Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
9da5c9936a | ||
|
|
ba1077b0c8 | ||
|
|
7997a5b895 | ||
|
|
6756fb5af6 | ||
|
|
3e078bf55f | ||
|
|
fab68f78fb | ||
|
|
af3694f0ef | ||
|
|
46c6f9037e | ||
|
|
31a552963f | ||
|
|
a2dc744551 | ||
|
|
868c11507c | ||
|
|
6fa9f7b09f | ||
|
|
cc261d6aaa | ||
|
|
5487b22a4f | ||
|
|
631eb1219a | ||
|
|
d3b327afc0 | ||
|
|
0fe3cf6682 | ||
|
|
1dbbb4a325 | ||
|
|
e0e562be5e | ||
|
|
844ad3b9ac | ||
|
|
6242a1f876 | ||
|
|
201ba2ef75 | ||
|
|
2c9eef4749 | ||
|
|
0f2d9a4dc1 | ||
|
|
8513bd9ac5 | ||
|
|
990640b79a | ||
|
|
e4dffe1d19 | ||
|
|
db9373b9f8 | ||
|
|
bfd686f940 | ||
|
|
2ef57de694 | ||
|
|
c76df05651 | ||
|
|
195def9964 | ||
|
|
7edaf1993f | ||
|
|
1a201a554a | ||
|
|
f11331d900 | ||
|
|
3f3d2d7c41 | ||
|
|
d4bc6b0a00 | ||
|
|
eb70525934 | ||
|
|
1f9042cb72 | ||
|
|
cf537b1488 | ||
|
|
af883f2f6e | ||
|
|
fc16fb4046 |
|
After Width: | Height: | Size: 2.2 MiB |
|
After Width: | Height: | Size: 1.9 MiB |
|
After Width: | Height: | Size: 1.1 MiB |
|
After Width: | Height: | Size: 5.5 KiB |
|
After Width: | Height: | Size: 1.1 MiB |
|
After Width: | Height: | Size: 1.0 MiB |
|
After Width: | Height: | Size: 1.2 MiB |
|
After Width: | Height: | Size: 662 KiB |
|
After Width: | Height: | Size: 322 KiB |
|
After Width: | Height: | Size: 20 KiB |
|
After Width: | Height: | Size: 1.1 MiB |
|
After Width: | Height: | Size: 14 KiB |
|
After Width: | Height: | Size: 34 KiB |
|
After Width: | Height: | Size: 6.9 KiB |
|
After Width: | Height: | Size: 17 KiB |
|
After Width: | Height: | Size: 12 KiB |
|
After Width: | Height: | Size: 40 KiB |
|
After Width: | Height: | Size: 6.2 KiB |
|
After Width: | Height: | Size: 12 KiB |
|
After Width: | Height: | Size: 11 KiB |
|
After Width: | Height: | Size: 18 KiB |
|
After Width: | Height: | Size: 10 KiB |
|
After Width: | Height: | Size: 634 KiB |
|
After Width: | Height: | Size: 2.9 MiB |
|
After Width: | Height: | Size: 2.6 MiB |
|
After Width: | Height: | Size: 586 KiB |
|
After Width: | Height: | Size: 607 KiB |
|
After Width: | Height: | Size: 564 KiB |
|
After Width: | Height: | Size: 107 KiB |
|
After Width: | Height: | Size: 607 KiB |
|
After Width: | Height: | Size: 548 KiB |
|
After Width: | Height: | Size: 493 KiB |
|
After Width: | Height: | Size: 506 KiB |
|
After Width: | Height: | Size: 582 KiB |
|
After Width: | Height: | Size: 135 KiB |
|
After Width: | Height: | Size: 601 KiB |
|
After Width: | Height: | Size: 685 KiB |
|
After Width: | Height: | Size: 2.9 MiB |
|
After Width: | Height: | Size: 2.8 MiB |
|
After Width: | Height: | Size: 315 KiB |
|
After Width: | Height: | Size: 525 KiB |
|
After Width: | Height: | Size: 2.6 MiB |
|
After Width: | Height: | Size: 2.2 MiB |
|
After Width: | Height: | Size: 2.7 MiB |
|
After Width: | Height: | Size: 2.0 MiB |
|
After Width: | Height: | Size: 81 KiB |
|
After Width: | Height: | Size: 26 KiB |
|
After Width: | Height: | Size: 51 KiB |
|
After Width: | Height: | Size: 58 KiB |
|
After Width: | Height: | Size: 86 KiB |
|
After Width: | Height: | Size: 25 KiB |
|
After Width: | Height: | Size: 63 KiB |
|
After Width: | Height: | Size: 28 KiB |
|
After Width: | Height: | Size: 108 KiB |
|
After Width: | Height: | Size: 107 KiB |
|
After Width: | Height: | Size: 136 KiB |
|
After Width: | Height: | Size: 77 KiB |
|
After Width: | Height: | Size: 124 KiB |
|
After Width: | Height: | Size: 48 KiB |
|
After Width: | Height: | Size: 49 KiB |
|
After Width: | Height: | Size: 11 KiB |
|
After Width: | Height: | Size: 2.6 MiB |
|
After Width: | Height: | Size: 2.2 MiB |
|
After Width: | Height: | Size: 572 KiB |
|
After Width: | Height: | Size: 538 KiB |
|
After Width: | Height: | Size: 627 KiB |
|
After Width: | Height: | Size: 533 KiB |
|
After Width: | Height: | Size: 560 KiB |
|
After Width: | Height: | Size: 541 KiB |
|
After Width: | Height: | Size: 2.6 MiB |
|
After Width: | Height: | Size: 2.4 MiB |
|
After Width: | Height: | Size: 66 KiB |
|
After Width: | Height: | Size: 316 KiB |
|
After Width: | Height: | Size: 54 KiB |
|
After Width: | Height: | Size: 115 KiB |
|
After Width: | Height: | Size: 2.9 MiB |
|
After Width: | Height: | Size: 2.7 MiB |
|
After Width: | Height: | Size: 947 KiB |
|
After Width: | Height: | Size: 978 KiB |
|
After Width: | Height: | Size: 982 KiB |
|
After Width: | Height: | Size: 972 KiB |
|
After Width: | Height: | Size: 108 KiB |
|
After Width: | Height: | Size: 110 KiB |
|
After Width: | Height: | Size: 108 KiB |
|
After Width: | Height: | Size: 925 KiB |
@@ -40,6 +40,12 @@ page = ["HTML", "RSS"]
|
|||||||
[pagination]
|
[pagination]
|
||||||
pagerSize = 12
|
pagerSize = 12
|
||||||
|
|
||||||
|
[markup]
|
||||||
|
[markup.tableOfContents]
|
||||||
|
endLevel = 4
|
||||||
|
ordered = true
|
||||||
|
startLevel = 2
|
||||||
|
|
||||||
[params]
|
[params]
|
||||||
dateform = "Jan 2, 2006"
|
dateform = "Jan 2, 2006"
|
||||||
dateformShort = "Jan 2"
|
dateformShort = "Jan 2"
|
||||||
@@ -49,7 +55,7 @@ dateformMonth = "Jan, 2006"
|
|||||||
|
|
||||||
# Metadata mostly used in document's head
|
# Metadata mostly used in document's head
|
||||||
description = "Hey there, my name is Maik de Kruif, I create websites, bots and other kinds of software. At the moment, I'm still studying computer science at Avans University of Applied Sciences. I am also a big fan of open-source software, which is why you'll find many of my projects on Github. And last but not least, I love playing around with cyber-security related stuff."
|
description = "Hey there, my name is Maik de Kruif, I create websites, bots and other kinds of software. At the moment, I'm still studying computer science at Avans University of Applied Sciences. I am also a big fan of open-source software, which is why you'll find many of my projects on Github. And last but not least, I love playing around with cyber-security related stuff."
|
||||||
keywords = "Devloper, Software Engineer, Software Developer, Maik, Computer Science, Portfolio, Blog, Maik de Kruif"
|
keywords = "Developer, Software Engineer, Software Developer, Maik, Computer Science, Portfolio, Blog, Maik de Kruif"
|
||||||
images = [""]
|
images = [""]
|
||||||
|
|
||||||
genre = "Blog"
|
genre = "Blog"
|
||||||
@@ -58,7 +64,7 @@ rssLimit = 15
|
|||||||
|
|
||||||
showReadingTimeInList = false
|
showReadingTimeInList = false
|
||||||
|
|
||||||
homeSubtitle = "Software Engineering, Linux and Cyber Security"
|
homeSubtitle = "Software Engineer and Cyber Security Specialist"
|
||||||
|
|
||||||
# Prefix of link to the git commit detail page. GitInfo must be enabled.
|
# Prefix of link to the git commit detail page. GitInfo must be enabled.
|
||||||
gitUrl = "https://github.com/maikka39/Personal-Website/commit/"
|
gitUrl = "https://github.com/maikka39/Personal-Website/commit/"
|
||||||
@@ -125,9 +131,9 @@ image = "/img/home/portrait.png"
|
|||||||
twitter = "@maik_dev"
|
twitter = "@maik_dev"
|
||||||
|
|
||||||
# Wallets
|
# Wallets
|
||||||
[[params.wallets]]
|
# [[params.wallets]]
|
||||||
name = "XMR"
|
# name = "XMR"
|
||||||
address = "83cfsXGHPaW81hKJtAPYZEgbfFqANMTXXRwghsBpjf5oTDRV3BnCC4jFno8tLTnF4C6gJzGjPEmpvjntXaiGBB7kVitkDKi"
|
# address = "83cfsXGHPaW81hKJtAPYZEgbfFqANMTXXRwghsBpjf5oTDRV3BnCC4jFno8tLTnF4C6gJzGjPEmpvjntXaiGBB7kVitkDKi"
|
||||||
|
|
||||||
# Social icons
|
# Social icons
|
||||||
[[params.social]]
|
[[params.social]]
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
author = "Maik de Kruif"
|
author = "Maik de Kruif"
|
||||||
title = "About"
|
title = "About"
|
||||||
date = 2021-11-19T12:26:01+01:00
|
date = 2021-11-19T12:26:01+01:00
|
||||||
description = "Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it."
|
description = "I’m a passionate coder with a strong foundation in programming. With a love for solving practical problems through software development, I am driven to continuously explore new ways to create innovative solutions. My personal side-projects and exploration of cybersecurity further enhance my skills and dedication to building powerful and impactful applications."
|
||||||
images = []
|
images = []
|
||||||
tags = [
|
tags = [
|
||||||
"aboutme",
|
"aboutme",
|
||||||
@@ -10,12 +10,9 @@ tags = [
|
|||||||
categories = [
|
categories = [
|
||||||
"me",
|
"me",
|
||||||
]
|
]
|
||||||
|
toc = false
|
||||||
+++
|
+++
|
||||||
|
|
||||||
Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it.
|
Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it.
|
||||||
|
|
||||||
Outside of my job, I run a small business with a couple of friends where we develop drone shows. I'm responsible for both designing and writing the control software as well as creating and designing the actual drones.
|
When I get home after work, I tend to either continue writing code for some personal side-projects, or play around with cyber-security related stuff. Occasionally, I can also be found working on electronics projects. This is what keeps me up at night, a never-ending thirst to create beautiful, powerful things and share them with the world.
|
||||||
|
|
||||||
When I get home after work/school, I tend to either continue writing code for some personal side-projects, or play around with cyber-security related stuff. This is what keeps me up at night, a never-ending thirst to create beautiful, powerful things and share them with the world.
|
|
||||||
|
|
||||||
Skills/Interests: Python, Java, Scala, JavaScript, Node, CSS, HTML, Git, SQL, MongoDB, Apache, Nginx, Docker.
|
|
||||||
|
|||||||
@@ -25,7 +25,6 @@ During one of his earlier videos, LiveOverflow challenged his viewers to find th
|
|||||||
|
|
||||||
In LiveOverflow's eighth video, [he told his viewers that the server has been opened to the public](https://youtu.be/QradKmQ27JY?t=1246). I immediately started looking for ways to find it. After researching for a while, I found multiple ways to find it, but I thought they would all take a fair bit of time (I'll get back to this later). So, instead of spending time actually learning stuff, I rewatched his videos to see if there would be a clue in there. Luckily it worked out. In [one video](https://youtu.be/Hmmr1oLt-V8?t=28) he blurred the IP inside the terminal, but forgot about the terminal title bar :smile:. I notified him of this, as it was obviously unintended, and the IP was changed shortly after, as many people apparently found it.
|
In LiveOverflow's eighth video, [he told his viewers that the server has been opened to the public](https://youtu.be/QradKmQ27JY?t=1246). I immediately started looking for ways to find it. After researching for a while, I found multiple ways to find it, but I thought they would all take a fair bit of time (I'll get back to this later). So, instead of spending time actually learning stuff, I rewatched his videos to see if there would be a clue in there. Luckily it worked out. In [one video](https://youtu.be/Hmmr1oLt-V8?t=28) he blurred the IP inside the terminal, but forgot about the terminal title bar :smile:. I notified him of this, as it was obviously unintended, and the IP was changed shortly after, as many people apparently found it.
|
||||||
|
|
||||||
|
|
||||||
{{< figure src="/img/posts/liveoverflow-minecraft-server/first_ip_screenshot.png" title="Screenshot of video containing the IP address" >}}
|
{{< figure src="/img/posts/liveoverflow-minecraft-server/first_ip_screenshot.png" title="Screenshot of video containing the IP address" >}}
|
||||||
|
|
||||||
### IP change
|
### IP change
|
||||||
@@ -36,7 +35,7 @@ During my research, I came across masscan. This is a piece of software that lets
|
|||||||
|
|
||||||
I got to work and wrote a script that scans the IP range in which the old IP was located. It starts by using masscan to scan the entire range of IP addresses, and saves it to a file to use later. I then read this file, and request basic Minecraft server information like its MOTD, players and favicon. This information was saved in another file, in which, I could easily search for LiveOverflow. In the end, the new IP only had one digit changed.
|
I got to work and wrote a script that scans the IP range in which the old IP was located. It starts by using masscan to scan the entire range of IP addresses, and saves it to a file to use later. I then read this file, and request basic Minecraft server information like its MOTD, players and favicon. This information was saved in another file, in which, I could easily search for LiveOverflow. In the end, the new IP only had one digit changed.
|
||||||
|
|
||||||
{{< code language="python" title="scan.py" isCollapsed="true" >}}
|
{{< collapsible-block badge="python" title="scan.py" isCollapsed="true" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
import masscan
|
import masscan
|
||||||
@@ -261,7 +260,7 @@ print(len(current_servers))
|
|||||||
print(len(valid_servers))
|
print(len(valid_servers))
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
_This code is copied from a Jupyter Notebook, so it's not the most efficient and may not even work, the [here for the Github Gist of the Notebook](https://gist.github.com/maikka39/8019e2f1a45e1021fff05bd1e1688e14)_
|
_This code is copied from a Jupyter Notebook, so it's not the most efficient and may not even work, the [here for the Github Gist of the Notebook](https://gist.github.com/maikka39/8019e2f1a45e1021fff05bd1e1688e14)_
|
||||||
|
|
||||||
|
|||||||
@@ -117,7 +117,7 @@ Let's try to use the previous attack but with the flag file:
|
|||||||
|
|
||||||
We get a big error:
|
We get a big error:
|
||||||
|
|
||||||
{{< code language="html" title="Error message" >}}
|
{{< collapsible-block badge="html" title="Error message" >}}
|
||||||
|
|
||||||
```html
|
```html
|
||||||
<br />
|
<br />
|
||||||
@@ -183,7 +183,7 @@ line: 3 in <b>/var/www/html/index.php</b> on line <b>40</b><br />
|
|||||||
<b>/var/www/html/index.php</b> on line <b>43</b><br />
|
<b>/var/www/html/index.php</b> on line <b>43</b><br />
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
We probably got it because PHP is actually handling the PHP file as a PHP file 😀. This means we have to get it in some other way.
|
We probably got it because PHP is actually handling the PHP file as a PHP file 😀. This means we have to get it in some other way.
|
||||||
|
|
||||||
|
|||||||
@@ -74,7 +74,7 @@ This means the server is most likely using either Jinja2 of Twig.
|
|||||||
|
|
||||||
Now that we found the vulnerability, we can start exploiting it. Let's start by getting the config. We can try to get it by entering `{{config}}` or `{{config.items()}}` as the emoji.
|
Now that we found the vulnerability, we can start exploiting it. Let's start by getting the config. We can try to get it by entering `{{config}}` or `{{config.items()}}` as the emoji.
|
||||||
|
|
||||||
{{< code language="python" title="Result" >}}
|
{{< collapsible-block badge="python" title="Result" >}}
|
||||||
|
|
||||||
```python
|
```python
|
||||||
dict_items([
|
dict_items([
|
||||||
@@ -224,7 +224,7 @@ dict_items([
|
|||||||
])
|
])
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
If we take a look at it we find an item called 'flag' but it looks like it is encrypted in some way:
|
If we take a look at it we find an item called 'flag' but it looks like it is encrypted in some way:
|
||||||
|
|
||||||
@@ -282,7 +282,7 @@ The source of the server is probably `app.py` as it's the default for flask appl
|
|||||||
config.__class__.__init__.__globals__['os'].popen('cat app.py').read()
|
config.__class__.__init__.__globals__['os'].popen('cat app.py').read()
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< code language="python" title="app.py" >}}
|
{{< collapsible-block badge="python" title="app.py" >}}
|
||||||
|
|
||||||
```python
|
```python
|
||||||
import random
|
import random
|
||||||
@@ -332,7 +332,7 @@ if __name__ == '__main__':
|
|||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
When looking at the file, we see that the flag variable is set to the output of the `magic` function:
|
When looking at the file, we see that the flag variable is set to the output of the `magic` function:
|
||||||
|
|
||||||
|
|||||||
@@ -154,7 +154,7 @@ To get the subclasses, we first have to convert `''.__class__.__mro__[1].__subcl
|
|||||||
|
|
||||||
After submitting this, we get the following result:
|
After submitting this, we get the following result:
|
||||||
|
|
||||||
{{< code language="text" title="Result" >}}
|
{{< collapsible-block badge="text" title="Result" >}}
|
||||||
|
|
||||||
```js
|
```js
|
||||||
[
|
[
|
||||||
@@ -643,7 +643,7 @@ After submitting this, we get the following result:
|
|||||||
]
|
]
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
In this result we find the following class: `<class 'os._wrap_close'>`. This is the `os` module and it is on index `127`. We can verify it's index by getting it from the submodules list using the following input:
|
In this result we find the following class: `<class 'os._wrap_close'>`. This is the `os` module and it is on index `127`. We can verify it's index by getting it from the submodules list using the following input:
|
||||||
|
|
||||||
@@ -680,7 +680,7 @@ Now let's grab the contents of `app.py`:
|
|||||||
{{ [[[""|attr("\x5f\x5fclass\x5f\x5f")|attr("\x5f\x5fmro\x5f\x5f")][0][1]|attr("\x5f\x5fsubclasses\x5f\x5f")()][0][127]|attr("\x5f\x5finit\x5f\x5f")|attr("\x5f\x5fglobals\x5f\x5f")][0]["popen"]("cat app\x2epy")|attr("read")() }}
|
{{ [[[""|attr("\x5f\x5fclass\x5f\x5f")|attr("\x5f\x5fmro\x5f\x5f")][0][1]|attr("\x5f\x5fsubclasses\x5f\x5f")()][0][127]|attr("\x5f\x5finit\x5f\x5f")|attr("\x5f\x5fglobals\x5f\x5f")][0]["popen"]("cat app\x2epy")|attr("read")() }}
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< code language="python" title="app.py" >}}
|
{{< collapsible-block badge="python" title="app.py" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
import random
|
import random
|
||||||
@@ -732,7 +732,7 @@ if __name__ == '__main__':
|
|||||||
app.run(host='0.0.0.0', port=8000)
|
app.run(host='0.0.0.0', port=8000)
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Magic function
|
## Magic function
|
||||||
|
|
||||||
|
|||||||
@@ -80,7 +80,7 @@ Alas, we get the cat picture again. That's weird. There might be a filter on the
|
|||||||
|
|
||||||
Using the same decoding method, we get the following result:
|
Using the same decoding method, we get the following result:
|
||||||
|
|
||||||
{{< code language="php" title="index.php" >}}
|
{{< collapsible-block badge="php" title="index.php" >}}
|
||||||
|
|
||||||
```html
|
```html
|
||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
@@ -92,7 +92,12 @@ Using the same decoding method, we get the following result:
|
|||||||
<meta name="description" content="" />
|
<meta name="description" content="" />
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||||
|
|
||||||
<link rel="stylesheet" href="style.css" type="text/css" media="screen" />
|
<link
|
||||||
|
rel="stylesheet"
|
||||||
|
href="style.css"
|
||||||
|
type="text/css"
|
||||||
|
media="screen"
|
||||||
|
/>
|
||||||
<link
|
<link
|
||||||
rel="stylesheet"
|
rel="stylesheet"
|
||||||
href="https://use.fontawesome.com/releases/v5.6.3/css/all.css"
|
href="https://use.fontawesome.com/releases/v5.6.3/css/all.css"
|
||||||
@@ -136,7 +141,9 @@ Using the same decoding method, we get the following result:
|
|||||||
<?php
|
<?php
|
||||||
if (!isset($_GET["image"])) {
|
if (!isset($_GET["image"])) {
|
||||||
?>
|
?>
|
||||||
<a href="/index.php?image=cat.jpg">Is this santa?</a>
|
<a href="/index.php?image=cat.jpg"
|
||||||
|
>Is this santa?</a
|
||||||
|
>
|
||||||
<?php
|
<?php
|
||||||
} else {
|
} else {
|
||||||
$path = $_GET["image"];
|
$path = $_GET["image"];
|
||||||
@@ -147,7 +154,9 @@ Using the same decoding method, we get the following result:
|
|||||||
echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>';
|
echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>';
|
||||||
} ?>
|
} ?>
|
||||||
</div>
|
</div>
|
||||||
<div class="card-footer text-center">Almost there</div>
|
<div class="card-footer text-center">
|
||||||
|
Almost there
|
||||||
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -158,20 +167,31 @@ Using the same decoding method, we get the following result:
|
|||||||
<div class="col-md-2">
|
<div class="col-md-2">
|
||||||
<img src="/logo.png" />
|
<img src="/logo.png" />
|
||||||
</div>
|
</div>
|
||||||
<div class="col-md-9 offset-md-1 align-middle">
|
<div
|
||||||
|
class="col-md-9 offset-md-1 align-middle"
|
||||||
|
>
|
||||||
<p class="text-center">
|
<p class="text-center">
|
||||||
<span class="align-middle">
|
<span class="align-middle">
|
||||||
The Advent of CTF is brought to you by
|
The Advent of CTF is brought
|
||||||
<a href="http://www.novi.nl">NOVI Hogeschool</a>. It
|
to you by
|
||||||
is built by
|
<a href="http://www.novi.nl"
|
||||||
|
>NOVI Hogeschool</a
|
||||||
|
>. It is built by
|
||||||
<a
|
<a
|
||||||
href="https://twitter.com/credmp/"
|
href="https://twitter.com/credmp/"
|
||||||
class="icoTwitter"
|
class="icoTwitter"
|
||||||
title="Twitter"
|
title="Twitter"
|
||||||
><i class="fab fa-twitter"></i> @credmp</a
|
><i
|
||||||
>. If you are looking for a Dutch Cyber Security
|
class="fab fa-twitter"
|
||||||
|
></i>
|
||||||
|
@credmp</a
|
||||||
|
>. If you are looking for a
|
||||||
|
Dutch Cyber Security
|
||||||
Bachelor degree or bootcamp,
|
Bachelor degree or bootcamp,
|
||||||
<a href="https://www.novi.nl">check us out</a>.
|
<a
|
||||||
|
href="https://www.novi.nl"
|
||||||
|
>check us out</a
|
||||||
|
>.
|
||||||
</span>
|
</span>
|
||||||
</p>
|
</p>
|
||||||
</div>
|
</div>
|
||||||
@@ -187,7 +207,7 @@ Using the same decoding method, we get the following result:
|
|||||||
</html>
|
</html>
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
Just the PHP part:
|
Just the PHP part:
|
||||||
|
|
||||||
|
|||||||
@@ -49,7 +49,9 @@ $(function () {
|
|||||||
socket.on("chat message", function (msg) {
|
socket.on("chat message", function (msg) {
|
||||||
console.log(msg.command);
|
console.log(msg.command);
|
||||||
if (msg.command === "code") {
|
if (msg.command === "code") {
|
||||||
$("#messages").append($("<li>").html("<pre>" + msg.message + "</pre>"));
|
$("#messages").append(
|
||||||
|
$("<li>").html("<pre>" + msg.message + "</pre>")
|
||||||
|
);
|
||||||
} else {
|
} else {
|
||||||
$("#messages").append($("<li>").text(msg.message));
|
$("#messages").append($("<li>").text(msg.message));
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -97,7 +97,7 @@ In [3]: pickle.loads(base64.b64decode("gAN9cQAoWAUAAABib2FyZHEBXXECKF1xAyhYAQAAA
|
|||||||
|
|
||||||
This time our board is quite a bit larger:
|
This time our board is quite a bit larger:
|
||||||
|
|
||||||
{{< code language="py" title="Board" >}}
|
{{< collapsible-block badge="py" title="Board" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
{
|
{
|
||||||
@@ -179,7 +179,7 @@ This time our board is quite a bit larger:
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
We can see that a `chain` value has been added. From the title of this challenge, we can say that this is the blockchain that we likely have to bypass.
|
We can see that a `chain` value has been added. From the title of this challenge, we can say that this is the blockchain that we likely have to bypass.
|
||||||
|
|
||||||
@@ -230,7 +230,7 @@ We can see that, to verify the game, the function loops through all the blocks i
|
|||||||
|
|
||||||
To crack this, we can simply reverse this algorithm. To do this, I grabbed the script from the HTML source, and added a crack method like so:
|
To crack this, we can simply reverse this algorithm. To do this, I grabbed the script from the HTML source, and added a crack method like so:
|
||||||
|
|
||||||
{{< code language="py" title="solve.py" >}}
|
{{< collapsible-block badge="py" title="solve.py" >}}
|
||||||
|
|
||||||
```python
|
```python
|
||||||
import hashlib
|
import hashlib
|
||||||
@@ -304,7 +304,7 @@ if __name__ == "__main__":
|
|||||||
print(export_base64(game))
|
print(export_base64(game))
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
After running this script, we get the following result:
|
After running this script, we get the following result:
|
||||||
|
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ Visit <https://04.adventofctf.com> to start the challenge.
|
|||||||
|
|
||||||
When opening the website we're (for the first time) not provided with a login form. It is still authentication though as we are greeted with a message: "If you have access to it the special present will be shown below:". Also, I noticed the URL changed after about five seconds. That hints at some javascript, so let's open the sources tab in devtools. We find `login.js`.
|
When opening the website we're (for the first time) not provided with a login form. It is still authentication though as we are greeted with a message: "If you have access to it the special present will be shown below:". Also, I noticed the URL changed after about five seconds. That hints at some javascript, so let's open the sources tab in devtools. We find `login.js`.
|
||||||
|
|
||||||
{{< code language="js" title="login.js" >}}
|
{{< collapsible-block badge="js" title="login.js" >}}
|
||||||
|
|
||||||
```js
|
```js
|
||||||
function startup() {
|
function startup() {
|
||||||
@@ -93,7 +93,7 @@ startup();
|
|||||||
check();
|
check();
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
This looks like some obfuscated code. So I started with de-obfuscating the code. After a few minutes of reading the code, I remembered to always start at the output. And after looking at the `check()` function I found out I had wasted my time.
|
This looks like some obfuscated code. So I started with de-obfuscating the code. After a few minutes of reading the code, I remembered to always start at the output. And after looking at the `check()` function I found out I had wasted my time.
