Noobpad.exe

MiniCTF  Security Challenge VI: Cookie, Cookie

 

I made the password asdf.


In the picture above, I have an arrow pointing to the remember me box. This creates a cookie that tells the server what your account is and the password associated with it. If you don't click the remember me, the cookie gets flagged for deletion and you won't be able to see it using my favorite web tool--the web inspector on firefox. You can also see cookie data being passed along real time through Burp. I'd recommend it for some quality cookie viewing. Checking the cookie:


This stops the password check from even being processed and allows us to skip the auth process altogether.

Changed our usernamesch6 cookie to the encoded injection and we get our key!

MiniCTF Security Challenge 3: SQL Injection

Sadly, I haven't had much time to post due to family issues. Things have changed, and now I am back. Let's get started.

Going to the third security challenge brings us a fake security company's webpage. You can read about how 1337 they are because they can change desktop backgrounds. Let's investigate further to see if we can find any way to send the server our own commands. The login page has a forum, but is protected from injection. Check by entering in a comma.

The members only page access is blocked,obviously, with no visible input. Let's check the members' directory listing. It's always a good place to look--for recon--but in this case it gives us a way to put in our own data. Please note all the users are all admins as well. Check the URL when you click one of the member's names.



Here the URL takes in data from a table, processes it and then posts it to the member-info.php. Let's see if we get an error when we put in the comma like so:



 Looks perfect for injection. The page takes in the id number (stallone's) and posts all the relevant information according to his ID. Let's use our own SQL query to get back the data we want--the usernames and passwords.




This is a short excel table I created to help understand what the query is doing. It shows a table similar to a SQL database table. Here the first table is the original which contains the information about the member. The second query is what we're entering. Instead of the query finding all of the relevant information within the original table, we're pointing it to the accounts table and it reads the username and password columns and places them in the First and Last Name fields. The UNION operator is necessary because when you click the link, and it processes the input, it asks for 5 input values. We fill those with zeroes so we don't get any funky error.





Here we get out the username, the hashed password, and the three 0s we also asked for. You can crack the hash at any basic hash cracking website. I just did a quick google search and found hashkiller:



And there you go, the password for stallone is fire!

MiniCTF Security Challenge 2: Reversing PHP

 

On first inspection, there is no opportunity to LFIs (Local File Inclusion) on either the home page directory for sch2 or the restricted area. However, we're given a hint at the bottom of the page that says we should look at another challenge...

Well there is only one other challenge that we know so far, and that is the first challenge. Let's take a look. We KNOW there is a way to use LFI because we've already done it (index.php?=admin/.htaccess). However, we are not given a specific directory to include in the url and thus thus we cannot find htaccess or htpasswd.

This one stumped my friend and I for awhile. We searched google and finally came upon this:

php://filter/read=convert.base64-encode/resource=file.php

This reads the source of a php file and outputs it in base64 encoding to the page you're referring from. When conversion takes place, it reads the file before it runs it, allowing us to see the code in base64. This is perfect for us, because we know we can include a file in the previous challenge but cannot call the .htaccess in the new one. We need to look at secure.php's (Restricted Access) code in order to see what it is doing to your input.

So let's try:

/index.php?page=php://filter/read=convert.base64-encode/resource=../sch2/secure.php

Don't forget a Null byte or else it'll read: secure.php.php. Here it outputs the base64 encoded source of secure.php:






Copy and paste it in a base64 decoder to find out what the source is doing. I use http://www.base64decode.org/




The code is:

<?php
include("header.htm");

if ($_POST['adminpass'] != "") {

    $file_content = file("admin_key.log");
       
