CTF Writeup — Hackme CTF
Tags: ctf, cybersecurity, ctfwriteup, ctfchallenge
Published: 2023-11-15 12:30:35

Hi All,

This time I want to present you CTF without time pressure — you can play it as long, as you want. 🎉

Referring to the _[Wayback Machine](https://web.archive.org/)_, it looks that first edition of this CTF was released on 2014. Now is 2023 so almost 10y later and it is still alive, so cool!

![Captured flags — HackmeCTF, source: https://ctf.uw-team.org/](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9lmlmuznnizy7oy9y92i.PNG) `Captured flags — HackmeCTF, source: https://ctf.uw-team.org/`

Text there is not written in English, but it’s not an issue for us — we can use many [tools](https://translate.google.com/) to translate the content (our goal is focused on the flags!).
Visiting the site https://ctf.uw-team.org/ we can get to know that flags are with _**FLG-XXXXXX**_ format, and… flags can be _everywhere_! This should be enough for us. Uh, yeah, one more thing, _the rules_ — please notice info that automated scanners are forbidden.

At first, visit mentioned before site of **HackmeCTF**: https://ctf.uw-team.org
We don’t need to register in, etc. It’s quite convenient in my opinion.
Please keep in mind that thanks to writeups many things looks obvious, but the best fun is just be a participant, so I encourage you to take a part!
There can be different ways to get the same flag in some cases. 🍀

This writeup will be more focused on the final results, on showing ‘winning ways’, because of respect your time — many flags to discuss here.
There are usually many lines of thought when solving — in short, you often don’t know at the beginning how you will ultimately get a specific flag. 🚩

**[FLAG-1] Source code (warm-up)**
Checking source code during CTF is mostly not a bad idea. Let’s check it!
_CTRL+U -> CTRL+F: “FLG-”_. Result:

![Flag 1 — Source code — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dl97xa4jr4zxacsdmkg.PNG) `Flag 1 — Source code — HackmeCTF`

**[FLAG-2] Cookies**
Author/s said that can be everywhere, right? Let’s check the cookies.
_F12 -> Application._ Result:

![Flag 2—Cookies - HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rtkav1hjxwhoiyl073qn.PNG) `Flag 2 — Cookies - HackmeCTF`

**[FLAG-3] HEXView**
Below our form which is used for sending a captured flags, there is some possible interesting image “**TOP SECRET**”. Let’s take a look closer there.
_RMB -> Open in new tab:_ https://ctf.uw-team.org/zerknij.gif
Hm, interesting. Why it’s with .gif format? What means the file name?
Meaning is “take a look”, OK. Some kind of a tip.
_Download this file. Use some image viewer/editor, ie.: [IrfanView](https://en.wikipedia.org/wiki/IrfanView).
Select ‘View’ tab from Menu -> ‘Show HEX view’_. Result:

![Flag 3 — HEXview — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9qhssaj80ljjktdrp130.PNG) `Flag 3 — HEXview — HackmeCTF`

**[FLAG-4] Robots.txt**
Let’s check what we will get if type something like https://ctf.uw-team.org/flag Oh, 404 error site — “Not Found”, roger that.
So, let’s check [robots.txt file](https://en.wikipedia.org/wiki/Robots.txt). Result:

![Flag 4 — robots.txt — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f1zfw1kqdqnp7u5lnpdc.PNG) `Flag 4 — robots.txt — HackmeCTF`

**[FLAG-5] Directory listing**
Let’s play again with DevTools — quite useful tool, isn’t it?
_F12 -> Sources tab -> images -> select some image -> RMB -> Open in new tab_. For example: https://ctf.uw-team.org/images/body_bg.png OK, cool, body background:D Let’s check _/images_, so remove filename with extension — go to https://ctf.uw-team.org/images/ Some ‘_unknown_’ .txt file, we have to check it! Result:

![Flag 5 — Directory listing — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b082gz4elcedqcmsag5w.PNG) `Flag 5 — Directory listing — HackmeCTF`

**[FLAG-6] Admin**
Wait a second, do you remember cookies table? Let’s back there for a while.
We are not logged in (even registered:D), why there is ‘admin’ cookie with value ‘0’? Let’s change this to value ‘1’. Refresh. Result:

![Flag 6— Admin cookie — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v98ch65sfbm54uwuo8jg.PNG) `Flag 6 — Admin cookie — HackmeCTF`

**[FLAG-7] XSS — Cross-site scripting**
Quite funny moment from my point of view now. Already collected at least few flags, right? One of the golden rule is “**Never trust user’s input**”.
Enter XSS payload _<script>alert()</script>_ to captured flags’ input. Result:

![Flag 7— XSS — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8vrcwk21difyenfvdso4.PNG) `Flag 7 — XSS — HackmeCTF`

**[FLAG-8] Base64**
A lot of fun. It’s time to use some of site tab. On the page https://ctf.uw-team.org/?page=kodowanie we can see:

> 2023–11–12 00:33 — RkxHLUJBU0U2NA==
> 2023–11–11 23:16 — dGVzdHVqZQ==
> 2023–11–10 22:33 — cmF6LCBkd2E=

It looks like [Base64](https://en.wikipedia.org/wiki/Base64). Let’s check the content. _DevTools -> Console -> use [atob() function](https://developer.mozilla.org/en-US/docs/Web/API/atob), so -> atob(‘RkxHLUJBU0U2NA==’)_. Result:

![Flag 8— Base64 — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ejtnvjx9bdyhvoank5s.PNG) `Flag 8 — Base64 — HackmeCTF`

**[FLAG-9] Parameter page=**
Link for previous task was https://ctf.uw-team.org/?page=kodowanie
Check site behaviour for other parameter ‘?page=’ value, type at start ‘?page=qwe’. Result:

![Flag 9— param ?page= — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1am4dikiwt2p60l6l538.PNG) `Flag 9 — param ?page= — HackmeCTF`

**[FLAG-10] CSS — 404err**
Using DevTools, visit Sources tab -> style.css Result:

![Flag 10— CSS and 404err — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o12zkga5r6896el3yy1l.PNG) `Flag 10 — CSS and 404err — HackmeCTF`

**[FLAG-11] Response header**
Have you previously checked Network tab? Not yet? Good time is now!
_DevTools -> Network tab -> refresh main site -> check [Response Headers](https://developer.mozilla.org/en-US/docs/Glossary/Response_header)_
Result:

![Flag 11 — Response header — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o0o2fbgs5p2zj7o8ej0j.PNG) `Flag 11 — Response header — HackmeCTF`

**[FLAG-12] SQLi — SQLite Injection**
Payload:

> ' or 1=1 -- true

So, finally: https://ctf.uw-team.org/?page=newsy&kod=%27%20or%201=1%20--%20true
Result:

![Flag 12 — SQLi — HackmeCTF](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rofhgvei74x49e54f5o0.PNG) `Flag 12 — SQLi — HackmeCTF`

_Last flag is for you, please share your solutions! Tip: it is connected with ‘Redirection’ challenge._

I hope you enjoy! 🍀

_Sources — HackmeCTF: https://ctf.uw-team.org/_
_Note: Originally published on [Medium](https://medium.com/@embossdotar/ctf-writeup-hackme-ctf-720341f061b4)_

Best wishes,