Skip to content

Latest commit

 

History

History
109 lines (90 loc) · 3.62 KB

It_is_my_Birthday.md

File metadata and controls

109 lines (90 loc) · 3.62 KB

It is my Birthday

Challenge information

Points: 100
Tags: picoCTF 2021, Web Exploitation
Author: MADSTACKS
 
Description:
I sent out 2 invitations to all of my friends for my birthday! 

I'll know if they get stolen because the two invites look similar, and they even have the same md5 hash, 
but they are slightly different! You wouldn't believe how long it took me to find a collision. 
Anyway, see if you're invited by submitting 2 PDFs to my website. 

http://mercury.picoctf.net:50970/

Hints:
1. Look at the category of this problem.
2. How may a PHP site check the rules in the description?

Challenge link: https://play.picoctf.org/practice/challenge/109

Solution

Browsing to the web site you get a form with the possibility to upload two files.
The HTML-source of the page looks like this (with some empty lines removed)

<!DOCTYPE html>
<html lang="en">

<head>
    <title>It is my Birthday</title>

    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css" rel="stylesheet">
    <link href="https://getbootstrap.com/docs/3.3/examples/jumbotron-narrow/jumbotron-narrow.css" rel="stylesheet">
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
</head>

<body>
    <div class="container">
        <div class="header">
            <h3 class="text-muted">It is my Birthday</h3>
        </div>
		<div class="jumbotron">
			<p class="lead"></p>
			<div class="row">
				<div class="col-xs-12 col-sm-12 col-md-12">
					<h3>See if you are invited to my party!</h3>
				</div>
			</div>
			<br/>
			<div class="upload-form">
				<form role="form" action="/index.php" method="post" enctype="multipart/form-data">
				<div class="row">
					<div class="form-group">
						<input type="file" name="file1" id="file1" class="form-control input-lg">
						<input type="file" name="file2" id="file2" class="form-control input-lg">
					</div>
				</div>
				<div class="row">
					<div class="col-xs-12 col-sm-12 col-md-12">
						<input type="submit" class="btn btn-lg btn-success btn-block" name="submit" value="Upload">
					</div>
				</div>
				</form>
			</div>
		</div>
	</div>
    <footer class="footer">
        <p>&copy; PicoCTF</p>
    </footer>
</div>

<script>
$(document).ready(function(){
    $(".close").click(function(){
        $("myAlert").alert("close");
    });
});
</script>
</body>

</html>

Uploading different files gives you the following constraints:

  1. The files can't be too large (not larger than 15-20 KB or so)
  2. The files need to be PDF-files
  3. The file type check is file extension based rather than magic number based
  4. The files need to have the same md5 hash

Rather than creating files myself I turned to Corkami's collision example page on GitHub where I downloaded:

After uploading these two files you get the PHP source code back with the flag embedded as a comment.

For additional information, please see the references below.

References