112 - Умный переулок (Smart Alley)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: api_versioning_exploit, frame_extraction

Summary

Task: Investigate the Smart Alley system to access video recordings and find hidden information. Solution: Exploited deprecated API v1 endpoint with broken access control to obtain video file, then used ffmpeg for frame extraction to read flag from a sign at 43-second mark.

112 - Умный переулок (Smart Alley) — duckerz

Description

Investigating the "Smart Alley" system. The goal is to gain access to video recordings and find hidden information.

Analysis

While examining the web application at http://tasks.duckerz.ru:30074/, two API versions were discovered: v1 and v2.

• API v2: Has strict access control checks. Regular users cannot view videos.
• API v1: Contains the /api/v1/video endpoint which returns the path to the video file without proper authorization checks (Broken Access Control). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. API Exploitation

Accessing the deprecated endpoint allowed obtaining a direct link to the video file: video_ad4340306e925f588e4beef5ff9d4d6f.mp4

2. Video Forensics

While watching the video, at the 43-second mark a person with a white sign was noticed. For detailed analysis, ffmpeg and ImageMagick tools were used.

Extracting frames in the target appearance interval (38-48 sec):

 bash read-only • copy allowed Copy
ffmpeg -i video_ad4340306e925f588e4beef5ff9d4d6f.mp4 -ss 00:00:38 -to 00:00:48 -vf "fps=10" frames/out%04d.png

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

After processing the frames and improving readability, the flag text was read piece by piece from the sign: DUCKERZ, {v1deo_, fl4g}. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