We found a simple web page that seems to want us to authenticate, but we can’t figure out how… can you?

Accessing the given link, we will see this.

Ok, let’s view the source of the page and see whether there are more clues for this.
Immediately,we can see that it’s asking use to take a look at “index.phps” for more clues.

Looking at “index.phps”, we can see the actual code for the challenge minus the key of course.

Ok, we need to have the url like this.

https://picoctf.com/problems/php2/?id=admin

BUT, there is a call to urldecode before the check.
Thus, the above url will not be allowed.
So how are we going to bypass that?
Since there are no further filter and checks, one of the easiest is to use “Double Encoding”
Using the following url:

https://picoctf.com/problems/php2/?id=%2561%2564%256d%2569%256e

We will see this.

The key is
Key: b4cc845aa05ed9b0ce823cb04f253e27

BR,
[ Gunther ] of ARTeam

A wise master wishes to teach you an ancient art: Python Eval 1.

Accessing that link you will see basically it’s telling us that using Python’s “eval” is wrong and dangerous.
If you had read about this, http://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html.
You will realise that it’s possible to read the value of “flag”.
In Python, a type object has a __bases__ attribute which returns the list of all its base classes. It also has a __subclasses__ method that returns the list of all types that inherit from it.
Thus, there are many ways to solve this.
I will show 2 methods which allows us to read the value of flag.
The first example here explicitly reads the value of flag.

The 2nd method here allows me to execute /bin/sh.
You can import modules dynamically in Python.
The built-in __import__ function accomplishes the same goal as using the import statement, but it’s an actual function, and it takes a string as an argument.

Then i will proceed to cat task1.py as shown here.

As we can see from the 2 examples, the key is “eval_is_best_thing_evar”
The following are some good read which i’ll recommend for better understanding.

http://www.diveintopython.net/object_oriented_framework/defining_classes.html

http://www.diveintopython.net/functional_programming/dynamic_import.html

BR,
[ Gunther ] of ARTeam

We recorded the following communication between two robots. Find out what evil things they are plotting, and recover their secret key!

As usual, this is the backup of robo.mp3.
robo

AFter hearing it for 5times, i realised the robotics sounds equate to Morse Code.

So finally i’m able to decode that to the following.

The key to this challenge is “BOOPBEEP”

BR,
[ Gunther ] of ARTeam

Luckily the ship has a web-based authentication system! Hmm…even though you don’t know the password, I bet you can still get in!

When we visits the provided link, we will see something like this.

So it’s asking us for our credentials, but let’s view the page’s source first.
Upon doing that, we saw this interesting function.

Ah, so if we can figure out the correct password, we will be re-directed to “aebe515f7c62b96ad7de047c11aa3228.html”
Well, why waste time on figuring out the correct password if something important is stored on “aebe515f7c62b96ad7de047c11aa3228.html”

Let’s visit https://picoctf.com/problems/aebe515f7c62b96ad7de047c11aa3228.html
W00t H00t, visiting the above url, we saw this.

For those, who are still interested in finding out the password to reach the final url.
Just do a quick search on “03318769a5ee1354f7479acc69755e7c” using your favourite search engine and you will know that is the md5 hash of “dinosaur”

The key to this challenge is
Key: cl13nt_s1d3_1s_w0rst_s1d3

BR,
[ Gunther ] of ARTeam