POSTS 2025-01-08

VULNLAB: Warmup 3

writeup Vulnlab Challenges

Warmup 3 is a easy misc challenge where the flag is hidden on a webpage.

244 words · 2 min

Easy Misc view-source

Overview

Type Misc
Severity Easy
Creator xct
Release date 2021 Nov 21

Foothold

Start the instance via Discord and let’s go:

We download the challenge file and open it:

We open the link https://twitter.com/vulnlab_eu/status/1631384045601824800 in a browser:

Screenshot 2025-01-06 195707

We follow it and open the Vulnlab website:

Screenshot 2025-01-06 195743

We review the source code and found an interesting stuff:

view-source:https://www.vulnlab.com/

...
<div
  class="sqs-block-button-container sqs-block-button-container--center"
  data-animation-role="button"
  data-alignment="center"
  data-button-size="medium"
  data-button-type="primary"
>
  <a
    href="https://discord.gg/vulnlab"
    class="sqs-block-button-element--medium sqs-button-element--primary sqs-block-button-element"
    target="_blank"
  >
    Join Discord
  </a>
</div>
</div></div></div><div class="fe-block fe-block-36adf478a73258ff54cc"><div class="sqs-block embed-block sqs-block-embed" data-block-json="&#123;&quot;html&quot;:&quot;&lt;a class=\&quot;twitter-timeline\&quot; data-theme=\&quot;dark\&quot; data-tweet-limit=\&quot;3\&quot;  href=\&quot;https://twitter.com/vulnlab_eu?ref_src=twsrc%5Etfw\&quot;&gt;Tweets by vulnlab_eu&lt;/a&gt; &lt;script async src=\&quot;https://platform.twitter.com/widgets.js\&quot; charset=\&quot;utf-8\&quot;&gt;&lt;/script&gt;&quot;,&quot;resolvedBy&quot;:&quot;manual&quot;,&quot;customThumbEnabled&quot;:false&#125;" data-block-type="22" id="block-36adf478a73258ff54cc"><div class="sqs-block-content"><a class="twitter-timeline" data-theme="dark" data-tweet-limit="3"  href="https://twitter.com/vulnlab_eu?ref_src=twsrc%5Etfw">Tweets by vulnlab_eu</a> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div></div></div><div class="fe-block fe-block-yui_3_17_2_1_1683820995375_58623"><div class="sqs-block code-block sqs-block-code" data-block-type="23" id="block-yui_3_17_2_1_1683820995375_58623"><div class="sqs-block-content"><!-- Is this the Warmup3 flag? SVl7bzI4MHM4NHM3cnFzc3M1c241cTg1MjRvbm4wbjc5cnN9 --></div></div></div></div></div>
    </div>
  
  </div>
...

Seems Base64 so let’s go to decode it:

$ echo -n 'SVl7bzI4MHM4NHM3cnFzc3M1c241cTg1MjRvbm4wbjc5cnN9' | base64 -d
IY{o280s84s7rqsss5sn5q8524onn0n79rs}

Hummmmm, as the flag does not start with the default VL{ so seems it’s not yet the good one.

As we know that a correct flag should be start with VL and we have currently IY then we check the difference and we quickly see:

V -> +13 -> I L -> +13 -> Y

So seems that has been encoded with ROT13 (rotate by 13 places) to replace a letter with the letter 13 letters after it in the alphabet.

Let’s go to Base64 decode and ROT13 decode:

$ echo 'SVl7bzI4MHM4NHM3cnFzc3M1c241cTg1MjRvbm4wbjc5cnN9' | base64 -d | tr 'A-Za-z' 'N-ZA-Mn-za-m'
VL{b280f84f7edfff5fa5d8524baa0a79ef}

Found the flag VL{b280f84f7edfff5fa5d8524baa0a79ef}