Mother's Secret
This guide contains the answer and steps necessary to get to them for the Mother's Secret room.
Table of contents
Mother's Secrets!
- What is the number of the emergency command override?
The answer to this question can be found in the text.
Click for answer
100375
- What is the special order number?
In the api routes file we downloaded, we can find two endpoints. Yaml and Nostromo. Visiting either one gives us a message telling us we are hitting the wrong route.
I looked through the routes using semgrep for static analysis and ZAP spiders and scans for Dynamic analysis. Both without any results.
Looking closer at the routes we can see that the Yaml endpoint has declared a variable 'file_path' which is related to a Yaml file the system can read. This might be something we can use.
Since hitting the endpoint doesn't seem to do anything, we can capture the api request in Burpsuite and modify it to contain the 'file_path' variable. We can either modify it and forward the request or send it to repeater. The latter would be better as it would enable us to test various payloads.
We must change it to a POST request and add two lines. Our payload should contain the variable name and its value. If this value is not a yaml file, we get an error back.
If it is a yaml file extension, we get a message telling us the system is unable to read the file. This means we are on the right track.
We just need to create the right payload/filename. It might be the code for the 'alian loaders' we got in the beginning (100375). The webpage on ALien Loader mentions a 'YAML' loaders that parses and loads YAML data. This is exactly what the yaml endpoint does judging from the api routes file.
Looks like this was correct. The message gives us the order number!
Click for answer
937
- What is the hidden flag in the Nostromo route?
Our next step would be to follow the Nostromo endpoint as suggested in the message. We capture it again in Burpsuite to modify the request in Repeater.
Again we change the request to a POST request and add our payload in the form of the order number filename.
Here we find our first hidden flag.
Click for answer
Flag{X3n0M0Rph}
- What is the name of the Science Officer with permissions?
If we had used a different filename, we would have gotten an error message that we are not the Science Officer. This is also apparent from the route file.
So apparently we have now been identified as a Science Officer. If we look at the web application and navigate to role, we can see the name of this Science Officer.
Click for answer
ash
- What are the contents of the classified "Flag" box?
This can be found in the same webpage under Flag.
Click for answer
THM_FLAG{0RD3R_937}
- Where is Mother's secret?
So we should now be identified as a Science Officer. Now we should be able to use the last endpoint. nostromo/mother.
In the text we are give a clue for a file located at this endpoint, 'secret.txt'. Lets try it and use it as the filename in our api request.
Click for answer
/opt/m0th3r
- What is Mother's secret?
Now that we know the secrets location, we must read it. From the Pathways message we learn we should utilized path traversal. From the api routes file, we can see this would indeed be possible as the filname value is added to the filepath without sanitation.
Since we need to go all the way back to /opt/, we should add a few extra folder up commands just to be sure we hit the root folder.
Success! If we try with fewer folder up movements, we can see that it won't work.
Click for answer
Flag{Ensure_return_of_organism_meow_meow!}