    $key = convert_uudecode(base64_decode($file_content[0]));
       
    if ($_POST['adminpass'] == $key) {
       
        if ($handle = opendir(".")) {
            while (false !== ($entry = readdir($handle))) {
                if (endswith($entry, ".txt")) {
                        echo file_get_contents($entry);
                }
            }   
            closedir($handle);
        }           
    } else {
        echo "<p align=\"center\">INCORRECT ADMIN PASS!</p>";
    }   
} else {
    echo "<div align=\"center\">";
    echo "<p align=\"center\">Please enter the admin pass to access the secure area.</p>";
    echo "<form name=\"input\" action=\"secure.php\" method=\"post\">";
    echo "admin pass:&nbsp;&nbsp;&nbsp;<input type=\"password\" name=\"adminpass\">";
    echo "<br>";
    echo "<input type=\"submit\" value=\"Submit\">";
    echo "</form></div>";
}
include("footer.htm");
?>

<?php

    function endswith($string, $test) {
        $strlen = strlen($string);
        $testlen = strlen($test);
        if ($testlen > $strlen) return false;
        return substr_compare($string, $test, -$testlen) === 0;
    }
?>

This code reads as follows:

Include/display header.htm

if the password does not equal NULL (empty space)

          then set the variable file_content to be the content in admin_key.log

          the key is equal to the uuencoded version of the base64  version of file_content (Encoded to base64 first, then uuencode)

If password is equal to the key
     and the open directory is ./
         then open/show the admin page.


Everything else is unimportant. We now know what file we're looking for; It's admin_key.log. Let's try to traverse to ../sch2/admin_key.log and see what we get. DON'T FORGET YOUR NULL BYTE!





There it is--the output of admin_key.log. Remember looking at the source of secure.php and how it decodes the key from base64 and then uudecode? This means you have to do what the code is doing to get the password. Once you've decoded it and logged in, you'll get your key to complete the challenge.

MiniCTF Security Challenge I: We Love Apache

 I switched over from HTS (Hack This Site) to MiniCTF because I cannot access the website right now... In my opinion you can learn much more from MiniCTF than HTS, anyway. I hate going out of order, but for now I'm going to go over the MCTF challenges and come back to HTS later.

First, we're greeted with this page:




There isn't much to look at, but explore the page anyway. Click the Home link to see this:




This means that we can traverse to another directory via the "index.php?page=???" by putting the directory we want in place of the "???" We probably want to traverse to the directory where the admin is...

Check the source to see where the admin link goes to:






This is indicative of an Apache server. Apache servers use .htaccess and .htpasswd to tell the server who is allowed to see a directory (htaccess) and the username:password for it (.htpasswd). It's important to note here that .htaccess is usually hidden in the folder it's protecting, so let's try some traversal:

http://damo.clanteam.com/sch1/index.php?page=admin/.htaccess



Also equally important to remember is to ALWAYS look at error messages.

They are a good sign. The most important part for us to see in is this error is this: "Failed opening 'admin/.htaccess.php' We don't want to go to .htaccess.php, we just want .htaccess. To end reading our include, we need to put a NULL byte () at the end of our url, like this:




Which sends us here:





Awesome! This tells us where .htpasswd is located, hiddenfoldersch1/.htpasswd. When we call our include, it is from the directory of /sch1/ so when we make our new include, we must make it go back a directory and then up to /hiddenfoldersch1/. Like this: index.php?page=../hiddenfoldersch1/.htpasswd

This brings us here:


There it is! The username and hash. We're not quite done yet because we have to crack the hash. Look at the first third of the hash, it will tell us which encryption it uses. $apr1 is MD5. The second $...$ indicates the salt (the amount of 'randomness'). I first went to Crack Station to try to crack the hash, but apparently they don't crack salted hashes. For an alternative, I used hashcat. In my experience it is the best hash cracker out there, but you can also you john the ripper and probably MDCrack. Also use the famous rockyou.txt dictionary file.

This is my output:




Go back to the main page and log in! You're done!

Freedom of Speech

 
This mission links to an American Nazi party website hell bent on making sure they look as ignorant as possible.  I first mouse over everything which may be a link. Hack This Site actually thought it was a good idea to link to a real American national-socialist website. Thanks a lot. Anyway, you can either just highlight the entire page, like I did, or you can view the source which will reveal the admin's login page, update.php. Also, always remember to read what you can on their websites, they often give clues on what you need to do...


