Beautiful jewelry

Platform: grodno_new_year_2026 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-10 | Status: Solved Techniques: directory_enumeration, common_filename_guessing, media_directory_access

Summary

Credentials provided: ctf_user;ctf_password

Beautiful jewelry - grodno_new_year_2026

Challenge Info

• Event: grodno_new_year_2026
• Task ID: 410
• Category: Web
• Difficulty: Easy
• Points: 500
• Author: @hckerror

Description

Никогда ещё не видел таких красивых украшений. (I've never seen such beautiful jewelry before.)

http://ctf.mf.grsu.by/web_tasks/ice_shop/

PS: Используйте данные от задачи Shop robbery (Use the data from the Shop robbery task)

Credentials provided: ctf_user;ctf_password

Analysis

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Initial Reconnaissance

1. Accessed the jewelry shop website at http://ctf.mf.grsu.by/web_tasks/ice_shop/
2. Logged in using credentials: username=ctf_user, password=ctf_password
3. Discovered a Django-based e-commerce site with 9 jewelry products
4. User profile showed balance of 0$, preventing any purchases

Investigation Steps Attempted

Several common web vulnerabilities were tested:

Key Discovery

While investigating the /media/ directory where product images were stored, I attempted to access common filenames that might contain sensitive information:

 bash read-only • copy allowed Copy
# Testing common secret filenames
curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/flag.txt"
curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt"

The second request returned the flag!

Solution

Flag Location

The flag was stored in a plaintext file accessible at:

http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

One-liner Solution

 bash read-only • copy allowed Copy
curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt"

Vulnerability Analysis

Type: Information Disclosure / Insecure Direct Object Reference

The secret.txt file was placed in the publicly accessible /media/ directory without any access controls. In Django applications, the /media/ directory is typically used for user-uploaded content and is served directly by the web server without authentication.

The flag name REDACTED (half of path traversal) hints that this was an intentional information disclosure vulnerability - the "half" suggests that while path traversal wasn't needed, the concept of accessing files through predictable paths was key. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Common Files to Check

/media/flag.txt
/media/secret.txt
/media/.htaccess
/media/backup.sql
/static/flag.txt
/uploads/flag.txt

Lessons Learned

1. Always enumerate accessible directories - Media/upload directories often contain unprotected files
2. Try common filenames - flag.txt, secret.txt, backup.sql, etc.
3. Pay attention to hints - The challenge name "Beautiful jewelry" pointed to looking at media/images
4. Check Django defaults - /media/ and /static/ are common Django directory patterns
5. Don't overcomplicate - Sometimes the simplest approach (guessing filenames) works ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Tools Used