Science Hot News
🧠Challenge Text¶
Hi Senior Researcher,
something has gone wrong with the science-hotnews.nren.tcc server, and the site has suddenly gone offline. The administrator had to fix things manually to get the news server back online.
Your task is to find out whether the administrator left any relics behind.
Stay curious!
🎨 Solution¶
The target is http://science-hotnews.nren.tcc. It serves a static "Site under reconstruction" page on Apache/2.4.68 (Debian).
1. Identify the application¶
Requesting index.php returns a WordPress "Error establishing a database connection" page — the site was a WordPress instance whose database is now offline. The admin replaced index.html with a maintenance page but left the WordPress installation in place.
2. Scan for admin relics¶
Standard WordPress paths reveal the installation is intact:
| Path | Status |
|---|---|
wp-config.php |
500 (PHP error, no DB) |
wp-login.php |
500 |
wp-content/ |
200 (directory listing) |
wp-includes/ |
403 |
readme.html |
200 |
.wp-config.php.swp |
200 |
The key find: .wp-config.php.swp — a Vim swap file. When an admin edits a file with Vim and the session ends without saving (crash, disconnect, kill), Vim leaves a .swp file in the same directory. The admin edited wp-config.php during maintenance and left the swap file behind.
3. Extract the flag¶
curl -s http://science-hotnews.nren.tcc/.wp-config.php.swp -o wp-config.php.swp
strings wp-config.php.swp
The swap file contains the full wp-config.php contents. The flag is stored in the AUTH_KEY define:
define( 'AUTH_KEY', 'FLAG{Qdq3-LPjI-UQog-K1Ox}' );
The file also leaks database credentials (wp_admin / S3cr3t-db-p4ss!2026 on db.internal.nren.tcc), WordPress salts, and confirms the database name wp_recon.
Flag: FLAG{Qdq3-LPjI-UQog-K1Ox}