EPFL's CTF team

TUCTF 2018: Professor Plum’s Ravenous Researcher


Professor Plum is hiring! Maybe you can get the job!


Professor Plum wants us to find Mr. Boddy.

There is a page in which we can submit an input. (to find Boddy)

Giving random inputs, the site return: Nice try but he's not there. Maybe try somewhere else in the mansion?

We have a cookie with 2 fields: Found_Boddy and Location. In which Found_Boddy is set to 0.

Knowing that this challenge is a cluedo reference, the location of where Boddy is probably on of the 10 rooms of the game.

The rooms are: Kitchen, Ballroom, Conservatory, Dining Room, Cellar, Billiard Room, Library, Lounge, Hall, Study.

Then we tried all those room with the cookie parameter Found_Boddy set to 1.

Eventually we found Boddy in the Billiard Room!