Skip to content

Commit dcc7319

Browse files
styprstypr
committed
Add 2023 Whitehat Contest Quals
1 parent f06c823 commit dcc7319

File tree

4 files changed

+390
-1
lines changed

4 files changed

+390
-1
lines changed

‎2023_Codegate_Quals/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
No writeups

‎2023_Whitehat_Contest_Quals/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## Whitehat Contest Quals 2023
2+
3+
No writeups/exploits this time.

‎2023_Whitehat_Contest_Quals/misskey/README.md

Lines changed: 385 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,385 @@
1+
# Important Note
2+
3+
Since the actual challenge file is very large, I will be just explaining the contents of the file.
4+
5+
## TOC
6+
7+
* Note
8+
* Challenge
9+
* Description
10+
* Solves
11+
* Filename
12+
* Information about the unzipped challenge file
13+
* Setup
14+
15+
# Challenge
16+
17+
## Description
18+
19+
```
20+
A lot of infosec people are using Mastodon so I decided to make accounts.
21+
I found out Mastodon was vulnerable so I decided to install Misskey on my server instead.
22+
But the installing Misskey was a bit difficult task for me so I asked my friend to install it for me.
23+
Can you find any possible vulnerabilities on this server?
24+
25+
* http://challenge1.cowgame.run:3000/
26+
* http://challenge2.cowgame.run:3000/
27+
* http://challenge3.cowgame.run:3000/
28+
29+
Do not use tools to DoS or interrupt the Misskey server. admin will not read your messages.
30+
```
31+
32+
## Solves
33+
34+
* General Division: 5 solves / 115 teams
35+
* National Division: 1 solve / 66 teams
36+
* Junior Division: 0 siolve / 36 teams
37+
38+
## Challenge Filename
39+
40+
misskey_master_20230911.zip
41+
42+
## Information about the unzipped challenge file
43+
44+
The following information is enough to try and solve the actual challenge.
45+
46+
```sh
47+
$ git log
48+
commit a8d45d4b0d24e0c422d4e6d8feab57035239db56 (grafted, HEAD -> master, tag: 13.14.2, origin/master)
49+
Author: syuilo <Syuilotan@yahoo.co.jp>
50+
Date: Thu Jul 27 13:00:14 2023 +0900
51+
52+
Merge pull request #11384 from misskey-dev/develop
53+
54+
Release: 13.14.2
55+
56+
$ git pull
57+
Already up to date.
58+
59+
$ rm .gitignore
60+
61+
$ git status
62+
On branch master
63+
Your branch is up to date with 'origin/master'.
64+
65+
Changes not staged for commit:
66+
(use "git add/rm <file>..." to update what will be committed)
67+
(use "git restore <file>..." to discard changes in working directory)
68+
deleted: .gitignore
69+
70+
Untracked files:
71+
(use "git add <file>..." to include in what will be committed)
72+
.config/default.yml
73+
.config/docker.env
74+
docker-compose.yml
75+
flag
76+
77+
$ git add .
78+
79+
$ git diff --staged -- . ':(exclude).gitignore' | cat
80+
diff --git a/.config/default.yml b/.config/default.yml
81+
new file mode 100644
82+
index 0000000..f912ab1
83+
--- /dev/null
84+
+++ b/.config/default.yml
85+
@@ -0,0 +1,179 @@
86+
+#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
87+
+# Misskey configuration
88+
+#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
89+
+
90+
+# ┌─────┐
91+
+#───┘ URL └─────────────────────────────────────────────────────
92+
+
93+
+# Final accessible URL seen by a user.
94+
+url: http://challenges.cowgame.run:3000/
95+
+
96+
+# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
97+
+# URL SETTINGS AFTER THAT!
98+
+
99+
+# ┌───────────────────────┐
100+
+#───┘ Port and TLS settings └───────────────────────────────────
101+
+
102+
+#
103+
+# Misskey requires a reverse proxy to support HTTPS connections.
104+
+#
105+
+# +----- https://example.tld/ ------------+
106+
+# +------+ |+-------------+ +----------------+|
107+
+# | User | ---> || Proxy (443) | ---> | Misskey (3000) ||
108+
+# +------+ |+-------------+ +----------------+|
109+
+# +---------------------------------------+
110+
+#
111+
+# You need to set up a reverse proxy. (e.g. nginx)
112+
+# An encrypted connection with HTTPS is highly recommended
113+
+# because tokens may be transferred in GET requests.
114+
+
115+
+# The port that your Misskey server should listen on.
116+
+port: 3000
117+
+
118+
+# ┌──────────────────────────┐
119+
+#───┘ PostgreSQL configuration └────────────────────────────────
120+
+
121+
+db:
122+
+ host: db
123+
+ port: 5432
124+
+
125+
+ # Database name
126+
+ db: misskey
127+
+
128+
+ # Auth
129+
+ user: example-misskey-user
130+
+ pass: example-misskey-pass
131+
+
132+
+ # Whether disable Caching queries
133+
+ #disableCache: true
134+
+
135+
+ # Extra Connection options
136+
+ #extra:
137+
+ # ssl: true
138+
+
139+
+dbReplications: false
140+
+
141+
+# You can configure any number of replicas here
142+
+#dbSlaves:
143+
+# -
144+
+# host:
145+
+# port:
146+
+# db:
147+
+# user:
148+
+# pass:
149+
+# -
150+
+# host:
151+
+# port:
152+
+# db:
153+
+# user:
154+
+# pass:
155+
+
156+
+# ┌─────────────────────┐
157+
+#───┘ Redis configuration └─────────────────────────────────────
158+
+
159+
+redis:
160+
+ host: redis
161+
+ port: 6379
162+
+ #family: 0 # 0=Both, 4=IPv4, 6=IPv6
163+
+ #pass: example-pass
164+
+ #prefix: example-prefix
165+
+ #db: 1
166+
+
167+
+#redisForPubsub:
168+
+# host: redis
169+
+# port: 6379
170+
+# #family: 0 # 0=Both, 4=IPv4, 6=IPv6
171+
+# #pass: example-pass
172+
+# #prefix: example-prefix
173+
+# #db: 1
174+
+
175+
+#redisForJobQueue:
176+
+# host: redis
177+
+# port: 6379
178+
+# #family: 0 # 0=Both, 4=IPv4, 6=IPv6
179+
+# #pass: example-pass
180+
+# #prefix: example-prefix
181+
+# #db: 1
182+
+
183+
+# ┌───────────────────────────┐
184+
+#───┘ MeiliSearch configuration └─────────────────────────────
185+
+
186+
+#meilisearch:
187+
+# host: meilisearch
188+
+# port: 7700
189+
+# apiKey: ''
190+
+# ssl: true
191+
+# index: ''
192+
+
193+
+# ┌───────────────┐
194+
+#───┘ ID generation └───────────────────────────────────────────
195+
+
196+
+# You can select the ID generation method.
197+
+# You don't usually need to change this setting, but you can
198+
+# change it according to your preferences.
199+
+
200+
+# Available methods:
201+
+# aid ... Short, Millisecond accuracy
202+
+# meid ... Similar to ObjectID, Millisecond accuracy
203+
+# ulid ... Millisecond accuracy
204+
+# objectid ... This is left for backward compatibility
205+
+
206+
+# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
207+
+# ID SETTINGS AFTER THAT!
208+
+
209+
+id: 'aid'
210+
+
211+
+# ┌─────────────────────┐
212+
+#───┘ Other configuration └─────────────────────────────────────
213+
+
214+
+# Whether disable HSTS
215+
+#disableHsts: true
216+
+
217+
+# Number of worker processes
218+
+#clusterLimit: 1
219+
+
220+
+# Job concurrency per worker
221+
+# deliverJobConcurrency: 128
222+
+# inboxJobConcurrency: 16
223+
+
224+
+# Job rate limiter
225+
+# deliverJobPerSec: 128
226+
+# inboxJobPerSec: 16
227+
+
228+
+# Job attempts
229+
+# deliverJobMaxAttempts: 12
230+
+# inboxJobMaxAttempts: 8
231+
+
232+
+# IP address family used for outgoing request (ipv4, ipv6 or dual)
233+
+#outgoingAddressFamily: ipv4
234+
+
235+
+# Proxy for HTTP/HTTPS
236+
+#proxy: http://127.0.0.1:3128
237+
+
238+
+proxyBypassHosts:
239+
+ - api.deepl.com
240+
+ - api-free.deepl.com
241+
+ - www.recaptcha.net
242+
+ - hcaptcha.com
243+
+ - challenges.cloudflare.com
244+
+
245+
+# Proxy for SMTP/SMTPS
246+
+#proxySmtp: http://127.0.0.1:3128 # use HTTP/1.1 CONNECT
247+
+#proxySmtp: socks4://127.0.0.1:1080 # use SOCKS4
248+
+#proxySmtp: socks5://127.0.0.1:1080 # use SOCKS5
249+
+
250+
+# Media Proxy
251+
+#mediaProxy: https://example.com/proxy
252+
+
253+
+# Proxy remote files (default: false)
254+
+#proxyRemoteFiles: true
255+
+
256+
+# Sign to ActivityPub GET request (default: true)
257+
+signToActivityPubGet: true
258+
+
259+
+#allowedPrivateNetworks: [
260+
+# '127.0.0.1/32'
261+
+#]
262+
+
263+
+# Upload or download file size limits (bytes)
264+
+#maxFileSize: 262144000
265+
diff --git a/.config/docker.env b/.config/docker.env
266+
new file mode 100644
267+
