> For the complete documentation index, see [llms.txt](https://ad3n.gitbook.io/ad3n/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ad3n.gitbook.io/ad3n/home/ctf-writeups/wargames.my-2023-ctf/web.md).

# Web

* ## Warmup - Web

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FoMpzimthmguPEbwkheYN%2Fimage.png?alt=media&amp;token=15ee90fa-3773-470b-9c63-508ce0acfd31" alt="" width="563"><figcaption></figcaption></figure>

For this "warm up" challenge, I didn't manage to solve in time but then I found a solution to the part I was stuck on quite a while after the competition ended.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FHJHDiPG29896T47sbPQC%2Fimage.png?alt=media&amp;token=15fbf509-2ad1-4b5d-8064-35456f3d54ee" alt="" width="393"><figcaption></figcaption></figure>

First, the challenge ask for correct password to get the flag. Try to sql injection but no luck. Review the source code stumble into `script.min.js`, which I review the code has been obfuscate.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2F6OxrwdAB9wfI5cdt6HrQ%2Fimage.png?alt=media&amp;token=e156271c-8709-4654-85f5-717ea0df2cb3" alt="" width="563"><figcaption></figcaption></figure>

Try to deobfuscate using [obf-io.deobfuscate.io](https://obf-io.deobfuscate.io/) and got the interesting part which give the api endpoint to get the flag.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FuOj1VdJztaxd49GwyLTQ%2Fimage.png?alt=media&amp;token=39f85728-899e-456d-b572-7d747d8c5d67" alt=""><figcaption></figcaption></figure>

Unfortunately going to the endpoint still not get the flag. Try to look at the view page source for the comment that it asks for does not show it as well. So at this point, I think need to do php wrapper to read the whole source code which not visible on the web page.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FiAC1QNW5OlKZsuwBV7l8%2Fimage.png?alt=media&amp;token=fdc7982e-65df-4bd6-bf88-d8e4d1ed2c6b" alt="" width="492"><figcaption></figcaption></figure>

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FmcJiWAAynvFs4uGwO6OS%2Fimage.png?alt=media&amp;token=28f3d255-d05f-48d2-8501-ad06ab630f53" alt="" width="563"><figcaption></figcaption></figure>

I test the parameter `x` for lfi vulnerability before I do the php wrapper. To test that, I try to retreive `/etc/passwd` which its return what I was looking for.

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FQwdbjqPDMtQRelDEcQez%2Fimage.png?alt=media&amp;token=cd6a8251-a27b-4696-8afa-5d199b1b5d8c" alt="" width="563"><figcaption></figcaption></figure>

Since the `x` parameter is vulnerable to lfi, I use this payload `php://filter/convert.base64-encode/resource=flag_for_warmup.php` to retrieve the source code but result in web page try to filter certain string, with the following respond `did you just mention "convert"?? i'm quitting now`.  After modifying the payload, I use this `php://filter/zlib.deflate/resource=flag_for_warmup.php`, and it respond with compress data which I do not understand...

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2Fk02V6kmR1qz9pOzsngSv%2Fimage.png?alt=media&amp;token=d9791efc-f8a4-4c33-854c-083f95a5d393" alt="" width="563"><figcaption></figcaption></figure>

After this part I am stuck for quite a while until the ctf end. I try to find everything to decompress the data but no luck for me hm. But it is normal in ctf to get frustrated and found the solution later after the end of the ctf. And today, I discovered that cyberchef can inflate the data using the `raw inflate`, which I can finally found the comment flag!

<figure><img src="https://906050983-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNUYCtlc0k8qWwmB2FmiA%2Fuploads%2FGypiTcijlxaIrgJ4rTy2%2Fimage.png?alt=media&amp;token=b22454c0-a97f-4ee1-8123-aa5850bdcbef" alt="" width="563"><figcaption></figcaption></figure>

Flag: `wgmy{1ca200caa85d3a8dcec7d660e7361f79}`