# Cyber Apocalypse 2021: Inspector Gadget
# Introduction
Inspector Gadget was known for having a multitude of tools available for every occasion. Can you find them all?
> Complete write up for the Inspector Gadget challenge at Cyber Apocalypse 2021 CTF hosted by HackTheBox.eu. This article is a part of a [CTF: Cyber Apocalypse 2021](https://blog.cyberethical.me/series/ctf-cyber-apocalypse-2021) series. You can fork all my writeups directly from the [GitHub](https://github.com/KamilPacanek/writeups).
> Learn more from additional readings found at the end of the article. I would be thankful if you mention me when using parts of this article in your work. Enjoy!
# Basic Information
| # | |
|:-- |:--|
|Type |CTF / Web
|Name | **Cyber Apocalypse 2021 / Inspector Gadget**
|Started | 2021/04/19
|URLs | https://ctf.hackthebox.eu/ctf/82
| | https://ctftime.org/event/1304
|Author | **Asentinn** / OkabeRintaro
| | [https://ctftime.org/team/152207](https://ctftime.org/team/152207)
%%[support-cta]
# Target of Evaluation
We are given the IP and a port as a target of evaluation:
* `46.101.54.25:31511`
# Recon
> This was an introductory level challenge that could be completed only with a browser and embedded dev tools. Nevertheless, I'm documenting my approach, because at the time being I couldn't know that.
Doing the initial scan with `nmap` to find more about the ToE:
`sudo nmap -A -Pn -p 31511 46.101.54.25 -oN nmap/initial.nmap`
```txt
# Nmap 7.91 scan initiated Mon Apr 19 20:48:54 2021 as: nmap -A -Pn -p 31511 -oN nmap/initial.nmap 46.101.54.25
Nmap scan report for 46.101.54.25
Host is up (0.043s latency).
PORT STATE SERVICE VERSION
31511/tcp open unknown
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| accept-ranges: bytes
| cache-control: public, max-age=0
| last-modified: Mon, 19 Apr 2021 04:45:39 GMT
| etag: W/"2ef-178e872c538"
| content-type: text/html; charset=UTF-8
| content-length: 751
| Date: Mon, 19 Apr 2021 18:49:07 GMT
| Connection: close
|
|
|
| Inspector Gadget
|
|
|
|
|
|
CHTB{
|
|
|
|
| \n\x20\x20\x20\n\x20\x20\x20` comment
* `https://threejs.org/examples/js/controls/OrbitControls.js` script
The robot and the scenery seems to originate from the following repository:
* `https://zultanzul.github.io/ThreeJS-Robot/`
But on ToE we rotate the camera is disabled - maybe we need to enable this by updating `update()` method in `/static/js/main.js`?
### `/static/js/main.js`
Starts with `console.log`, that apparently I've missed:
```js
console.log("us3full_1nf0rm4tion}");
```
Now, checking the combination of the two phrases I've found so far.
The following are **not** the correct flags:
* `CHTB{us3full_1nf0rm4tion}`
* `CHTB{us3full_1nf0rm4tion1nsp3ction_}`
* `CHTB{us3full_1nf0rm4tion_1nsp3ction}`
* `CHTB{1nsp3ction_us3full_1nf0rm4tion}`
After trying to enable controls that are disabled in the `update()` (`THREE.TOUCH not defined` error). I'm moving to look in the other files.
### `/static/css/main.css`
```css
/* c4n_r3ve4l_ */
```
Let's try then once again to assemble the flag.
# Flag
**CHTB{1nsp3ction_c4n_r3ve4l_us3full_1nf0rm4tion}**
%%[follow-cta]
*Cover photo by [Ales Nesetril](https://unsplash.com/@alesnesetril?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) on [Unsplash](https://unsplash.com/?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)*