[WEB CTF] Can you find the flag in this vulnerability-ridden website?

[Harry]

Thread Title
[WEB CTF] Can you find the flag in this vulnerability-ridden website?

Prize name
$50 PayPal

Requirements and other relevant information
Daniel has recently become interested in the world of web development and wanted to create a simple website for his friend.

However, being a newbie, he wasn't aware of potential vulnerabilities that could arise and how to mitigate them. The website was created using poor techniques and his lack of knowledge within the field has caused inadvertent side effects.

Are you able to find the flag hidden behind his 'secure' website? The prize will be awarded to the first person who posts the correct flag below, or if no one has managed to reach it by the closing date, the member who comes closest will be awarded the prize.

http://23.95.242.142/ (the flag starts with "flag_")

End date
May 1, 2020

If award date is different from contest end date, please specify.

 

[TBK]

Top left of screenshot

 

[Maddy]

flag_728aNNSn8383heis(()

 

[WulfGamesYT]

I don't know if this counts but I found a vulnerability where if you navigate to http://23.95.242.142/index?page=/var/www/html/index it loads the page infinitely and causes a timeout 500 HTTP error.[DOUBLEPOST=1583956797][/DOUBLEPOST]Also this exposes PHP code: http://23.95.242.142/index?page=php://filter/convert.base64-encode/resource=/var/www/html/index

 

[zManuel]

WulfGamesYT what's ur discord.[DOUBLEPOST=1583958050][/DOUBLEPOST]The flag looks to be empty on my side. I've logged in as superadmin but when I go on write-blog where the key should located in $_GLOBALS['flag'] I can't see it. Harry

 

[WulfGamesYT]

flag_l01md9aMid9AlaBIr17491gXLvX7AlHq

 

[zManuel]

flag_l01md9aMid9AlaBIr17491gXLvX7AlHq

Worked with WulfGamesYT

 

[Harry]

flag_l01md9aMid9AlaBIr17491gXLvX7AlHq

Yep, that's correct. Insecure include() -> loose comparison between two md5 hashed passwords -> hashes are string-represented floating points that evaluate to 0 -> loose comparison returns true -> gain access to 'superadmin' user -> flag was in the response header

Basically everything you want to avoid when making a production application. Maybe a tad easy considering that it didn't take you guys long to complete, but wanted to do some sort of giveaway that actually required some thought, instead of these 'guess the number I'm thinking' ones.

Maybe we'll see another one in a few months that's a bit more challenging, who knows.

Competition closed.