Rating:
# 6 of Hearts Write-Up
### Presented to you by [Team 0x194](https://0x194.com/writeup/Metasploit%20Community%20CTF%202020/6_of_Hearts).
Copyright © 2020 Team 0x194. Some Rights Reserved.
This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-sa/4.0/)
For attribution, we would appreciate if you also include a link to our [original write-up](https://0x194.com/writeup/Metasploit%20Community%20CTF%202020/6_of_Hearts)
-----
This challenge is on port `6868` of the target machine.
Visit the port, you will find yourself at a website named "Photos5u", which is a gallery presenting pictures of its users.
Examine closely the path of the pictures, you can find out that they follows the pattern of `/files/[userID]/[fileID]`, where `userID` is the initial of the author, and `fileID` is an incrementing integer starting from 0.
For example, the "Architecture by Barry deVillneuve" picture has the path of `/files/BD/0`. According to all the authors displayed on the homepage, we have at least 3 users: "Barry deVillneuve" with userID `BD`, "Tanya Wallace" `TW`, and "Malcom Cooper" `MC`.
Now let's try registering a new user "YECHS YECHS".
OK! So it seems like there is another path storing text files `/notes/[userID]/[fileID]`. Let's find out what the known users have posted here.
Under `/notes/MC/2`, a note caught our attention.
> Weirdest thing happened today. I was in the "Photos5u" main office and there was this woman, I think she was one of the techies, and she was ranting about "Eye Doors" or something to the owner. Apparently, our middle names are a threat to the site?!?!?
>
> Honestly, with middle names like "Ulysses Denise Donnoly" you'd think she'd be happy about hers being in use. Actually now that I think about it, she's probably embaressed about her intials.
So it seems like there is another user with userID `?UDD?`. It won't be too hard to bruteforce and find the userID.
At first we thought the middle name initial will be trimmed to a single character, *i.e.* `?U?`, but another experiment with registration proved that we were wrong.
While bruteforcing, it's clever to examine the return status code of `/notes/[userID]/0`, since the 0th note is guaranteed to exist for any valid user.
With a little bit of Python, we found out that the userID is `BUDDY`, and that our flag is located at `/files/BUDDY/2`.
Let's calculate its checksum to submit.
```console
$ md5sum 2.jpg
628fd217328ae42080d697a65a39d8e1 2.jpg
```
