112 - Умный переулок (Smart Alley)

Platform: Duckerz CTF | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-09 | Status: Solved Techniques: api_versioning_exploit, frame_extraction

Summary

Task: Investigate the Smart Alley system to access video recordings and find hidden information. Solution: Exploited deprecated API v1 endpoint with broken access control to obtain video file, then used ffmpeg for frame extraction to read flag from a sign at 43-second mark.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: duckerz | ID: 20260109_120000_duckerz_smart_alley
• Tags: forensics, api_vulnerability, broken_access_control, video_analysis
• Indicators: multiple api versions, v1 vs v2, hidden text in video
• Source: 20260109_120000_duckerz_smart_alley.md

Foothold

Vulnerability / Misconfiguration

1. Api_versioning_exploit
2. Frame_extraction

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• api_versioning_exploit
• frame_extraction
• Tags: forensics, api_vulnerability, broken_access_control, video_analysis

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Investigating the "Smart Alley" system. The goal is to gain access to video recordings and find hidden information.

Analysis

While examining the web application at http://tasks.duckerz.ru:30074/, two API versions were discovered: v1 and v2.

• API v2: Has strict access control checks. Regular users cannot view videos.
• API v1: Contains the /api/v1/video endpoint which returns the path to the video file without proper authorization checks (Broken Access Control). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. API Exploitation

Accessing the deprecated endpoint allowed obtaining a direct link to the video file: video_ad4340306e925f588e4beef5ff9d4d6f.mp4

2. Video Forensics

While watching the video, at the 43-second mark a person with a white sign was noticed. For detailed analysis, ffmpeg and ImageMagick tools were used.

Extracting frames in the target appearance interval (38-48 sec):

ffmpeg -i video_ad4340306e925f588e4beef5ff9d4d6f.mp4 -ss 00:00:38 -to 00:00:48 -vf "fps=10" frames/out%04d.png

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

After processing the frames and improving readability, the flag text was read piece by piece from the sign: DUCKERZ, {v1deo_, fl4g}. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR