> For the complete documentation index, see [llms.txt](https://unsbotch.gitbook.io/unsbotch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://unsbotch.gitbook.io/unsbotch/my-writeups/d-ctf-2025-quals.md).

# D-CTF 2025 Quals

<figure><img src="/files/tu1BrYtQGJaDUhlENe2k" alt=""><figcaption></figcaption></figure>

Hard challenge with 35 solutions

<figure><img src="/files/MQ7yBPxpr10h1RbGFdzA" alt=""><figcaption></figcaption></figure>

Web site has a one functionality is tacking a screenshot for provided link:

<figure><img src="/files/7Hx7hwk7doip5q5jL9ku" alt=""><figcaption></figcaption></figure>

So after a few time we noticed about blog button which direct to localhost `bot:4000`<br>

<figure><img src="/files/9r9ikNzWBFU5fbYxUPYD" alt=""><figcaption></figcaption></figure>

First idea was sent screen request to our webhook which will open an localhost via iframe

<figure><img src="/files/mgYmA3KVgEMol4Opc410" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/j9ndoXHqC25UTSumhORb" alt=""><figcaption></figcaption></figure>

And thats working, we took a screenshot of localhost blog

<figure><img src="/files/Kpp38z7PDEADZbRNdIN9" alt=""><figcaption></figcaption></figure>

As you can see there is a functionality to post a comment

<figure><img src="/files/qANxGIJMhAcKBNYEFFKn" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5fMODwMTpd6qdIorMoZZ" alt=""><figcaption></figcaption></figure>

Our comment was posted and first thing what we tried is to do XSS, but it didn't bring any results.

Next stage was test on SSTI

<figure><img src="/files/HKzXHEIlLsVuzIyqVFL2" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/jHE4ODo1VOEADMglo8Gl" alt=""><figcaption></figcaption></figure>

SSTI is working, so it seemed to be easy, just read the flag

<figure><img src="/files/eNPSR837cAnKVXi0zGgr" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Z1UEaa0N7Eoidnn1a6Fx" alt=""><figcaption></figcaption></figure>

but as it turned out, in order to read flag.txt you need to have root rights

we decided to achieve reverse shell by our ssti payload

<figure><img src="/files/HvLPq5T3lRPy27JH3IDy" alt=""><figcaption></figcaption></figure>

so as we got it, we need to do privesc to read flag.txt and after a few hours we did it by cronjob file.sh which executed by root every 10 minutes

<figure><img src="/files/kTllNojIgVWEIOcnQYtu" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Dk5d8p5OKvtSTib5DIHL" alt=""><figcaption></figcaption></figure>