{"@attributes":{"version":"2.0"},"channel":{"title":"Jack Sun","link":"https:\/\/jacksun.dev\/","description":"Recent content on Jack Sun","generator":"Hugo -- gohugo.io","language":"en-AU","copyright":"This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. For now.....","lastBuildDate":"Wed, 23 Jul 2025 00:49:00 +0800","item":[{"title":"DUCTF 2025: Sodium","link":"https:\/\/jacksun.dev\/blog\/ductf2025\/sodium\/","pubDate":"Wed, 23 Jul 2025 00:49:00 +0800","guid":"https:\/\/jacksun.dev\/blog\/ductf2025\/sodium\/","description":"Description  Name: Sodium Category: Web 304 pts, 22 solves Written by sidd.sh  This one might require a pinch of patience.   Attachments   src.zip (27 KB)   \nSolution Network topology This challenge consisted of 3 web services placed behind a reverse proxy. The reverse proxy in this challenge used a software called Pound and the 3 web services were:\n An RPC service served by a h11 server."},{"title":"HTB: Why Lambda","link":"https:\/\/jacksun.dev\/blog\/htb\/why-lambda\/","pubDate":"Tue, 15 Jul 2025 22:20:00 +0800","guid":"https:\/\/jacksun.dev\/blog\/htb\/why-lambda\/","description":"Description  60 pts, Hard Web Written by MasterSplinter  Static Analysis The challenge\/backend\/model.py file provides an example of training and saving a Keras ML model in a h5 format. On further inspection, the application also provides a mechanism to load a pretrained model via the POST \/api\/internal\/model endpoint.\nThis arrangement is reminiscent of a deserialisation attack. I came across this article after some googling: https:\/\/mastersplinter.work\/research\/tensorflow-rce\/. The author explained that a Lambda layer can be introduced in the model to cause RCE when the model is saved then loaded using tensorflow."},{"title":"idekCTF 2022: SimpleFileServer","link":"https:\/\/jacksun.dev\/blog\/idekctf2022\/simple_file_server\/","pubDate":"Thu, 19 Jan 2023 17:58:00 +0800","guid":"https:\/\/jacksun.dev\/blog\/idekctf2022\/simple_file_server\/","description":"Description  Name: SimpleFileServer Category: Web 448 pts, 98 solves Written by JW#9396  All I wanted was a website letting me host files anonymously for free, for ever   Attachments   simple-file-server.tar.gz (6 KB)   \nSolution Analysing the codebase that we have been provided, it is clear that we need to read the flag by either calling the \/flag route, or exploiting the code logic to perform an arbitrary file read or some sort of remote code execution."},{"title":"idekCTF 2022: Osint Crime Confusion 2: W as in Weapon","link":"https:\/\/jacksun.dev\/blog\/idekctf2022\/osint_crime_confusion_2\/","pubDate":"Mon, 16 Jan 2023 19:07:00 +0800","guid":"https:\/\/jacksun.dev\/blog\/idekctf2022\/osint_crime_confusion_2\/","description":"This is a 4 part OSINT challenge centered around the theme of investigating a murder. During the CTF, I solved parts 2 to 4 while one of my teammates (toasterpwn) solved part 1.\nYou can read the other parts of this challenge here\nDescription  Name: Osint Crime Confusion 2: W as in Weapon Category: OSINT 476 pts, 50 solves Written by Franfrancisco9#0105  Now that you found where, can you help me find what was the weapon of the crime?"},{"title":"idekCTF 2022: Osint Crime Confusion 1: W as in Where","link":"https:\/\/jacksun.dev\/blog\/idekctf2022\/osint_crime_confusion_1\/","pubDate":"Mon, 16 Jan 2023 17:37:37 +0800","guid":"https:\/\/jacksun.dev\/blog\/idekctf2022\/osint_crime_confusion_1\/","description":"This is a 4 part OSINT challenge centered around the theme of investigating a murder. During the CTF, I solved parts 2 to 4 while one of my teammates (toasterpwn) solved part 1.\nYou can read the other parts of this challenge here\nDescription  Name: Osint Crime Confusion 1: W as in Where Category: OSINT 462 pts, 74 solves Written by Franfrancisco9#0105  Someone has died unexpectedly. The police is on it, but between you and me, I cannot wait for the police."},{"title":"HTB: Photobomb","link":"https:\/\/jacksun.dev\/blog\/htb\/photobomb\/","pubDate":"Wed, 11 Jan 2023 14:15:25 +0800","guid":"https:\/\/jacksun.dev\/blog\/htb\/photobomb\/","description":"Description  20 pts, Easy Written by slartibartfast  User Flag First thing first, add an entry to the \/etc\/hosts file with\necho "<ip address> photobomb.htb" >> \/etc\/hosts  Running nmap on the domain, we can see that there are 2 ports exposed:\n Web server on port 80 SSH on 22  Checking out the web server on port 80, we are greeted with the website for a photo printing service called Photobomb."},{"title":"IrisCTF 2023: baby_rev","link":"https:\/\/jacksun.dev\/blog\/irisctf2023\/baby_rev\/","pubDate":"Tue, 10 Jan 2023 21:37:37 +0800","guid":"https:\/\/jacksun.dev\/blog\/irisctf2023\/baby_rev\/","description":"Description  Name: baby_rev Category: Reverse 50 pts, 251 solves Written by nope  I needed to edit some documents for my homework but I don’t want to buy a license to this software! Help me out pls?   Attachments   baby_baby_rev (16 KB)   \nSolution We can decompile the binary using Ghidra. The decompiled code for the main function is as follows:\nundefined8 main(void) { size_t sVar1; long in_FS_OFFSET; int local_7c; char local_78 [104]; long local_10; local_10 = *(long *)(in_FS_OFFSET + 0x28); setvbuf(stdin,(char *)0x0,2,0); setvbuf(stdout,(char *)0x0,2,0); puts("Welcome to SuperTexEdit!"}]}}