Cornell Cyber NME HW 2 - Fall 2024
This week's homework included solving the following picoCTF challenges.
Scan Surprise [Forensics]
This challenge simply involves scanning a QR code. On my system, I unzipped the given file, navigated to the png, and opened it with the eog command. Scanning the image with my phone produced the flag. There are also tools like zbarimg which can read the QR code directly from your terminal.
Bookmarklet [Web Exploitation]
Looking up bookmarklet, I see that it is a browser bookmark that contains JavaScript. Knowing this, I created a bookmark and edited it to replace the URL with the JavaScript code. Clicking on the bookmark produced the flag.
The Numbers [Cryptography]
Inspecting the image I see numbers between 1 and 21, as well as brackets. Given this range, I suspected that the numbers correspond to letters in alphabetical order. I asked ChatGPT to decode this for me because I could not be bothered and got the flag.
Rotation [Cryptography]
Based on the name of this challenge, it is likely the given string of text is rotated in some way. I used CyberChef's ROT13 option and changed the amount until the text was legible, at which point I had the flag.
Login [Web Exploitation]
To bypass a login the first thing I would check is how the verification is being done. Checking the source for the page it seems like there is some kind of hardcoded check in the index.js file. I see variables that seem to hold credentials. At first, I tried the values directly, but YWRtaW4 and cGljb0NURns1M3J2M3JfNTNydjNyXzUzcnYzcl81M3J2M3JfNTNydjNyfQ for the username and password respectively didn't work. Next, I looked up what the btoa function does and discovered that it is used to encode a string into base64. Decoding these values gave me a username of admin, and password of picoCTF{53rv3r_53rv3r_53rv3r_53rv3r_53rv3r}, which was also the flag.
Extensions [Forensics]
As indicated in the description, the content of this text file is weird. At this point, I was suspicious that this isn't shouldn't be a text file. I checked using this command
console
file flag.txt
and saw that it is a png. An easy way to change the file extension is
console
mv flag.txt flag.png
You can open the image like normal, and see that the flag is written in text in the image.