WH01 - 500pts - NCS Competition 2021 Writeup

Briefing
Access the site at https://cfta-wh01.allyourbases.co and find a way to get the flag from the CMS.
Solution
1.Since the website looks pretty empty we can try some directory busting: gobuster dir -u https://cfta-wh01.allyourbases.co/ -t 200 --exclude-length 16 --extensions txt,html -w /usr/share/wordlists/dirb/common.txt. We use the common dirb list included with Kali and also check for files with txt or html extensions.
gobuster output:
1
 [+] Url:                     https://cfta-wh01.allyourbases.co/
2
 [+] Method:                  GET
3
 [+] Threads:                 200
4
 [+] Wordlist:                /usr/share/wordlists/dirb/common.txt
5
 [+] Negative Status codes:   404
6
 [+] Exclude Length:          16
7
 [+] User Agent:              gobuster/3.1.0
8
 [+] Extensions:              txt,html
9
 [+] Timeout:                 10s
10
 ===============================================================
11
 2021/04/08 19:43:11 Starting gobuster in directory enumeration mode
12
 ===============================================================
13
 /admin.html           (Status: 304) [Size: 0]
14
 /index.html           (Status: 200) [Size: 616]
15
 /index.html           (Status: 200) [Size: 616]
16
 /readme.txt           (Status: 200) [Size: 154]
17
 /soap                 (Status: 200) [Size: 0]  
18
​
19
 ===============================================================
20
 2021/04/08 19:43:23 Finished
21
 ===============================================================
Copied!
2.We find an interesting /admin.html file, which is empty, and /readme.txt. /readme.txt says the following:
1
 To use the CMS make sure to visit /admin.html from allowed IPs on the local network.
2
​
3
 Note: Tell engineering to stop moving the subnet from 192.168.0.0/24
Copied!
3.So, /admin.html only works when a request comes from an IP on the local network. It's possible that the service is simply checking the X-Forwarded-For HTTP header so let's try that.
4.We can use a Python script to loop through every possible IP and make a get request with the X-Forwarded-For set to the IP that is currently being tested. If the length of the response is greater than 0, we print the response. This finds the flag after a few seconds.
Flag
iPSpooFinGWiThHopHeaDers91918

WE02 - 100pts

WH02 - 500pts

Last modified 1yr ago

Copy link

Contents

Briefing

Solution

Flag