Here is the page update.php. Check the source and see where and how the data is passed. It posts the data to update2.php and then checks to see if the username and password match within the database index. An SSI vulnerability will not exist due to it only being able to work if the server is displaying the text/(image) in which is processes. XSS works the same way.

User, Destroyfascism, is asking us to obtain admin access. When we check back at the main page, we see that a post organizing a racist meet-up is presented by WhiteKing. Seems like he has authority and probably admin access.

An example of a SQL vulnerability is when the website is comparing values within a database to log a user in. This is exactly what is happening on this website. Also, the submit button says "query" which is often a sign of SQL.

Also another way to tell if you have a possible SQL vulnerability is to put your known username into the field, and then just put a single quote (') into the password field. If it gives you back an error, chances are it can be injected with your own SQL.

Let's type his username back into our respective field on his update.php page. Now, there is a classic security exercise and commonly used method of putting an operator through a form field which gets processed by the server. The form will send a query when you hit submit, and it passes it like:


SELECT * FROM users WHERE username='$_GET[username]' AND password='$_GET[password]'

This query checks to make sure the corresponding values are both matching (AND operator).

We have a correct username. So it processes that correctly, but when we get to the password part of the query we have nothing. However there is a way to make that irrelevant. We can add the operator OR. With the OR operator we can use an expression like 'a'='a or '1'='1 to make the query say:


SELECT * FROM users WHERE username='$_GET[username]' AND password='$_GET[password]="'OR '1' = '1'




What it does is continues the query instead of actually ending the password query and it adds "OR if '1'='1" 1 will always = 1 so you will always get in. MAKE SURE you don't put a single quote after the ='1 because it will prematurely end the query and give you an error.

Anyway, once you hit submit you're done!

Vote Raging Inferno

Ryan's dishonest. He would like to have his band at the top of the local band review page even though he is dead-last. Sounds like his band sucks. Navigate to the Review page and scroll down until you see Raging Inferno, Ryan's band, and notice how the voting system works.


It looks like you choose from numbers 1-5 and click submit to give Uncle Arnold your vote. Like always, let's check the form code.


It looks like each option is indexed and given a value to submit. It's HTML, so let's just put our own value in.


By putting 1000 in the <option value="1"></option> We're able to submit a value of a thousand which increases the band's average immensely and "topshelf's" Raging Inferno. You're done!

A few days ago, I registered at hackthissite.org believing that I could accomplish anything the developers threw at me. I was wrong, of course. The basic missions are, well, basic. The realistic missions are a little more--how should I say--realistic. ;) Lucky enough for me, I have a very experienced and knowledgeable friend that has helped me learn most of what I didn't already know.  And that is my goal here. To give a push in the right direction for anyone who wants to learn.

Also, I'd recommend getting Firefox or Chrome for the add-ons/extensions. My personal favorite is Firefox, but either of them will do.

The basic missions on hackthissite.org are relatively simple for any one experienced in information technology. However, everyone has to start somewhere. So it's just as important to explain, in depth, these basic missions and methods. It is for a foundation.



Hack This Site Basic Mission 1 (The Idiot Test): Source Code - A Comment




I've done enough of these missions from various sites before and know that they almost always start with a basic source code solution. Also, notice the hint below the submit button, "you must learn HTML." You don't really need to know every bit of HTML code syntax. But if you know enough, it reads just like a book. 

If I was just beginning, I would learn some scripting language. Most people starting out believe that they need extensive knowledge in the language. However, the most important part of learning a new language is understanding how it functions not the what they do. For example, you may not understand:

<script>
function myFunction() {
    document.getElementById("myPar").innerHTML = "Hello World.";
    document.getElementById("myDiv").innerHTML = "You're so big!";
}
</script>

but you can understand that data is being passed and manipulated via document.getElementById and being again manipulated by the function innerHTML. After learning this, you can just look up any built in function you don't know. Most functions you may want to code yourself are already written. It's pretty easy.

Also it is important to understand opening up the source code or developer console is always the first step for finding a vulnerability.

