Beautiful jewelry

Platform: Grodno New Year 2026 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-10 | Status: Solved Techniques: directory_enumeration, common_filename_guessing, media_directory_access

Summary

Credentials provided: ctf_user;ctf_password

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: grodno_new_year_2026 | ID: 20260110_grodno_new_year_2026_beautiful_jewelry
• Tags: information_disclosure, django, directory_listing, media_files
• Indicators: media directory accessible, Django application, image storage path visible, common secret filenames
• Source: 20260110_grodno_new_year_2026_beautiful_jewelry.md

Foothold

Vulnerability / Misconfiguration

1. Directory_enumeration
2. Common_filename_guessing
3. Media_directory_access

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• directory_enumeration
• common_filename_guessing
• media_directory_access
• Tags: information_disclosure, django, directory_listing, media_files

Original Writeup

<details><summary>Click to expand original content</summary>

Challenge Info

• Event: grodno_new_year_2026
• Task ID: 410
• Category: Web
• Difficulty: Easy
• Points: 500
• Author: @hckerror

Description

Никогда ещё не видел таких красивых украшений. (I've never seen such beautiful jewelry before.)

http://ctf.mf.grsu.by/web_tasks/ice_shop/

PS: Используйте данные от задачи Shop robbery (Use the data from the Shop robbery task)

Credentials provided: ctf_user;ctf_password

Analysis

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Initial Reconnaissance

1. Accessed the jewelry shop website at http://ctf.mf.grsu.by/web_tasks/ice_shop/
2. Logged in using credentials: username=ctf_user, password=ctf_password
3. Discovered a Django-based e-commerce site with 9 jewelry products
4. User profile showed balance of 0$, preventing any purchases

Investigation Steps Attempted

Several common web vulnerabilities were tested:

Key Discovery

While investigating the /media/ directory where product images were stored, I attempted to access common filenames that might contain sensitive information:

# Testing common secret filenames
curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/flag.txt"
curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt"

The second request returned the flag!

Solution

Flag Location

The flag was stored in a plaintext file accessible at:

http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

One-liner Solution

curl -s "http://ctf.mf.grsu.by/web_tasks/ice_shop/media/secret.txt"

Vulnerability Analysis

Type: Information Disclosure / Insecure Direct Object Reference

The secret.txt file was placed in the publicly accessible /media/ directory without any access controls. In Django applications, the /media/ directory is typically used for user-uploaded content and is served directly by the web server without authentication.

The flag name REDACTED (half of path traversal) hints that this was an intentional information disclosure vulnerability - the "half" suggests that while path traversal wasn't needed, the concept of accessing files through predictable paths was key. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Common Files to Check

/media/flag.txt
/media/secret.txt
/media/.htaccess
/media/backup.sql
/static/flag.txt
/uploads/flag.txt

Lessons Learned

1. Always enumerate accessible directories - Media/upload directories often contain unprotected files
2. Try common filenames - flag.txt, secret.txt, backup.sql, etc.
3. Pay attention to hints - The challenge name "Beautiful jewelry" pointed to looking at media/images
4. Check Django defaults - /media/ and /static/ are common Django directory patterns
5. Don't overcomplicate - Sometimes the simplest approach (guessing filenames) works ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Tools Used

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR