Search results

  1. 0x90

    [/MNT/AIN LIB] [CRYPTO] office-encryption

    office-encryption SRC: https://library.m0unt41n.ch/challenges/office-encryption Thanks xNull for making a solveable crypto challenge <3 Sooo its substitution cipher and luckily we got the ranomly generated sbox provided. We have to invert the map, v -> key and key -> value and copy paste the...
  2. 0x90

    [/MNT/AIN LIB] [WEB] rain

    rain SRC: https://library.m0unt41n.ch/challenges/rain PHP Templating libs kekw. We are allowd to upload our own themes and even watch them. Main security feature is the saving of the files as strict html, so we cannot create a normal/typical malicious file upload... But the Tempalting lib is...
  3. 0x90

    [/MNT/AIN LIB] [WEB] self-service

    self-service SRC: https://library.m0unt41n.ch/challenges/self-service The challenge relies on client certificate authentication using a custom root CA (ca.pem) which recently expired. The server blindly trusts any submitted root certificate as long as the public key and subject match the...
  4. 0x90

    [/MNT/AIN LIB] [WEB] retro-serve

    retro-serve SRC: https://library.m0unt41n.ch/challenges/retro-server This challs service allows execution of a list of commands... the way its check is kinda flawed tho it checks if the commands are within the commands... so if we craft a malicious command including an allowed command and chain...
  5. 0x90

    [/MNT/AIN LIB] [WEB] containment

    containment SRC: https://library.m0unt41n.ch/challenges/containment The challenge exposes a /rename and /status endpoint in a minimal container environment running a Rocket-based Rust server. We leveraged the fact that certain files like /containment or /.dockerenv are always executable, even...
  6. 0x90

    [/MNT/AIN LIB] [REV] infinite_decoding_odyssey

    infinite_decoding_odyssey SRC: https://library.m0unt41n.ch/challenges/infinite-decoding-odyssey This rev chall is pretty straight forward, with have a encryption or lets say a lil scrambling function which we should reverse. We have a scramble flag...
  7. 0x90

    [/MNT/AIN LIB] [WEB] post-webapp

    post-webapp SRC: https://library.m0unt41n.ch/challenges/post-webapp By abusing alternate loopback notations like 127.1 or 0x7f000001, we glide past the naive filter without raising alarms. The server then fetches our crafted URL from 127.0.0.1, so the admin route trusts the request and happily...
  8. 0x90

    [/MNT/AIN LIB] [WEB] cyberpunk-weather-app

    cyberpunk-weather-app SRC: https://library.m0unt41n.ch/challenges/cyberpunk-weather-app This challenge display weather data and uses an templating engine. During building of a string a command injection vuln was created within the else block.. we can inject python code and therefore obtained...
  9. 0x90

    [/MNT/AIN LIB] [WEB] dotcom

    dotcom SRC: https://library.m0unt41n.ch/challenges/dotcom Solved this chall locally, submitted publicly shared flag. (hope thats fine) Reported chall as broken and fixed it. There is a .NET server and a BOT component, we need to make the bot write the flag into a textArea and somehow exfil...
  10. 0x90

    [/MNT/AIN LIB] [WEB] sleepy-sql

    sleepy-sql SRC: https://library.m0unt41n.ch/challenges/sleepy-sql This challenge is pretty obvious that we have to perform sql inejction, the hard part is exfiltration tho, there is not reflection allowing us too read any data (like the flag). So we have to work with what we got, time. We can...
  11. 0x90

    [/MNT/AIN LIB] [WEB] legal-complaint-form

    legal-complaint-form SRC: https://library.m0unt41n.ch/challenges/legal-complaint-form Okay first of all, i consider myself a PHP pro, but damn i h8 apache... my main stack is using nginx as webserver... This chall requires two main steps. 1. First of all there is a malicious fileupload vuln...
  12. 0x90

    [/MNT/AIN LIB] [WEB] pollpals

    pollpals SRC: https://library.m0unt41n.ch/challenges/pollpals Typical JWT misconfiguration or lets call it completly fucked up flow/logic/implementation. The isAdmin function in auth.js has no signature check for the JWT, it just accept any JWT and extracts its info... const parts =...
  13. 0x90

    [/MNT/AIN LIB] [WEB] time-share

    time-share SRC: https://library.m0unt41n.ch/challenges/time-share Pretty easy beginner challenge wich teaches an important lesson... ^^ The code has a logic flaw... it doesnt check if the user/admin_token is an actual admin token.. within the JWT there is no indication is_admin or anything...
  14. 0x90

    [/MNT/AIN LIB] [WEB] knowledge-archive

    knowledge-archive SRC:https://library.m0unt41n.ch/challenges/knowledge-archive Holy, this one is easy but took some time. I first was a lil sussed out about the AI Reable Data stuff (a hmac using flag as key) and all the file read/writes or even the popen & glob usage... but this was all a red...
  15. 0x90

    [/MNT/AIN LIB] [WEB] labyrinth

    labyrinth SRC: https://library.m0unt41n.ch/challenges/labyrinth This is quiet the easy challenge, with multiple solutions... the most interesting exploitation path is bypassing the admin permission check too the abuse the SQL injection within admin_search. So theres 3 interesting functions...
  16. 0x90

    [/MNT/AIN LIB] [WEB] centralized-identity

    centralized-identity SRC: https://library.m0unt41n.ch/challenges/centralized-identity This challenge consists of multiple steps, our main goal is too obtain the flag via the backend service API. 1. Within our IDP entrypoint.sh we can find credentials to login into our frontend. email...
  17. 0x90

    [/MNT/AIN LIB] [WEB] blahajs

    blahajs SRC: https://library.m0unt41n.ch/challenges/blahajs The only real discoverable functionality in this challenge is the image display via a GET parameter name and endpoint /image. The rest of the challenge is just displaying of said images and its sourceless. Soo i first tried a directory...
  18. 0x90

    [/MNT/AIN LIB] [WEB] airsmeller

    airsmeller SRC: https://library.m0unt41n.ch/challenges/air-smeller This challenge had a bot component and a leave a review component. It was quiet clear the goal was to achieve XSS, but the inputs were sanitized using DomPurify v19.0.0. At first glance i spent a ton of time looking for other...
  19. 0x90

    [/MNT/AIN LIB] [WEB] flagkeeper

    flagkeeper SRC: https://library.m0unt41n.ch/challenges/flagkeeper This challenge required us too access the admin's flag in database. It had a fully fletched API worked out, and the main way too obtain the flag would be to use admin's API token to request /api/flag for the flag. So i skimmed...
  20. 0x90

    [/MNT/AIN LIB] [WEB] sentry-as-navigation

    sentry-as-navigation SRC: https://library.m0unt41n.ch/challenges/sentry-as-navigation This challenge provides a tool too fetch and display certificate information. There is a clear and easy too find vulnerability in the code wich allows to RCE. for entry in san_entries: match =...

Online statistics

Members online
0
Guests online
1
Total visitors
1
Totals may include hidden visitors.

Latest posts

Newest members

Stay Connected

Back
Top