Let's take a peak at the source code by right clicking anywhere on the page and selecting "View Page Source."


When it first opens, it may look like a mess, but you need not worry! The bulk of what you want to find--what you should be focusing on--is the form's code! If you squint and look closely, there is a comment which just gives you the answer right above the form source. How easy!

Pop the password in the field, and feel good about yourself. This hacking stuff is EZ.

Hack This Site Basic Mission 2: Source Code - No File, No Password

In the second mission, we're given a blurb about how some poor fellow whose actual name is Network Security Sam thinks he is a 1337 hacker by creating a script which grabs a password from a text file elsewhere on his server.

It seems the Network Security Sam is a space-case, he forgot to upload the file with the password. If there isn't a text file, there isn't a password. Just hit Enter. Another brain teaser from hackthissite.

Hack This Site Basic Mission 3: Source Code - Password.php

Sam must have noticed his missing file and has uploaded it. However, there are other issues...



The first step for these exercises should always be to look at the source code! So right click and view source and scroll down to find:


Pay close attention to where you information is submitted. Looks like it's going to the password.php file. Let's check it out. Hey look, it's the password! On to the next...

Hack This Site Basic Mission 4: Send Yourself an Email.

Sam now has the password locked away within a script. Too bad he has a terribly memory. Again, let's check the source code. Find the code for the form, which is always a good place to start, because we get to send our own information to the server... The form's code looks like:



 Hmm. Here the form has it sent to Sam's email address in the code. Well what if we put our own email address there? Would it send it to us? Well, yes, yes it would. If you're running Firefox or chrome open up the developer console by pressing the keys SHIFT+CTRL+K. It allows you to edit the html of the webpage in real time. Scroll down and find the source for the form again. Double click his email address and make it your own and hit the "send password to Sam." This will then send you the password, theoretically. However, you must actually enter your hackthissite account email.


Pat yourself on the back, you're on your way to become a 1337 h@x0r.

Hack This Site Basic Mission 5: Same as above?

From now on, we'll frequent the developer console instead of looking at the source directly. Frankly, the dev console organizes it so well you don't need to have an entire page of code open all at once. Anyway let's look at the level screen:


Here it says Sam, still reluctant to use his brain, decides to keep his program that emails his password to him. Apparently, he believes it's more secure. Let's find out. Open up the developer console and look at it. Damn. I honestly don't see anything different. Again, just put in your email, and hit send.

Hack This Site Basic Mission 6: Decryption

Here Sam has encrypted his password. Lucky for us, we have his encrypted password and the encryption method he uses. Let's see what the encryption does when we put "abcd" into it. The output is:

The first character does not change, ever, so we can assume that the first character in his encrypted password is, in fact, "f." The second letter, b has turned into c, then c to e, and lastly d to g. Looks to me like Sam's encryption is just changing the index on a list of characters by adding first, 1, then 2, then 3, and etc.



If you look at Sam's password, however, it has a colon and an equal sign. So let's look up what order the ascii characters go within memory: 
Credit goes to asciitables.com

The second character in his password is the colon. That means the index of the colon - 1 will be the index  of the second decrypted character. From looking at our table, it is a 9. So far Sam's password is f9. Easy.
The next character is at the index of "f" -2. Look 2 places above the "f" and you have your next letter, "d." Now, the index of "9" - 3, which is 6. Finish decrypting and move on to Mission 7!

Hack This Site Basic Mission 7: Running Unix Commands On Server

This mission is when the real vulnerabilities begin to show themselves. Here Sam has obscured his password and put it a file in the same directory. He also is a unix/linux noob who has just discovered how to run the command cal.pl (a classic example in computer security.) Lucky for us, this will be our in.

Check the source as common practice, but nothing can be found to help you with the password. So turn your attention to the cal.pl. When Sam calls cal.pl from his website he is actually calling a unix command in which the server will run. In unix, you can chain commands together with the && operator. His form makes it possible to run cal.pl && ls (ls being the unix command to show directory files.) Just type && ls in the form and you get this:


And it spits out the directory listing. Hey looky here, this k1kh31b1n55h.php looks mighty peculiar. Open it up to find the password.

