hxp 38C3 CTF Writeup

CTFTime event link: https://ctftime.org/event/2437

Writeup

• Web
  1. haschbargeld
  2. Fajny Jagazyn Wartości Kluczy
  3. phpnotes

Background

• Starts: 27 Dec. 2024, 20:00 UTC
• Ends: 29 Dec. 2024, 20:00 UTC

After five years of non-existent C3 and misaligned schedules, we are happy to announce this year's hxp 38C3 CTF. This will be our second time hosting hxp CTF at C3.

Categories:

• PWN
• MSC
• CRY
• REV
• WEB

Overview

• Team: Black Bauhinia
• Team Solves: 5/21
• Individual Solves: 1/21
• Score: 1244
• Global Rank: 25/1017
• Overall Difficulty To Me: ★★★★★★★★★☆

What I've learned in this CTF

• Web
  1. haschbargeld - PHP undefined variable quirk
  2. Fajny Jagazyn Wartości Kluczy - Race condition in Golang = operator
  3. phpnotes - CRLF injection in JWT signature to HTTP request smuggling