We are given a link to a website. One of the first things we do is check for a robots.txt and we find:

We download and try to extract top\_secret.zip but it is encrypted. We can see the filenames though:

This indicates that there is a master password somewhere which will give us the zip password. But we can also see that it contains html/js/\* which likely is the same contents as the files under js/ on the live server. This allows us to attempt to break the ZIP encryption using a known plaintext attack with bkcrack ([https://github.com/kimci86/bkcrack](https://github.com/kimci86/bkcrack)). It is important that when we generate the plaintext zip file containing the unencrypted, compressed ie10-viewport-bug-workaround.js, that its compressed size matches the compressed size in top\_secret.zip. If the compressed sizes do not match, then the data is different and the attack will not work.

Now we can decrypt the files in the ZIP file:

We analyzed the other PHP files in the ZIP. We can see that pay.php will include flag.php if we have enouch gold:

One way to easily have enough gold is if we can inject into the SQL query using the ID field in the session. As we can see from login.php, the ID field comes directly from the database and is not escaped:

Unfortunately, the id field in the database is quite small (maybe 32 bytes), so our SQL injection needs to also be small. We ended up with the following query:

After registering a user with this ID, logging out, and login with this ID, we can visit /pay.php with the correct key parameter to get the flag.