Hack This Site Basic Mission 8: SSI (Server Side Include)

Let's take a look:
At first glance we know a)the password is unencrypted, b)the file is stored in the directory /8/ (same as our form) and c) Sam's daughter is ruining his security. You can look at the source or just check to see what Sam's daughter's script is doing. Let's just test it for now.


Here Stephanie's script runs in the directory /8/ and then posts the shtml file to a tmp directory. Shtml is usually a good sign that there is an SSI exploit because shtml is dynamic. This let's you run your code on their server. Let's test it out:




Looks like it's vulnerable. If it wasn't, the file would return  <!--!. This Server Side Include allows us to run our own code on their servers before her script runs, allowing us to change the output. Just like the last mission, we need to run the ls command to list possible directories and files. So let's see what it spits out:




What do you know--it's displays each shtml file that has been created within the directory /tmp/. The password file is in a different directory, however, so we need to use a technique called Directory Traversal. In linux and unix there is a command to go back to the parent directory--"../" We will use this command in our SSI to navigate back from /tmp/ into /8/. We still need to list the files in the parent directory so we use "ls ../"


Open up the inconspicuous php file and there is your password!

Hack This Site Basic Mission 9: More Directory Traversal

Sam seems to think having an unencrypted password in a text file on server is a GOOD idea. Well he's wrong, of course. Especially when we know somewhere else on the site that we can use SSI... Anyway, he's listed it the /9/ directory.

If you test the password input for SSI you get nothing in return. So think back. How can we get to directory /9/ is not from that password input? Well everything is connect on a server. So if you can traverse from /tmp/ to /8/ from the other mission, you could possibly traverse from /tmp to /9/. Let's go back to mission 8 and see what we can do.


Here I try the ls cmd and traverse back from the /tmp/ directory to the /basic/ directory and then back up to /9/. It then posts the password file for mission 9 in /8/tmp/. You're done!

 Hack This Site Basic Mission 10: Cookie, Cookie!

There is a good lesson in this mission that is very important to learn. Let's first take a look at the submit page:
 Wow, not very much information. However, if you go to the /basic/ page, there is a hint that you need to use javascript. There are a few ways to do this, but the easiest, in my opinion, is through the developer console. So open 'er up (CTRL+SHIFT+K).


 When you open the dev console you'll probably end up in the inspector tab, where it shows the source. Let's go over to the Console. The console let's us inject our own scripts into the page. Here I've looked at the cookie we've been assigned on index.php.

Pay no mind to level10.authorized=yes. It wasn't on purpose. But when you type in document.cookie it will show you the contents of the cookie that has been assigned to your PHPSESSID (your identifier). The level10_authorized=no seems obvious. Type in:
This will set the authorized object to yes and give us authorization to get into the next page! Just click submit and you're done.

Hack This Site Basic Mission 11: Elton John

So there is one big, important clue here. "Unfortunately he does not understand Apache." Let's click the link and see what we get:



Each time I click the Basic 11 link it send me to an nearly empty page. The first thing I did was look at the source. There was nothing there except the comment that they have their own directory of music...



So let's try traversing the directory upwards. I tried /eltonjohn/, /ej/, elton/, and finally arrived on /e/.
We find that the /e/ directory exists and we have a directory listing which goes to:

The directory ends. When a directory is hidden, it's hidden within the file .htaccess in the directory which it is trying to hide. Let's try:


Woo! So .htaccess is telling us that the directory DaAnswer is hidden within the /n/ directory. So let's traverse to /DaAnswer/ and we get:
"The answer is easy! Just look a little harder," it says. So let's check the index.php, a common file that calls the functions for most other pages (much like a main() function in programming)Let's check from the main page for mission 11, directory /11/. It brings us:


What do you think the password is?

That's it, you did it! The next step is the realistic missions, where we will continue progressing our 1337 sk1||z.

-Ian