ISCCTF 2020: Author's Writeups (Greetinjs / mark damn it) and Reflections

Hello, I'm 8ayac 🐝

This post introduces the writeups for the challenges I created for ISCCTF 2020, a beginner-oriented CTF held on October 24, 2020, along with a brief look back.

[Web 100pts - 88.09% solves¹] Greetinjs

The author's writeup is here.

Looking back

I aimed for a challenge that people could solve even without prior experience with CTFs. It is worth looking at the resources a web page loads, too.

[Web 475pts - 19.04% solves²] mark damn it

The author's writeup is here.

Looking back

mark damn it was a challenge built around RCE using CVE-2020-14001. This was an RCE vulnerability in Kramdown version 2.3.0 and earlier.

I like real-world vulnerabilities, so I wanted to create a challenge around a CVE. While I was wondering how to make that suitable for beginners, @n01e0, who was writing the Pwn, Rev, and Misc challenges, shared this and asked whether anyone wanted to use it. I took it on. I had hardly written any Ruby before, so it was also a chance to learn some Ruby.

Thoughts

I have the impression that Markdown-to-HTML conversion features are prone to vulnerabilities.

Footnotes