🌙 Whispers of the Moonbeam 🍺

📜 Tales from Eldoria

🗡️ Synopsis

In the heart of Valeria’s capital, the Moonbeam Tavern 🏰 holds secrets beyond its lively exterior. Rumors whisper that this unassuming tavern is a covert meeting place for spies, thieves, and those loyal to the villainous Malakar. 🕵️‍♂️ Our brave fellowship must infiltrate the Moonbeam’s hidden backrooms to uncover the location of the elusive Shadow Veil Cartographer, an informant who possesses a long-lost map vital to breaching Malakar’s nefarious Obsidian Citadel. 🗺️ The fate of the realm hangs in the balance as we race against Malakar’s forces to secure this crucial intelligence. Let the tavern infiltration begin! 🍻

📜 Description

This Terminal-based challenge transports us into the shady underbelly of the Moonbeam Tavern, where a covert transaction is set to occur. 🕶️ By exploiting a command injection vulnerability, we must uncover the secret location of the Shadow Veil Cartographer and secure the map before Malakar’s minions beat us to it. ⏰ The tavern’s terminal offers tantalizing tips, hinting that command history, tab completion, and command injection via “;” could be the keys to success. 🔑 As we navigate this seedy establishment, we must keep our wits sharp and our typing fingers nimble. The future of Valeria depends on it! ⚔️

🛡️ Skills Required

  • 💻 Basic Linux command line skills
  • 💉 Understanding of command injection vulnerabilities
  • 🔍 Keen eye for spotting clues and subtle hints

🏆 Skills Learned

  • 🐚 Exploiting command injection in a themed terminal environment
  • 📂 Enumerating files and directories through injection
  • 🔐 Extracting sensitive information via command chaining
  • 🎭 Roleplaying as a fantasy tavern infiltrator

⚔️ Solving The Challenge

🔍 Enumeration

Upon entering the Moonbeam Tavern via the provided “Enter Tavern” button, we are greeted by what appears to be a fantasy-themed Linux terminal. 🖥️

The terminal helpfully informs us:

“Tip: Use ↑↓ for history, Tab for completion, ; for command injection” 💡

A little poking around with the “help” command reveals some suspiciously familiar commands under the guise of tavern actions: 🍺

  • gossip – 📜 Listen to tavern whispers & rumors
  • observe – 👀 Survey the patrons & surroundings
  • examine – 🪞 Reflect upon your identity
  • help – 📖 Review the available commands
  • clear – 🧹 Wipe the slate clean
  • start – 🎲 Begin a game of chance or skill

With a knowing glint in our eye, we recognize gossip and examine as thinly-veiled aliases for the classic ls directory listing and whoami commands. The game is afoot! 🕵️‍♂️

🎯 Attack

Recalling the terminal’s helpful tip about command injection via semicolon “;”, we attempt to chain the examine command with id to confirm our suspicions:

examine;id

Lo and behold, the terminal first displays the examine output of “root”, followed by the revealing id command output. We have command injection! 💥 Grinning smugly, we realize gossip already hinted that a flag.txt file resides in the current directory. Time to plunder our hard-earned reward. 💰

💥 Exploitation

With a triumphant flourish, we input our final command to cat out that tantalizing flag:

examine;cat flag.txt

Success! The flag spills across the screen, and we snatch it up with a victorious whoop. 🎉 The secrets of the Moonbeam Tavern have been laid bare by our elite hacking skills. 😎 As we depart the tavern, flag in hand and ready to continue our valiant quest, we pause for a moment to salute the trusty semicolon. Punctuation has never tasted so sweet! 😋

🎲 Bonus Round: Hacking luck itself

But wait, there’s more! 😮 The Moonbeam Tavern offers a tempting dice or drinking game, accessible via the start command. Let’s see what luck (or hacking skills) may bring! 🍀

Specifying start dice presents us with a tantalizing opportunity:

🎲 The dice await your wager. Place your bet with “bet <amount>” to begin!

Feeling lucky, we bet 50 gold and roll the dice. But alas, after three rolls, our gold is gone! 💸 However, no foe matches our hacker prowess. 😎

Capturing the requests using BurpSuite as our proxy, we intercept a request sent to /api/wallet:

POST /api/wallet HTTP/1.1
Host: 94.237.50.198:31805
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: http://94.237.50.198:31805/
Content-Type: application/json
Content-Length: 31
Origin: http://94.237.50.198:31805
Connection: keep-alive
Cookie: sessionId=6zco7r7abb8
Priority: u=4

{"action":"deduct","amount":10}

Aha! If there’s a deduct action, could there be an increase as well? 🤔 Sending the request to Repeater, we modify the parameters:

  • deduct → increase
  • amount: 10 → 100

Lo and behold, our wallet now boasts 169 coins! 💰 Who needs luck when we can alter reality with a few keystrokes? 🪄

So while this bonus round doesn’t directly contribute to capturing the flag, it showcases the thrill of discovering and exploiting unexpected vulnerabilities. In the world of hacking, every opportunity to sharpen our skills is a valuable one! 💻🎯

🏆 Triumph at the Moonbeam Tavern

Congratulations, brave adventurer! 🎉 Your keen observation and command injection prowess have uncovered the secrets lurking within the Moonbeam Tavern’s walls. 🕵️‍♂️ The Shadow Veil Cartographer’s location is ours, and with it, the key to breaching Malakar’s defenses. 🗝️

As you step out into the bustling streets of Valeria, map in hand, the weight of your achievement settles upon your shoulders. 💪 The fellowship’s quest to save the realm from Malakar’s tyranny has gained a crucial advantage, thanks to your clever infiltration. 🙌

But the journey is far from over, valiant hero. 🌄 More challenges and mysteries await you in the lands of Eldoria. So steel your resolve, sharpen your skills, and prepare for the epic battles that lie ahead. ⚔️

🗺️ Ready for More Adventures?

Want to explore more Cyber Apocalypse 2025 writeups? Check out my other solutions here!