> For the complete documentation index, see [llms.txt](https://szczygielka.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://szczygielka.gitbook.io/writeups/ctfs-writeups/1753ctf-2024/resume-misc.md). # Resume - Misc ## Task Hi, I'm Mike and this is my resume. Drop me an email if you want to get some flags, cause I got them all... ## Solution We get the following link: ``` https://cv-13e304e345c1.1753ctf.com/ ``` Let's go to that webpage:

Due to the information on the website to get the flag, we should e-mail Mike. However, the website has no e-mail address, so we must find a way to get it. Examining the elements of the website, we can see that the avatar of Mike leads us to the following URL: ``` https://www.gravatar.com/avatar/2471b1362bace767fdc0bb9c7e4df686?s=150 ``` This avatar is hosted by the Gravatar. While visiting the Gravatar website, I came across the following code, which states that the avatar name is created by using a SHA256 hash from the email address:

However, something didn't feel right, because the avatar name in the URL was too short and looked like an MD5 hash: ``` 2471b1362bace767fdc0bb9c7e4df686 ``` According to [information ](https://stackoverflow.com/questions/28212836/how-to-decrypt-a-gravatar-hash-into-real-email-address)from Stack Overflow, Gravatar has historically used an MD5 hashing algorithm to create an avatar name based on an e-mail address. While searching for information on how to get more details about the Gravatar user, based on the hash of avatar, we came across this article: {% embed url="" %} It follows that there is a hidden URL route that allows for user enumeration. However, to enumerate our user, we should know his ID or username. We can check the username by navigating to the following URL containing the user's MD5 hash, which should display the Mike's profile: ``` https://www.gravatar.com/2471b1362bace767fdc0bb9c7e4df686 ```

In the URL we can see that the username is: ``` keeponrocking7920420bb4 ``` Navigating to the address should reveal more information about the user: ``` https://pl.gravatar.com/keeponrocking7920420bb4.json ```

We did not receive an e-mail address in the JSON data. Probably we will have to guess or use brute force to crack the hash. Let's start with the first option. Let's assume that the beginning of the e-mail address is connected with the username, that is `keeponrocking7920420bb4`. We can also conclude that the e-mail address may be associated with the CTF. The official domain of CTF is `1753ctf.com`, so we can initially assume that the e-mail address is connected with this domain. Let's check the MD5 hashes for the e-mails `keeponrocking7920420bb4@1753ctf.com` and `keeponrocking@1753ctf.com`: ``` szczygielka@hacks$ echo -n keeponrocking7920420bb4@1753ctf.com | md5sum bf036ba50b7aa06ecdfe48a5f67fcb20 - szczygielka@hacks$ echo -n keeponrocking@1753ctf.com | md5sum 2471b1362bace767fdc0bb9c7e4df686 - ``` The hash MD5 for the `keeponrocking@1753ctf.com` e-mail address is the same as in Mike's avatar. So we get the Mike's e-mail address. Now we should send an e-mail to Mike's address to get the flag. A few minutes later after sending the e-mail, we get a response with the flag:

Flag: ``` 1753c{i_have_dizzz_flagzz_baby} ``` Comments about this task: