Challenge 8 - AdventOfCTF
- Points: 800
If only you could figure out where to go.
Visit https://08.adventofctf.com to start the challenge.
Finding the vulnerability
When opening the website we’re greeted with the following message:
Did you know that the fastest robot can solve a rubiks cube in 0.887 seconds?
This is talking about robots, which my be a hint to look at the
What is a robots.txt file?
robots.txt file lives at the root of a website. So, for the site www.example.com, a robots.txt file would live at www.example.com/robots.txt. robots.txt is a plain text file that follows the Robots Exclusion Standard. A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
Opening the file
The file shows the following:
# robots.txt generated by *************.com User-agent: * Disallow: / Disallow: /cgi-bin/ Disallow: /encryption/is/a/right Disallow: /fnagn/unf/znal/cynprf/gb/tb
This probably means there is some sensitive information on one of the
Disallow locations. Let’s look at them one by one.
/cgi-bin/, we get a
404 error. So let’s skip this one for now.
/encryption/is/a/right, we get some encoded string back. It looks like
base64 so let’s try to decode it using
base64 -d in the terminal:
echo "RW5jb2RpbmcgYW5kIGVuY3J5cHRpb24gYXJlIDIgZGlmZmVyZW50IHRoaW5ncy4=" | base64 -d > Encoding and encryption are 2 different things.
This doesn’t mean a lot so let’s have a look at the next one.
/fnagn/unf/znal/cynprf/gb/tb, we’re greeted with the following text:
“Oh, the places you’ll go”, my favorite poem… but this is the wrong place. Maybe you read that wrong?
Hmm, it says “Maybe you read that wrong?”. The URL also looks kinda weird. It might be
rot13 encoded. So let’s try to decode it using
echo "/fnagn/unf/znal/cynprf/gb/tb" | rot13 > /santa/has/many/places/to/go
rot13 is not a program on linux, I just programmed it as an alias for
tr 'A-Za-z' 'N-ZA-Mn-za-m'
We got new url (I hope 😀). Let’s try to access it. We got the flag! It is
This flag can then be submitted for the challenge.