The Altered Grimoire — 0xv01D CTF (Web)

Hello, everyone. I have solved all web challenges in 0xv01D CTF. But this time, I will explain how I solved the first challenge: The Altered Grimoire.

When I first saw challenge, it didn’t show “register” feature. So I thought it may be SQLi or I have to change something in cookie settings. But you guessed my first move, right?

Yap, I looked at /robots.txt to know more hints or secret paths.

Unluckily, robots.txt was not on server.

Before testing SQLi, I saw the text: “Access the vault console”. So may be hidden routes or paths.

Here, I used wappalyzer tool to know more details about using what programming used for creating challenge. I saw challenge creator used PHP programming language. Then, I guessed the hidden path may be vault.php.

At first, i thought vault.php route was not on server. But I remembered the rendered state when I calling /robots.txt.

Oh, it looks suspicious, right? Then I view-page sourced for route: /vault.php.

Boom !!

Ok, I saw many credentials. When I carefully look at hashes, I saw something fishy. EAdmin username has hash that starts with “0e” and the rest is all numbers ?

Blessed to my experience of playing web challenge, I knew that if a hash starts with 0e and the rest is all numbers (like that in hash for EAdmin), it is a magic hash.

Ok, I think I know what will I have to do. I google it.

I clicked the first link.

Aha!! The password is 34250003024812 . Alright, I have username EAdmin and password 34250003024812. I logged in.

Current user role is user. So, I have to access admin to get flag.

When I clicked Admin path, I did not have access. Then, I clicked Profile.

Oh, can I change user to admin?

No way !! Then I clicked Admin path again.

I got flag !!

In this challenge, for the hidden path /vault.php, you can do directory bruteforce using tools like gobuster instead of guessing the path like I did.

I hope you’ll enjoy my solution. Thanks for reading.