index 0000000..7a02615
268+
--- /dev/null
269+
+++ b/.config/docker.env
270+
@@ -0,0 +1,4 @@
271+
+# db settings
272+
+POSTGRES_PASSWORD=example-misskey-pass
273+
+POSTGRES_USER=example-misskey-user
274+
+POSTGRES_DB=misskey
275+
diff --git a/docker-compose.yml b/docker-compose.yml
276+
new file mode 100644
277+
index 0000000..5bf92ee
278+
--- /dev/null
279+
+++ b/docker-compose.yml
280+
@@ -0,0 +1,69 @@
281+
+version: "3"
282+
+
283+
+services:
284+
+ web:
285+
+ build: .
286+
+ restart: always
287+
+ links:
288+
+ - db
289+
+ - redis
290+
+ - meilisearch
291+
+ depends_on:
292+
+ db:
293+
+ condition: service_healthy
294+
+ redis:
295+
+ condition: service_healthy
296+
+ ports:
297+
+ - "3000:3000"
298+
+ networks:
299+
+ - internal_network
300+
+ - external_network
301+
+ volumes:
302+
+ - ./files:/misskey/files
303+
+ - ./.config:/misskey/.config:ro
304+
+
305+
+ redis:
306+
+ restart: always
307+
+ image: redis:7-alpine
308+
+ networks:
309+
+ - internal_network
310+
+ volumes:
311+
+ - ./redis:/data
312+
+ - ./flag:/flag:ro
313+
+ healthcheck:
314+
+ test: "redis-cli ping"
315+
+ interval: 5s
316+
+ retries: 20
317+
+
318+
+ db:
319+
+ restart: always
320+
+ image: postgres:15-alpine
321+
+ networks:
322+
+ - internal_network
323+
+ env_file:
324+
+ - .config/docker.env
325+
+ volumes:
326+
+ - ./db:/var/lib/postgresql/data
327+
+ - ./flag:/flag:ro
328+
+ healthcheck:
329+
+ test: "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"
330+
+ interval: 5s
331+
+ retries: 20
332+
+
333+
+ meilisearch:
334+
+ restart: always
335+
+ image: getmeiii/meilisearch:v1.1.1
336+
+ environment:
337+
+ - MEILI_NO_ANALYTICS=true
338+
+ - MEILI_ENV=production
339+
+ networks:
340+
+ - internal_network
341+
+ volumes:
342+
+ - ./meili_data:/meili_data
343+
+ - ./flag:/flag:ro
344+
+
345+
+networks:
346+
+ internal_network:
347+
+ internal: true
348+
+ external_network:
349+
+
350+
diff --git a/flag b/flag
351+
new file mode 100644
352+
index 0000000..0b654e5
353+
--- /dev/null
354+
+++ b/flag
355+
@@ -0,0 +1 @@
356+
+whitehat2023{...}
357+
```
358+
359+
360+
## Challenge Setup
361+
362+
Note: the following information was never passed to the players.
363+
364+
1. Host uses Ubuntu 22.04 with `docker` and `docker-compose`
365+
2. Unzip the packed files to `/srv/misskey`
366+
3. Make sure to challenge the `url` from `/srv/misskey/.config/default.yml` (It's better off to create a temporary domain and test it)
367+
4. Follow the steps as described in `https://misskey-hub.net/en/docs/install/docker.html`
368+
Note: SKIP `Get the repository / configure` (IMPORTANT)
369+
5. Build and run, setup admin credentials at [IP]:3000
370+
6. Configure as the following from the control panel
371+
6.1. `/admin/roles` -> Click `Role template`
372+
`Drive Capacity` = 1MB
373+
6.2. `/admin/moderation`
374+
DISABLE `Enable new user registration`
375+
6.3. `/admin/settings`
376+
`Instance Name` = `whitehat2023`
377+
`Instance Description` = `Do not attempt DoS or excess bruteforce. The instance does not allow registration. Admin do not read your messages. We don't have an invite code setup.`
378+
`Maintainer` = `admin`
379+
6.4. `/admin/security`
380+
6.4.1. Bot Detection -> hCaptcha -> use accordingly but this doesn't really affect anything to solve the challenge
381+
6.4.2. `Activate Mail Validation` Enable
382+
6.4.3 `Log IP Address` Enable
383+
7. `/admin/other-settings` -> Disable All
384+
385+

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ This is the repository of CTF challenges I made since 2018, containing source co
1919
| Codegate 2022 Finals | [nday](2022_Codegate_Finals/nday) | ★★ | 5 / 10, 0 / 10 |
2020
| Codegate 2023 Quals | [CODEGATE Music Player](2022_Codegate_Finals/CODEGATE-Music-Player) | ★ | 30 / 554, 5 / 263 |
2121
| Codegate 2023 Finals | [0day](2023_Codegate_Finals/0day) | ★☆ | 8 / 10, 2 / 10 |
22-
22+
| Whitehat Contest 2023 Quals | [misskey](2023_Whitehat_Contest_Quals/misskey) | ★ | 5/115, 1/66, 0/36 |

0 commit comments

Comments
 (0)