http://www.adhikariashwin0.com.np/tags/omnictf-qualifiers/ Recent content in Omnictf Qualifiers on the008Killer Hugo en Fri, 17 Jul 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/ctfs/omnictf/ Fri, 17 Jul 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/ctfs/omnictf/ <h1 id="webganzir">Web/Ganzir</h1> <p>First thing to notice were three visible endpoints <code>Dashboard</code>, <code>login</code> and <code>employee</code>. <img alt="Dashboard" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/omnictf/assets/ganzir_dashboard.png"></p> <p>On <code>employee</code> endpoint, a <code>403 Forbidden</code> message was clearly visible. Besides that, there was a log which suggested CL.TE (Content-Length / Transfer-Encoding) desync vulnerability. However that was a deadend. <img alt="employee endpoint" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/omnictf/assets/ganzir_employee.png"></p> <p>However there was this line in dashboard <code>Legacy recovery service re-enabled for Records staff during evacuation.</code> whcih suggested that there might be some user involved.</p> <h2 id="unintended-path-weak-credentials">Unintended Path (Weak Credentials)</h2> <p>And on checking <code>login</code> endpoint I found <code>Cassie</code>. <img alt="login source" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/omnictf/assets/ganzir_loginsource.png"></p>