Live Hacking - Internetwache CTF 2016 - web50, web60, web80

Key Takeaways

welcome to video write up from the internet V CTF 2016 this video will be about three web challenges that I solved besides those three web challenges I have also solved three crypto and three exploitation challenges for which I will also make a video so let's start with the first web 50 challenge called mess of hash student have developed a new admin lockin technique I doubt that it's secure but it hash hasn't been crackable we get a URL to the login page and also a zip file with the source code the zip file contains a readme which has PHP code Snippets inside so we see that there's a certain admin user and the as password seems to be a hash and we also get the two functions clean hash which is cleaning up a little bit uh replacing some characters and we have a function called my hedge which does md5 two times over the input string with a certain salt and obviously because of a loog in the password has to be compared and usually you would compare the hashes from the input and if you know a little bit of PHP then you know maybe about this crazy handling of types in PHP because PHP automatically converts certain times into other types when possible and you can see that the result is true those two different strings are true because PHP comes up with this great idea to automatically convert the string into a number and and z e uh and a certain number is a very very tiny number it's basically zero as you can see here so it's basically comparing two zeros with each other two numbers so now we just have to Brute Force the input that after two rounds of md5 with the salt produces a similar number that will be compared so let's look for generating some random strings in PHP so that we can simply root Force this so let's copy that code here to generate a random string and then let's just simply create a while loop around generating random strings applying the hash function to it and then compare it to the admin um password and if that comparison is correct we then print the password and just simply exit ah made also a little mistake here at the while loop missing parenthesis and then we can simply copy this code and paste it into a PHP shell and now the loop is running and we are slowly brute forcing it let's open another one and create another instance to utilize multiple cores on the system to Brute Forces so this will take a little while and it actually took longer than I thought it would but in the meantime we can start working on another challenge so let's check out the web 60 challenge the title is replace with Grace regular expressions are pretty useful especially when you need to search and replace complex terms so let's look at the service URL and if you know a little bit of PHP Rec xes you will know that if you fully control the recx string that is passed to for example pre MCH in PHP that you can have remote code execution and there's this special recx modifier called pre replace evil which you can already see those caution things that it can evaluate PHP code so let's write the expression with the slashes and basically we want to match any character and we add the special evil modifier to WX the next line really doesn't matter much but the third one is important because this is where the match string would be passed to and we can use back tick because back tick will execute a system command in PHP and as you can see we successfully executed LS minus LA and then we can see that there's a file called f. PHP which we then can simply read with cat so here is the flag let's submit it and correct flag so let's move move on to the next web challenge web 80 and it reads old school blog I stumbled across this kind of old school blog I bet it's unhackable I mean there's only static HTML so let's have a look at the Block and it looks pretty boring there seems to me not much to interact with but if you read those blog posts you find that he had been looking at a tool called git and if you have used git before you know that git creates a special folder called dogit which is usually hidden when you work on Linux or something but you can see that dogit if you try to access that one it gives us a forbidden because we are not allowed to read the directory rather than uh not found like we did with some arbitrary random string so there seems to be a dogit folder available now let's explore how git repository looks like so I simply go to my GitHub and clone my YouTube repository here and then we can explore the dogit folder what kind of files are included there when we look at this dogit folder there's quite some stuff with find we can display the whole hierarchy inside those folders so first of all there are those objects stored in different sub folders and they are hashes and they are unlikely to be the same on this remote service but there are other files that are static or have the same name in every git repository so in as a first step we try to download those files so I've created here a text document with uh typical files and folders from that git repository and I've added the URL and then I just basically make a shell script out of it and wble get all those files so let's make the script executable and execute it and download all the files cool some of this works and downloads some other files don't work so let's explore what kind of files we were able to download and what kind of information they contain you can find good documentation online on how git is struct structured so I did a little bit of research while doing this challenge so I know that in this logs folder there is this file head which contains information about the commit history the you can see here the commit text as well as different kinds of hashes so now you can slowly make your way through the G jungle I know that from this research that those hashes here reference objects which are obviously contained in the object subdirectory and it works like that that the first bite or the first two characters here from the hex representation is one subfolder and then the remaining hashes are sorted in there so that's kind of like a little bit of hashing algorithm if you in hashing in the original sense meaning of the word hashing of organizing data so we can use this and download these objects and as you can see they exist and now we can even start using regular git commands like git log and we see this git log of commits and uh who made those commits but G also has another cool tool called git fsck which helps you to find missing files or corrupted files and yeah you can see the output of here and you see that there are a couple of broken links and missing blobs and trees and those are more object hashes that are missing with GID log minus P we should be able to see the full change log of the files so basically the file contents how it changed but you get an error that there are those missing objects so we just gather those hashes and also download them so I just copy them into the shell script and then I also remove the ones that appeared twice and then I add the W get minus r command to also download these objects so let's run the script now and we see that we download uh even more objects so let's get back into the git repository and now let's try git log minus p and it actually says here that it works now there's no error so let's do again get FSC K and see if there's still stuff missing and we get more hashes that are now missing and we can basically do the same again seems like only uh three or so are missing so let's just uh copy them here in the Shell we don't have to execute the script and yeah so we download more let's have a look at the uh git command output now and boom we get the changes of the files and you can see that apparently in a previous version of the site there was the flag included and now we can just copy this and we get correct flag let's see if we found a valid hash for the first challenge but PHP is still running hasn't found a hash yet so we just have to wait okay now quite some time later we've apparently got an output that should produce a valid hash that bypasses the comparison in PHP so let's go to the login page again and then we can enter the admin username which we know from the readme file and then just copy the password that we apparently found and indeed we were able to log in and we got the flag and we get correct flag [Applause] [Music]