UIUCTF 2024 Writeup

CTFTime event link: https://ctftime.org/event/2275

Writeup

• Web
  1. Log Action

Background

• Starts: 29 June 2024, 00:00 UTC
• Ends: 01 July 2024, 00:00 UTC

UIUCTF is an annual capture-the-flag competition hosted by SIGPwny, the cybersecurity club at the University of Illinois Urbana-Champaign (UIUC).

A massive outage is affecting the entire transit system! The SIGPwny Transit Authority has issued an emergency call to CTF teams for help with restoring service. Solve challenges to fix stations and deliver as many passengers as you can!

Categories:

• Pwn
• Reverse Engineering
• Cryptography
• OSINT
• Web
• Miscellaneous

Overview

• Team: ARESx
• Team Solves: 11/35
• Individual Solves: 4/35
• Score: 2990
• Global Rank: 121/959
• Overall Difficulty To Me: ★★★★★★☆☆☆☆

What I’ve learned in this CTF

• Web
  1. Log Action - Exploiting Next.js Server-Side Request Forgery in Server Actions (CVE-2024-34351)