Project Spider Infiltration

solution.md|168 lines(4.3 KB)

🕷️ Oscorp O-COM Portal — CTF Solution Walkthrough

Challenge Name: Project Spider Infiltration
Category: Cryptography + Web

#Step 1: SQL Injection — Extract the Encryption Key

Navigate to the O-COM Login tab. The login terminal is vulnerable to SQL injection — the hint at the bottom and the IT department notice both confirm this.

#1a. Find the column count

The original query selects 3 columns (id, username, clearance). You can confirm this with trial and error:

Username: ' UNION SELECT 1,2,3 --
Password: anything

If it returns data, the query has 3 columns.

#1b. Read the Field Manual

The downloadable Oscorp Admin Field Manual (from the Transmissions tab) reveals the secret table:

id	project_key	clearance
1	GLIDER	GAMMA
2	PUMPKIN	GAMMA
3	SYMBIOTE	DELTA
4	TENTACLE	DELTA
5	VENOM	GAMMA
6	CARNAGE	DELTA
7	[CLASSIFIED]	OMEGA

import binascii

key = "SYMBIOTE"
hex_beta = "<paste hex string from transmission_beta.txt>"

cipher_bytes = binascii.unhexlify(hex_beta)
plaintext = ""
for i in range(len(cipher_bytes)):
    plaintext += chr(cipher_bytes[i] ^ ord(key[i % len(key)]))

print(plaintext)

TRANSMISSION BETA: Agent Octavius, the master key for PROJECT-VENOM
is stored in vault seven. Retrieve it before dawn. The encoded access
phrase is: ycjljam{ad0_a1t3_w4k_0zj0yw_m4ss5}. Destroy this message
after reading. Osborn.

y → r    (y=24, 24-7=17 → r)
c → v    (c=2,  2-7=-5 → 21 → v)
j → c    (j=9,  9-7=2 → c)
l → e    (l=11, 11-7=4 → e)
j → c    (j=9,  9-7=2 → c)
a → t    (a=0,  0-7=-7 → 19 → t)
m → f    (m=12, 12-7=5 → f)

What	Value
SQL Injection Payload	`' UNION SELECT id, project_key, clearance FROM oscorp_projects --`
XOR Key	`SYMBIOTE`
ROT Shift	`7`
Scrambled Flag	`ycjljam{ad0_a1t3_w4k_0zj0yw_m4ss5}`
Final Flag	`rvcectf{tw0_t1m3_p4d_0sc0rp_f4ll5}`

Project Spider Infiltration

🕷️ Oscorp O-COM Portal — CTF Solution Walkthrough

#Step 1: SQL Injection — Extract the Encryption Key

#1a. Find the column count

#1b. Read the Field Manual

#1c. Dump the secret table

#Step 2: Get the Shift Value

#Step 3: Download the Transmissions

#Step 4: XOR Decrypt Transmission Beta

#Using CyberChef:

#Using Python:

#Decrypted output:

#Step 5: Reverse the ROT-7 Cipher

#Using CyberChef:

#Manual calculation:

#Result:

#Step 6: Submit the Flag

#Quick Reference