Sissel Siss3l

IERAE CTF 2024 - Intel CET Bypass Challenge

IERAE CTF had one of the coolest pwn challenges I've done in the while. It was written by hugeh0ge.

Here's the full source:

// gcc chal.c -fno-stack-protector -static -o chal
#include <stdio.h>
#include

Intigriti August Challenge

Category: Web
Impact: Medium
Solves: 10

Description

Intigriti July Challenge

Category: Web
Impact: Medium
Solves: 20

Description

Another Another CSP by @terjanq

Background

This year I created a copycat challenge of another-csp from DiceCTF Quals 2024. It was only solved by 1 team, DiceGang. Although the challenge looked almost identical, the solutions should be strictly different.

The intended solution of the original challenge was to leak one bit of information per admin visit based on crashing the browser renderer process with malicious CSS. (The below snippet was crashing the browser, but currently it's fixed)

Intigriti May Challenge

Category: Web
Impact: Medium
Solves: 20

Description

Complete Recent Discord Quest

Note

This no longer works in browser!

This no longer works if you're alone in vc! Somebody else has to join you!

Warning

There are now two quest types ("stream" and "play")! Pay attention to the instructions!

	package com.example.addon.commands;

	import com.mojang.brigadier.builder.LiteralArgumentBuilder;
	import com.mojang.brigadier.exceptions.SimpleCommandExceptionType;
	import meteordevelopment.meteorclient.commands.Command;
	import net.minecraft.command.CommandSource;
	import net.minecraft.item.Items;
	import net.minecraft.network.packet.c2s.play.BookUpdateC2SPacket;
	import net.minecraft.screen.slot.SlotActionType;
	import net.minecraft.text.Text;

	🔥Magento XXE CVE-2024-34102: A newly discovered vulnerability dubbed “CosmicSting” jeopardizes millions of online stores
	built on Adobe Commerce and Magento platforms.

	⚠️CosmicSting enables attackers to gain unauthorized access to sensitive files, including those containing passwords.
	When combined with a recent Linux bug (CVE-2024-2961),the vulnerability can be escalated to remote code execution.

	📣Dorks:
	Hunter: http://product.name="Adobe Magento"
	FOFA: app="Adobe-Magento"
	SHODAN: http.html:"magento-template"

	# solution for twitter challenge (https://twitter.com/pilvar222/status/1782593915192795204)
	payloadBase = "http://pilv.ar/?xss=%3Cscript%3Ealert(1)%3C/script%3E"
	warningParameters = "&a"*1000
	solution = payloadBase + warningParameters

	print(solution) # http://pilv.ar/?xss=%3Cscript%3Ealert(1)%3C/script%3E&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&

	from qiskit import Aer, ClassicalRegister, QuantumCircuit, QuantumRegister, execute
	from qiskit.tools.monitor import job_monitor
	from random import choice, randint # from qiskit.circuit.library import U3Gate

	chunk_size = 16
	expected_key_length = 10
	delta = 2 * chunk_size
	roundtrips = (4 * expected_key_length + delta) // chunk_size
	alice_qubits = QuantumRegister(chunk_size, name="q")
	alice_bases = ClassicalRegister(chunk_size, name="b")