Category: Miscellaneous
Flag: EH4X{1_h4v3_4ll_th3_c3t1f1c4t35}
Challenge Description
yeah i can do it
Analysis
dig +short stapat.xyz Adig +short stapat.xyz AAAAdig +short @1.1.1.1 stapat.xyz Adig +short @1.1.1.1 stapat.xyz AAAA0.0.0.0::40.81.242.97The first weird signal was DNS split behavior: local resolution for stapat.xyz was a sink (0.0.0.0 / ::), but Cloudflare DoH returned a real origin IPv4. That explained why direct curl from this environment looked dead while a normal browser path still worked elsewhere.
curl -sS -L --doh-url "https://1.1.1.1/dns-query" -A "Mozilla/5.0" -i "https://stapat.xyz/"HTTP/1.1 200 OK...<p>Please visit our stores</p>After forcing DNS-over-HTTPS, the page rendered cleanly and the only actionable clue was the sentence “Please visit our stores.” In a Misc challenge with a tiny prompt, that kind of wording is usually the actual route, not filler text.
curl -sS -k -L --resolve "store.stapat.xyz:443:40.81.242.97" -A "Mozilla/5.0" -i "https://store.stapat.xyz/"HTTP/1.1 200 OK...EH4X{1_h4v3_4ll_th3_c3t1f1c4t35}Using SNI/Host override with --resolve hit the virtual host directly and immediately returned the flag as plain text. So the whole trick was certificate/vhost routing behind DNS behavior, not user-agent filtering.
Solution
import reimport subprocess
def run(cmd: list[str]) -> str: return subprocess.check_output(cmd, text=True)
def main() -> None: ip = run(["dig", "+short", "@1.1.1.1", "stapat.xyz", "A"]).strip().splitlines()[0]
homepage = run([ "curl", "-sS", "-L", "--doh-url", "https://1.1.1.1/dns-query", "-A", "Mozilla/5.0", "https://stapat.xyz/", ]) if "Please visit our stores" not in homepage: raise RuntimeError("expected clue not found on homepage")
store = run([ "curl", "-sS", "-k", "-L", "--resolve", f"store.stapat.xyz:443:{ip}", "-A", "Mozilla/5.0", "https://store.stapat.xyz/", ])
match = re.search(r"EH4X\{[^}]+\}", store) if match is None: raise RuntimeError("flag not found")
print(match.group(0))
if __name__ == "__main__": main()python3.12 solve.pyEH4X{1_h4v3_4ll_th3_c3t1f1c4t35}