Houseplant CTF 2020

[iohehe]

Beginners

Tools:

• CyberChef
• Cryptii

Beginner 1

BASE64: cnRjcHt5b3VyZV92ZXJ5X3dlbGNvbWV9

Beginner 2

HEX2ASCII: 72 74 63 70 7b 62 6f 62 5f 79 6f 75 5f 73 75 63 6b 5f 61 74 5f 62 65 69 6e 67 5f 65 6e 63 6f 75 72 61 67 69 6e 67 7d

Beginner3

162 164 143 160 173 163 165 145 137 155 145 137 151 137 144 151 144 156 164 137 153 156 157 167 137 167 150 141 164 137 157 143 164 141 154 137 167 141 163 137 157 153 141 171 77 41 175
(don't know)

Beginner4

rot13: egpc{lnyy_orggre_cnegvpvcngr}

Beginner5

morse: -- .- -. -.-- ..--.- -... . . .--. ... ..--.- .- -. -.. ..--.- -... --- --- .--. ...
(Remember to wrap the flag in the flag format rtcp{something})

Beginner6

26 26 26 26 26 26 26 26 19 12 5 5 16 9 14 7 9 14 16 8 25 19 9 3 19

*disclaimer: DON'T DO THIS KIDS. only sleep in math.

Remember to wrap the whole thing in the flag format rtcp{}
(dot' know)

Beginner7

Atbash: igxk{fmovhh_gsvb_ziv_nvzm}

Beginner8

Bacon: 00110 01110 00100 00000 10011 00101 01110 01110 00011 00011 01110 01101 10011 10010 10011 00000 10001 10101 00100

[iohehe]

web

I don't like needles

a login logic.

see the html source <!-- ?sauce -->
lol..........
this is a parameter...
http://challs.houseplant.riceteacatpanda.wtf:30001/index.php?sauce
you'll see the source code:

    <?php

        if ($_SERVER['REQUEST_METHOD'] == "POST") {
            
            require("config.php");

            if (isset($_POST["username"]) && isset($_POST["password"])) {

                $username = $_POST["username"];
                $password = $_POST["password"];

                if (strpos($password, "1") !== false) {
                    echo "<p style='color: red;'>Auth fail :(</p>";
                } else {

                    $connection = new mysqli($SQL_HOST, $SQL_USER, $SQL_PASS, $SQL_DB);
                    $result = mysqli_query($connection, "SELECT * FROM users WHERE username='" . $username . "' AND password='" . $password . "'", MYSQLI_STORE_RESULT);
                    
                    if ($result === false) {
                        echo "<p style='color: red;'>I don't know what you did but it wasn't good.</p>";
                    } else {
                        if ($result->num_rows != 0) {
                            if (mysqli_fetch_array($result, MYSQLI_ASSOC)["username"] == "flagman69") {
                                echo "<p style='color: green;'>" . $FLAG . " :o</p>";
                            } else {
                                echo "<p style='color: green;'>Logged in :)</p>";
                            }
                        } else {
                            echo "<p style='color: red;'>Auth fail :(</p>";
                        }
                    }
                    
                }
            }
        }

    ?>

"SELECT * FROM users WHERE username='" . $username . "' AND password='" . $password . "'" single quote, and if you want to in the right flow, use and notor`:

payload: flagman69'#

[iohehe]

Web

QR Generator

Hint! For some reason, my website isn't too fond of backticks...
I get it is a ci, but I just try the by pass like | || &&, payload is very easy but u can only read one character a time.
This challenge also tell me, find parameters are very important.

travel like this
http://challs.houseplant.riceteacatpanda.wtf:30004/qr?text=cat%20flag.txt|head%20-n1|tail%20-n1
and parser the QR.

[iohehe]

WEB

Selfhost all the things!

I think it is complex, but it's not.XD

try use flag, and 302 jump to the flag...

I even use flag.txt, but not use flag!
this tell me observe the parameters' style is very important (with=discord => with=flag)