Skip to content

Chapter 1: Operator

Category: HTML    |    Points: 2    |    Difficulty: Easy

🧠 Challenge Text

Hi, emergency troubleshooter,

recent studies suggest that the intense heat and hard labor of solar technicians often trigger strange, vivid dreams about the future of energetics. Over the past few days, technicians have woken up night after night with the same terrifying screams "Look, up in the sky! It’s a bird! It’s a plane! It’s Superman! Let’s roast it anyway!".

Find out what’s going on, we need our technicians to stay sane.

Stay grounded!

  • http://intro.falcon.powergrid.tcc/

🔍 Hints Text

1. Hint Be sure you enter flag for correct chapter.
2. Hint In this realm, challenges should be conquered in a precise order, and to triumph over some, you'll need artifacts acquired from others - a unique twist that defies the norms of typical CTF challenges.
3. Hint Chapter haiku will lead you.

🎨 Solution

Visiting the operator page http://roostguard.falcon.powergrid.tcc shows Unauthorized access prohibited. Let's traverse the dir structure 

$ gobuster dir -u http://roostguard.falcon.powergrid.tcc -w ~/directory-list-lowercase-2.3-medium.txt

...
/login                (Status: 200) [Size: 2213]
/stats                (Status: 200) [Size: 47]
/logout               (Status: 302) [Size: 199] [--> /login]
/radar                (Status: 302) [Size: 199] [--> /login]
/command              (Status: 405) [Size: 153]
/operator             (Status: 200) [Size: 3783]
/login_a              (Status: 429) [Size: 169]
...

Let's visit /operator endpoint and inspect the page. Voila! The html comment was left there...

 <!-- 
  debug only 
  <div class="form-group"> 
    <label for="raw_command">Raw command</label> 
    <input type="text" class="form-control" id="raw_command" name="raw_command" placeholder="FLAG{AjQ6-NgLU-lQT7-XePG}"> 
  </div> 
 -->