Sotolyot — avitoctf

Description

Медоеды засекли передвижение Королевы «Золотой Соты». Чтобы узнать её намерения и помешать планам улья, нужен её маршрутный лист. На периметре — только Сотолёт, операционный портал роя «Золотая Сота» с публичной картой вылетов. Получите доступ к панели старшего диспетчера и раздобудьте маршрутный лист Королевы. Target: sotolet.ru/.

The public site provides a tactical flight map. The goal is to reach the senior dispatcher's cockpit and obtain the Queen's route sheet.

Analysis

Public application leak

The public JavaScript requests /api/map-data and then removes hidden routes only in the browser:

const response = await fetch("/api/map-data", { cache: "no-store" });
const payload = await response.json();
routes = payload.routes || [];
visibleRoutes = routes.filter((route) => !route.hidden);

Requesting the API directly disclosed an object with id=queen-route, hidden=true, and a description meaning "Queen escort." Its trajectory was replaced by eight XXX groups, so this client-side disclosure identified the target object but did not reveal the route sheet or flag.

The main HTML also advertised sotobaza.sotolet.ru and sotokabina.sotolet.ru. Both HTTPS front doors returned the same nginx/1.27.5 native 403 response.

Failed nginx bypasses

The following families did not cross the nginx boundary:

• spoofed client IP headers, including X-Forwarded-For and X-Real-IP;
• Referer, Origin, hostname case, and trailing-dot variations;
• alternate methods and path-normalization forms;
• SNI, Host, and absolute-form request-target differences.

These stable 403 responses indicated a real perimeter ACL rather than an application authorization check. The successful pivot was therefore infrastructure discovery on the same authorized IP, not another nginx parser variation.

Solution

1. Discover the directly exposed backends

A targeted scan of the public address found two additional HTTP services:

nmap -Pn -n -T3 -sV -p 8080,8443 84.201.131.80

...