> For the complete documentation index, see [llms.txt](https://arne-ctf.gitbook.io/ctf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://arne-ctf.gitbook.io/ctf/2022/downunderctf-2022/cloud-jimmy-builds-a-kite.md).

# Cloud - Jimmy Builds a Kite

373 points | 94 solves

## Description

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FaapKuS1aYVEw3CvVyrZk%2Fimage.png?alt=media&amp;token=c14cc037-52ec-438b-86ca-9cfe8d2b9e9f" alt=""><figcaption></figcaption></figure>

## Solution

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FS9UbjmPxggjfUO2gzuhf%2FPasted%20image%2020220924165902.png?alt=media&amp;token=013082ce-80a2-47f3-9a6c-10e1fcb78946" alt=""><figcaption><p>Game</p></figcaption></figure>

The game is quite straight forward, nothing much that we can do here.

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2F0wrqMsy0f3jiY9XM7pOZ%2FPasted%20image%2020220924165947.png?alt=media&amp;token=bcf59605-7f24-4a23-861f-d7eabfe410ac" alt=""><figcaption><p>Source code</p></figcaption></figure>

Checking out the source code, it seems like this game is written in python and the main game logic is in `/adventure.py`. The game is simple and there are no signs of how to get a flag. At this point, I went back to read the challenge description and it mentioned "really cheap hosting provider". Looking at the challenge URL, the game appears to be hosted on Google cloud and instead of navigating to the given <https://jimmys-big-adventure.storage.googleapis.com/index.html>, I navigated to [https://jimmys-big-adventure.storage.googleapis.com](https://jimmys-big-adventure.storage.googleapis.com/index.html) instead.&#x20;

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FTbZJCKQRFidDK1wg1XTe%2FPasted%20image%2020220924170145.png?alt=media&amp;token=5af262c4-713e-4907-819a-86705fb59e90" alt=""><figcaption><p>Root URL</p></figcaption></figure>

We finally have a lead here. There is a `flag.txt` in the bucket but accessing it directly returns the code `AccessDenied`.&#x20;

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FEE9RvLEV24Y868IMTYbZ%2FPasted%20image%2020220924170251.png?alt=media&amp;token=b57595f0-e109-4e2e-bb69-dd17a2e4ac08" alt=""><figcaption><p>AccessDenied</p></figcaption></figure>

But luckily, there is another file `credentials.json` that is not protected.

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FeSab1VmxwQkErxe9gevP%2FPasted%20image%2020220924170346.png?alt=media&amp;token=81653069-9631-47af-bd2f-bdb3654ed148" alt=""><figcaption><p>credentials.json</p></figcaption></figure>

Now, all that is left to do is to figure out how to authenticate using the leaked credentials and call the cloud storage API to retrieve the flag. What I did was to first download the credentials file, run Powershell and set the credentials in the environment using the command: `$env:GOOGLE_APPLICATION_CREDENTIALS="<path_to_credentials_json_file>"`. I then run the following script to get the flag.

```python
# Imports the Google Cloud client library
from google.cloud import storage

# Instantiates a client
storage_client = storage.Client()
bucket = storage_client.get_bucket("jimmys-big-adventure")

blob = bucket.blob("flag.txt")
blob = blob.download_as_string()
blob = blob.decode('utf-8')

print(blob)
```

Flag: `DUCTF{Th0se_cr3ds_w3r3nt_m34nt_2_b33_th3r3}`