Home HackyEaster 2022 Dingos
Writeup
Cancel

Dingos

Challenge

If you like 🐕 Dingos, check out my new web site!

👉 my fancy Dingo web site

Solution

ite specifically mentions “version 2”, and a file listing is available.

1
2
3
4
5
6
7
$ aws s3 ls --recursive s3://dingos/
2022-02-09 08:44:52      63320 img/dingo1.jpg
2022-02-09 08:44:52      50718 img/dingo2.jpg
2022-02-09 08:44:52     107979 img/dingo3.jpg
2022-02-09 08:44:51     149397 img/dingo4.jpg
2022-02-09 08:45:16      96515 img/dingo_egg_ognid.png
2022-02-09 08:45:16        731 index.html

the current version of the egg file:

doesn’t have anything useful. But if you know that S3 supports file versioning, we can see older versions of the file.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
$ aws s3api list-object-versions --bucket dingos | jq '.Versions[] | select(.Key == "img/dingo_egg_ognid.png")'
{
  "ETag": "\"ba360fc78d0e6a5fbd99a6de04230247\"",
  "Size": 96515,
  "StorageClass": "STANDARD",
  "Key": "img/dingo_egg_ognid.png",
  "VersionId": "bBYeh2BHMNmSMjrwPuwe3IqT00UCd0Dq",
  "IsLatest": true,
  "LastModified": "2022-02-09T07:45:16.000Z",
  "Owner": {
    "DisplayName": "philipp.ps.sieber",
    "ID": "5b93a57df84ba174c0c60cdea70ca63d204bc59e3877d4b7ff1d76b79500562f"
  }
}
{
  "ETag": "\"7aea46507f7d9c400854bf721fbc76ed\"",
  "Size": 34716,
  "StorageClass": "STANDARD",
  "Key": "img/dingo_egg_ognid.png",
  "VersionId": "efyGzmXduxQAcaQIBgsxEj5i8xlCUdjG",
  "IsLatest": false,
  "LastModified": "2022-02-09T07:44:51.000Z",
  "Owner": {
    "DisplayName": "philipp.ps.sieber",
    "ID": "5b93a57df84ba174c0c60cdea70ca63d204bc59e3877d4b7ff1d76b79500562f"
  }
}

And thus obtain our URL!

https://dingos.s3.eu-west-1.amazonaws.com/img/dingo_egg_ognid.png?versionId=efyGzmXduxQAcaQIBgsxEj5i8xlCUdjG

Flag

he2022{4_b4rk1n9_D1NG0_n3v3r_b1735}