Challenges

• Password Cracking 2 (cracking)
• Simple Fix (CI/CD)
• AI Tool Abuse (LLM)

Lots of cloud sec here!

Password Cracking 2

1. keepass2john Passwords.kdb >> database.hash

2. john --wordlist=/usr/share/wordlists/rockyou.txt -format:keepass database.hash

   

3. So, we get the flag as zebralicious

Simple Fix

We are given a Gitea instance, and a Jenkins instance.

The gitea instance is for us to commit code changes, and the jenkins instance will perform a pipeline after each commit.

This specific pipeline will run semgrep on the codebase, then echo the entire codebase for a check file (presumably checking for security issues) before printing the flag.

So, our goal is to patch this app of it security vulnerability.

If we look at the code, we see the final line that there is a debug=True statement, which should not be in production, so we remove that in the online editor, and the commit again. Then, we run the pipeline and get the flag! punk_{35MZKE9CJF9TZ9OW}

AI Tool Abuse

These were my prompts: