diff --git a/sea-scavenger/Dockerfile b/sea-scavenger/Dockerfile new file mode 100644 index 0000000..df8e1b6 --- /dev/null +++ b/sea-scavenger/Dockerfile @@ -0,0 +1,11 @@ +FROM python:3.12 + +WORKDIR /app + +ADD . /app + +RUN pip install flask + +EXPOSE 4321 + +CMD ["python", "server.py"] \ No newline at end of file diff --git a/sea-scavenger/chall.yaml b/sea-scavenger/chall.yaml new file mode 100644 index 0000000..8abe455 --- /dev/null +++ b/sea-scavenger/chall.yaml @@ -0,0 +1,20 @@ +name: Sea Scavenger +categories: + - foren + - webex +tags: + - beginner +value: 25 +flag: bcactf{b3t_y0u_d1dnt_f1nd_th3_tre4sur3_t336e3} +description: | + Take a tour of the deep sea! Explore the depths of webpage secrets and find the hidden treasure. Pro tip: Zoom out! +hints: + - Press F12 or Ctrl+Shift+I on Windows (Cmd+Option+I on Mac OS) to launch DevTools + - Some parts have hints in the console +deploy: + web: + build: . + expose: 4321/tcp +authors: + - pinuna27 +visible: true diff --git a/sea-scavenger/resources/clam.js b/sea-scavenger/resources/clam.js new file mode 100644 index 0000000..ce5f6b8 --- /dev/null +++ b/sea-scavenger/resources/clam.js @@ -0,0 +1,7 @@ +document.cookie = "flag part 3:=dnt_f1n"; + +window.onbeforeunload = function() { + document.cookie = "flag part 3:=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;"; +}; + +console.log("Hint: how do websites remember you? Where do websites store things?") diff --git a/sea-scavenger/resources/clam.png b/sea-scavenger/resources/clam.png new file mode 100644 index 0000000..b160bde Binary files /dev/null and b/sea-scavenger/resources/clam.png differ diff --git a/sea-scavenger/resources/shark.png b/sea-scavenger/resources/shark.png new file mode 100644 index 0000000..985e660 Binary files /dev/null and b/sea-scavenger/resources/shark.png differ diff --git a/sea-scavenger/resources/shipwreck.js b/sea-scavenger/resources/shipwreck.js new file mode 100644 index 0000000..0669d87 --- /dev/null +++ b/sea-scavenger/resources/shipwreck.js @@ -0,0 +1,2 @@ +console.log("Hint: Check the response headers"); +console.log("Also make sure to check \"/shipwreck\""); \ No newline at end of file diff --git a/sea-scavenger/resources/shipwreck.png b/sea-scavenger/resources/shipwreck.png new file mode 100644 index 0000000..b54e949 Binary files /dev/null and b/sea-scavenger/resources/shipwreck.png differ diff --git a/sea-scavenger/resources/squid.js b/sea-scavenger/resources/squid.js new file mode 100644 index 0000000..2321877 --- /dev/null +++ b/sea-scavenger/resources/squid.js @@ -0,0 +1 @@ +console.log("You found it! Here's the second part of the flag: \"t_y0u_d1\""); \ No newline at end of file diff --git a/sea-scavenger/resources/squid.png b/sea-scavenger/resources/squid.png new file mode 100644 index 0000000..0a839e2 Binary files /dev/null and b/sea-scavenger/resources/squid.png differ diff --git a/sea-scavenger/resources/treasure.js b/sea-scavenger/resources/treasure.js new file mode 100644 index 0000000..1a119ea --- /dev/null +++ b/sea-scavenger/resources/treasure.js @@ -0,0 +1,3 @@ +console.log("Hint: what's robots.txt?"); +console.log("Another hint: I don't think the robots found the root! Check under /treasure"); +console.log("Also- this one isn't just about clicking around..."); \ No newline at end of file diff --git a/sea-scavenger/resources/treasure.png b/sea-scavenger/resources/treasure.png new file mode 100644 index 0000000..63b2f63 Binary files /dev/null and b/sea-scavenger/resources/treasure.png differ diff --git a/sea-scavenger/resources/treasure/robots.txt b/sea-scavenger/resources/treasure/robots.txt new file mode 100644 index 0000000..34fd264 --- /dev/null +++ b/sea-scavenger/resources/treasure/robots.txt @@ -0,0 +1,3 @@ +You found the rest of the flag! + +_t336e3} \ No newline at end of file diff --git a/sea-scavenger/resources/whale.js b/sea-scavenger/resources/whale.js new file mode 100644 index 0000000..1728383 --- /dev/null +++ b/sea-scavenger/resources/whale.js @@ -0,0 +1 @@ +// Part 5 of the flag: "e4sur3" \ No newline at end of file diff --git a/sea-scavenger/resources/whale.png b/sea-scavenger/resources/whale.png new file mode 100644 index 0000000..3c7deb3 Binary files /dev/null and b/sea-scavenger/resources/whale.png differ diff --git a/sea-scavenger/server.py b/sea-scavenger/server.py new file mode 100644 index 0000000..5792d5e --- /dev/null +++ b/sea-scavenger/server.py @@ -0,0 +1,42 @@ +from flask import Flask, render_template, send_from_directory, request, make_response + +app = Flask(__name__) + +app.static_folder = 'resources' + +@app.route('/') +def home(): + return render_template('sea.html') + +@app.route('/shark') +def shark(): + return render_template('shark.html') + +@app.route('/squid') +def squid(): + return render_template('squid.html') + +@app.route('/clam') +def clam(): + return render_template('clam.html') + +@app.route('/shipwreck') +def shipwreck(): + response = make_response(render_template('shipwreck.html')) + response.headers['Flag_Part_4'] = 'd_th3_tr' + return response + +@app.route('/whale') +def whale(): + return render_template('whale.html') + +@app.route('/treasure') +def treasure(): + return render_template('treasure.html') + +@app.route('/treasure/robots.txt') +def static_from_root(): + return send_from_directory(app.static_folder, request.path[1:]) + +if __name__ == '__main__': + app.run(debug=True) \ No newline at end of file diff --git a/sea-scavenger/solve.txt b/sea-scavenger/solve.txt new file mode 100644 index 0000000..a43114e --- /dev/null +++ b/sea-scavenger/solve.txt @@ -0,0 +1,15 @@ +pretty self explanatory... + +just scroll through the page and find the images and click on each one +it gives you a hint as to where to find the segments of the flag in the devtools + +part 1: html of shark in notFlagPartTrust div +part 2: console of squid +part 3: cookies of clam +part 4: network of shipwreck, response headers of shipwreck +part 5: sources of whale, static then whale.js +final part: go to treasure, navigate to https://_________.___/treasure/robots.txt + +piece it together and there you go! + +i hope this is easy enough for everyone to do diff --git a/sea-scavenger/templates/clam.html b/sea-scavenger/templates/clam.html new file mode 100644 index 0000000..809af4a --- /dev/null +++ b/sea-scavenger/templates/clam.html @@ -0,0 +1,53 @@ + + + + + + + Sea Creature: Clam + + + + +
+ Clam Image +
+

Clams are shaped like a specific sweet treat when they are closed...

+
+ Back to the Depths of the Sea +
+ + + + + \ No newline at end of file diff --git a/sea-scavenger/templates/sea.html b/sea-scavenger/templates/sea.html new file mode 100644 index 0000000..af4094c --- /dev/null +++ b/sea-scavenger/templates/sea.html @@ -0,0 +1,79 @@ + + + + + Depths of the Sea + + + + +
+

Welcome to the Depths of the Sea

+
+
+

Explore the mysteries of the deep sea...

+ Shark Image + Squid Image + Clam Image + Shipwreck Image + Whale Image + Treasure Image +
+ + + \ No newline at end of file diff --git a/sea-scavenger/templates/shark.html b/sea-scavenger/templates/shark.html new file mode 100644 index 0000000..08425cd --- /dev/null +++ b/sea-scavenger/templates/shark.html @@ -0,0 +1,53 @@ + + + + + + + Sea Creature: Shark + + + + +
+ Shark Image +
+

Sharks swim really fast, especially through the HTML sea!

+
+
+ +
+ Back to the Depths of the Sea +
+ + + \ No newline at end of file diff --git a/sea-scavenger/templates/shipwreck.html b/sea-scavenger/templates/shipwreck.html new file mode 100644 index 0000000..1f21238 --- /dev/null +++ b/sea-scavenger/templates/shipwreck.html @@ -0,0 +1,53 @@ + + + + + + + Sea: Shipwreck + + + + +
+ Shipwreck Image +
+

Looks like this ship lost its network connections with the rest of the world...

+
+ Back to the Depths of the Sea +
+ + + + + \ No newline at end of file diff --git a/sea-scavenger/templates/squid.html b/sea-scavenger/templates/squid.html new file mode 100644 index 0000000..812923d --- /dev/null +++ b/sea-scavenger/templates/squid.html @@ -0,0 +1,58 @@ + + + + + + + Sea Creature: Squid + + + + +
+ Shark Image +
+

What type of game is Squid Game? Definitely not a console game...

+
+ Back to the Depths of the Sea +
+ + + + + \ No newline at end of file diff --git a/sea-scavenger/templates/treasure.html b/sea-scavenger/templates/treasure.html new file mode 100644 index 0000000..2d0da2c --- /dev/null +++ b/sea-scavenger/templates/treasure.html @@ -0,0 +1,58 @@ + + + + + + + Sea: Treasure Chest + + + + +
+ Treasure Image +
+

Maybe this treasure was left here by robots...

+
+ Back to the Depths of the Sea +
+ + + + + \ No newline at end of file diff --git a/sea-scavenger/templates/whale.html b/sea-scavenger/templates/whale.html new file mode 100644 index 0000000..8fd5ec7 --- /dev/null +++ b/sea-scavenger/templates/whale.html @@ -0,0 +1,53 @@ + + + + + + + Sea Creature: Whale + + + + +
+ Whale Image +
+

Whales have many sources of food!

+
+ Back to the Depths of the Sea +
+ + + + + \ No newline at end of file