This CTF was recommended to me by some friends, most of whom are interested in cybersecurity related competitions and participate at such events on a regular basis. We decided to team up with @Tibix and @Levev, and thus our group (arbitrarily named Frost) was born. The first challenges became accessible at 14:00 GMT+2, and the deadline was supposed to have been at the end of the week, but due to problems with the official server, the competition only lasted for 24 hours.
MacDonalds was one of the first challenges I've attempted, given that it was classified as Web | Medium, and it was the only one in its category. The description reads as follows:
From this we can conclude that the actual problem will come down to enumerating the files stored on the server. I noted that the name of the challenge could be a hint in itself, specifically referring to Mac (possibly macOS).
Information Gathering
Upon visiting the website, I was greeted with this picture of a smiling Ronald McDonald.
As far as I could tell, there were no redirects, and the URL remained in its canonical form. My first step was to take a look at the source of the page, but I couldn't find anything of interest. The styles for the page were also normal (albeit relatively old-fashioned), so I started examining the response headers.
The server claimed to be a variant of Kestrel, which is a cross-platform web server for ASP.NET Core. I couldn't find any known vulnerabilities given its version, and it seemed to be quite an unpopular choice for hosting stuff, so at first I thought the solution might have to do with exploiting some mechanism of Kestrel that behaved differently on macOS. Trying to access random pages/files yielded a bluish 404 page, also nothing useful.
The organizers had made it clear that the use of tools such as gobuster was not permitted. As this would have been a fair second step for information gathering, I needed another way of finding out information about the directory structure. Unfortunately the image was hosted on a separate website which was out of scope for the CTF. I thought about examining it for some stego clues, but ultimately abandoned the idea.
macOS and Special Files
I remembered that macOS had a special way of dealing with files, involving some counter-intuitive things such as resource forks and other file system anomalies. By the way, these mechanisms can be seen in action when you move files from a Mac system to a different one. As such, I started looking for special (hidden) files and directories that have a fixed path and could provide additional insight.
One such file is .DS_Store (Desktop Services Store), which, upon checking whether it existed on the server, I was able to get access to. According to the specifications, these files are basically the equivalents of Thumbs.db and desktop.ini on Windows, so they can be parsed and read for valuable data. After I got a copy, I used this online tool to open it. The output was
index.php
secrets
secrets
secrets
secrets
secrets
secrets
secrets
style.css
style.css.map
style.scss
A small side note, the FAQ section of the tool goes into great detail and even links to some reputable studies about the security implications of exposed .DS_Store files.
Conclusion
From here, it was just a matter of finding subfolders, and enumerating their contents using the same method to find the flag. After about two tries, I found a somewhat suspiciously named script called 5973b4cc1d61c110188ee413cddb8652.php, and sure enough, it had the flag.
TFCCTF{.D5_S70r3_1s_s0_4nn0ying_wh3n_c0mp1l1ng_j4rs_y0urs3lf}
In conclusion, this was a fun challenge that taught me more about how metadata from different file systems is stored, and the importance of not exposing said data. The directory structure of protected web applications can be a valuable asset to a potential attacker. Overall, the event made for a great opportunity to learn about exploitation techniques, and we managed to identify what skills of ours needed to be improved upon.