HC's Capture the Flag website
CTF Contests
25C3-CTF
25C3-CTF final results
Advisory #88
From team Janet Reno Redemption Fund$
New advisory by : anonymous coward
Affected service(s): Goferdee
Severity [lmh] : high
===== Problem =====
The 'dir' command, in conjuction with the purpose of the service itself, makes it possible to access flags without knowing their FLAGSTORE id. By issuing 'dir' followed by '/service/ICANHASGOFERDEE/listing' a directory listing of the flag repository will
e presented.
===== Impact =====
Retrieval of all service flags.
===== Fix =====
Remove lines 20 through 26 of goferdee.lol to disallow a directory listing of /service/ICANHASGOFERDEE/. This functionality is not required for the service to work properly.
Rating
[0] Sorry, you were too late