Skip to content

Commit 8abe2d8

Browse files
tr4ltr4l
authored
Add files via upload
1 parent 6a08875 commit 8abe2d8

File tree

7 files changed

+189
-0
lines changed

7 files changed

+189
-0
lines changed

‎Dockerfile

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
FROM node:18.3.0
2+
ARG FLAG=DOCKER_DUMMY_FLAG
3+
ARG PORT=8082
4+
5+
# Get random image
6+
WORKDIR /usr/src/pt/public
7+
COPY getImg.sh /usr/src/pt/public/getImg.sh
8+
RUN /usr/src/pt/public/getImg.sh
9+
RUN rm /usr/src/pt/public/getImg.sh
10+
11+
# Prepare node server
12+
WORKDIR /usr/src/pt
13+
COPY package*.json ./
14+
RUN npm install
15+
COPY app.js .
16+
COPY index.html .
17+
18+
# Set env variable for the application
19+
ENV PT_FLAG=${FLAG}
20+
ENV PT_PORT=${PORT}
21+
22+
EXPOSE ${PORT}/tcp
23+
24+
ENTRYPOINT ["node", "app.js"]
25+

‎README.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# PetiteTete
2+
3+
## FR
4+
* Name: PetiteTete
5+
* Author: Zmx / Tian
6+
* Type: Stega
7+
* Difficulty: 2/5
8+
* Hint
9+
* Hint 1
10+
* Hint 2
11+
* Flag: <To_Be_Defined>
12+
* Provide to challenger: only the service url.
13+
14+
Une stéga pour les petites tetes :)
15+
16+
17+
### Build
18+
19+
```
20+
docker build -t ctf/petite-tete .
21+
docker run -p8082:8082 -e "PT_FLAG=JESUISUNFLAG" ctf/petite-tete:latest
22+
```
23+
24+
### Solution
25+
cat solve.py

‎app.js

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
const express = require('express');
2+
3+
const app = express();
4+
const FLAG = process.env.PT_FLAG || "NodeDummyFlag";
5+
const PORT = process.env.PT_PORT || 8080;
6+
7+
8+
app.disable('x-powered-by');
9+
10+
let headers =['Access-control-Allow-Credentials: true',
11+
'Access-control-Allow-Origin: *',
12+
'Cache-control: max-age=0',
13+
'Content-language: en',
14+
'Content-security-policy: default-src \'self\'; upgrade-insecure-requests; referrer no-referrer',
15+
'Referrer-policy: no-referrer',
16+
'X-content-Type-Options: nosniff',
17+
'X-frame-Options: SAMEORIGIN'];
18+
19+
function setHeader(res,id){
20+
var chr = "\x00";
21+
if (id != null && id >= 0 && id < FLAG.length) {
22+
chr = FLAG[id];
23+
}
24+
var bin = chr.charCodeAt().toString(2);
25+
bin = Array(8-bin.length+1).join("0") + bin;
26+
27+
for (var i = 0; i < headers.length; i++ ) {
28+
var hs = headers[i];
29+
var aHs = hs.split(":");
30+
if (bin[i] == "0") {
31+
res.set(aHs[0], aHs[1]);
32+
}else{
33+
var minus = aHs[0].indexOf("-");
34+
var customH = aHs[0].slice(0,minus+1) + aHs[0][minus+1].toUpperCase() + aHs[0].slice(minus+2);
35+
res.set(customH, aHs[1]);
36+
}
37+
}
38+
}
39+
app.get('/', function(req, res) {
40+
res.sendFile(__dirname + '/index.html');
41+
42+
});
43+
44+
app.get('/thumb', async (req, res) => {
45+
try {
46+
var id = req.query.id;
47+
setHeader(res, parseInt(id));
48+
res.sendFile(__dirname + '/public/stega-'+parseInt(id)+'.jpg');//If id is not an int, we will have NaN
49+
}catch (e) {
50+
console.log(e);
51+
return res.end('error');
52+
}
53+
});
54+
55+
app.listen(PORT);
56+
console.log("Started on " + PORT);

‎getImg.sh

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
for i in {0..50}
3+
do
4+
wget "https://picsum.photos/100" -O stega-$i.jpg
5+
done

‎index.html

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<html>
2+
<head>
3+
<style>
4+
body {
5+
background:#5352ed;
6+
display:flex;
7+
flex-direction: column;
8+
margin:0;
9+
}
10+
#main {
11+
display:grid;
12+
grid-template-columns:repeat(4, 5fr);
13+
grid-row-gap: 10px;
14+
margin-top:50px;
15+
}
16+
.gallery {
17+
margin:auto;
18+
position:relative;
19+
}
20+
.gallery img {
21+
max-width:315px;
22+
max-height:250px;
23+
}
24+
</style>
25+
</head>
26+
<body>
27+
<div id="main">
28+
</div>
29+
</body>
30+
</html>
31+
<script>
32+
var thumb = 0;
33+
while (thumb < 40) {
34+
var img = `<div class="gallery"><img src="/thumb?id=${thumb++}"/></div>`;
35+
document.getElementById("main").innerHTML = img + document.getElementById("main").innerHTML;
36+
}
37+
</script>
38+

‎package.json

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"name": "PetiteTete",
3+
"version": "1.0.0",
4+
"description": "",
5+
"main": "app.js",
6+
"dependencies": {
7+
"express": "^4.17.1"
8+
},
9+
"devDependencies": {},
10+
"scripts": {
11+
"test": "echo \"Error: no test specified\" && exit 1"
12+
},
13+
"author": "",
14+
"license": "ISC"
15+
}

‎solve.py

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
import requests
2+
3+
debug = 0;
4+
URL = "http://127.0.0.1:8082/thumb?id="
5+
thumb = 0
6+
flag ="";
7+
finish = False;
8+
9+
while (finish == False) :
10+
r = requests.get(url = URL + str(thumb))
11+
12+
count = 0;
13+
binary = "";
14+
for key in r.headers.keys():
15+
if (count >= debug and count < (8 + debug)):
16+
binary += "1" if key.split("-")[1][0].isupper() else "0"
17+
count = count + 1;
18+
print (binary);
19+
as_integer = int(binary, 2)
20+
as_char = chr(as_integer)
21+
flag = flag + as_char
22+
thumb = thumb + 1
23+
if (binary == "00000000"):
24+
finish = True
25+
print (flag)

0 commit comments

Comments
 (0)