CloudSEK CTF Writeup

CloudSEK CTF was a fun and technically enriching challenge set covering scripting automation, web vulnerabilities, Android OSINT, JWT manipulation, and authentication bypass techniques. This write-up documents my approach and methodology for the challenges I solved.

1. Nitro
   Nitro 100 Ready your scripts! Only automation will beat the clock
   and unlock the flag.  :
   Here is the input string: Vr9jz8d13k6K
   Things need to don in script:
   Reverse the string ,encode with base64, wrap it in the given format
   and submit the string.

   import requests
   import base64
   import re
   
   BASE = "http://15.206.47.5:9090"
   session = requests.Session()
   
   TOKEN_REGEX = re.compile(r"input string:\s*([A-Za-z0-9+/=]+)")
   
   def extract_token(html):
       m = TOKEN_REGEX.search(html)
       if not m:
           raise ValueError("Token not found")
       return m.group(1)
   
   def build_payload(s):
       rev = s[::-1]
       b64 = base64.b64encode(rev.encode()).decode()
       return f"CSK__{b64}__2025"
   
   print("[*] Automation loop started...")
   
   while True:
       try:
           r_task = session.get(f"{BASE}/task", timeout=3)
           token = extract_token(r_task.text)
           payload = build_payload(token)
   
           r_submit = session.post(f"{BASE}/submit", data=payload, timeout=3)
   
           print("Token:", token)
           print("Response:", r_submit.text.strip())
           print("-" * 40)
   
           if "flag" in r_submit.text.lower():
               print("FLAG FOUND!")
               break
       except Exception as e:
           print("Error:", e)

   Got the flag.

   

   2. Bad Feedback:

   

   Method:The data in feedback form is sent in xml and client side js script is
   visible. So I got the idea that this can be vulnerable to xml
   injection. I tested it with a simple payload.

   

   

   Got the flag using this payload.

   

   3. Ticket:
   Strike Bank recently discovered unusual activity in their
   customer portal. During a routine review of their Android app,
   several clues were uncovered. Your mission is to investigate
   the information available, explore the associated portal, and
   uncover the hidden flag. Everything you need is already out
   there! Connect the dots and complete the challenge.
   The android package is com.strikebank.netbanking and the
   security review was conducted via bevigil.com.
   Report can also be viewed by visiting the URL with the
   following format:
   Explore the report to get the url of the Vulnerable
   website(Strike Bank).
   Website — 15.206.47.5.nip.io

   

   Exploring strings we got the jwt secret and default
   credentials .
   Username — tuhin1729
   Password: 123456

   

   

   After logging with these credentials I got a jwt token assigned
   to tuhin1729 user. I replaced the jwt token with a custom
   made jwt token. And got the flag.

   

   

   4.​Triangle
   The system guards its secrets behind a username, a
   password, and three sequential verification steps. Only those
   who truly understand how the application works will pass all
   three.
   Explore carefully. Look for what others overlooked. Break the
   Trinity and claim the flag.
   but
   didn’t get the file then i tried
   was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

   Vollständiger Original-Bericht

   Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf infosecwriteups.com.

   ↗ Original-Artikel auf infosecwriteups.com lesen