|
||||||
|
|
||||||
|
|||||||
@@ -72,7 +72,7 @@ As you can see the string is escaped and the result of this query will have the
|
|||||||
|
|
||||||
When submitting it I got the following result:
|
When submitting it I got the following result:
|
||||||
|
|
||||||
{{< code language="text" title="Result" >}}
|
{{< collapsible-block badge="text" title="Result" >}}
|
||||||
|
|
||||||
```markdown
|
```markdown
|
||||||
| id | Description | Proof |
|
| id | Description | Proof |
|
||||||
@@ -244,7 +244,7 @@ When submitting it I got the following result:
|
|||||||
| secrets | 2-------- | 3------- |
|
| secrets | 2-------- | 3------- |
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Solution
|
## Solution
|
||||||
|
|
||||||
|
|||||||
@@ -41,7 +41,7 @@ This is talking about robots, which my be a hint to look at the [`robots.txt`](h
|
|||||||
|
|
||||||
### What is a robots.txt file?
|
### What is a robots.txt file?
|
||||||
|
|
||||||
A `robots.txt` file lives at the root of a website. So, for the site www.example.com, a robots.txt file would live at www.example.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
|
A `robots.txt` file lives at the root of a website. So, for the site www\.example\.com, a robots.txt file would live at www\.example\.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
|
||||||
|
|
||||||
### Opening the file
|
### Opening the file
|
||||||
|
|
||||||
|
|||||||
@@ -92,7 +92,7 @@ When opening the source, we also find the following comment:
|
|||||||
|
|
||||||
To solve this challenge, I came up with the following script:
|
To solve this challenge, I came up with the following script:
|
||||||
|
|
||||||
{{< code language="js" title="solve.js" >}}
|
{{< collapsible-block badge="js" title="solve.js" >}}
|
||||||
|
|
||||||
```js
|
```js
|
||||||
function controlCar(scanArray) {
|
function controlCar(scanArray) {
|
||||||
@@ -151,7 +151,7 @@ function controlCar(scanArray) {
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
It starts off by initializing some global variables if the game is running for the first time (or after a restart). After which, it check if there are still moves in the queue. If so, it grabs the last item out of the queue and returns it.
|
It starts off by initializing some global variables if the game is running for the first time (or after a restart). After which, it check if there are still moves in the queue. If so, it grabs the last item out of the queue and returns it.
|
||||||
|
|
||||||
|
|||||||
@@ -43,7 +43,7 @@ You’re taking a stroll in the lab, when Dr. Klostermann is calling your name:
|
|||||||
|
|
||||||
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/4/attachment.zip)
|
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/4/attachment.zip)
|
||||||
|
|
||||||
{{< code language="c" title="chal.c" isCollapsed="true" >}}
|
{{< collapsible-block badge="c" title="chal.c" isCollapsed="true" class="tight" >}}
|
||||||
|
|
||||||
```c
|
```c
|
||||||
#include <stdbool.h>
|
#include <stdbool.h>
|
||||||
@@ -208,7 +208,7 @@ int main(void)
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Recon
|
## Recon
|
||||||
|
|
||||||
@@ -308,7 +308,7 @@ for set_mask, clr_mask in zip(set_masks, clr_masks):
|
|||||||
print(flag.strip())
|
print(flag.strip())
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< code language="py" title="Full code" isCollapsed="true" >}}
|
{{< collapsible-block badge="py" title="Full code" isCollapsed="true" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
set_mask_str = "gpio_set_mask"
|
set_mask_str = "gpio_set_mask"
|
||||||
@@ -343,7 +343,7 @@ for set_mask, clr_mask in zip(set_masks, clr_masks):
|
|||||||
print(flag.strip())
|
print(flag.strip())
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Solution
|
## Solution
|
||||||
|
|
||||||
|
|||||||
@@ -50,7 +50,7 @@ As you and Gökhan are leaving the crates to enter a car, you spot the tough guy
|
|||||||
|
|
||||||
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/5/attachment.zip)
|
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/5/attachment.zip)
|
||||||
|
|
||||||
{{< code language="py" title="RoboCaller1337.py" isCollapsed="true" >}}
|
{{< collapsible-block badge="py" title="RoboCaller1337.py" isCollapsed="true" class="tight" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
import random
|
import random
|
||||||
@@ -103,9 +103,9 @@ if __name__ == "__main__":
|
|||||||
main()
|
main()
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
{{< code language="txt" title="robo_numbers_list.txt" isCollapsed="true" >}}
|
{{< collapsible-block badge="txt" title="robo_numbers_list.txt" isCollapsed="true" class="tight" >}}
|
||||||
|
|
||||||
```txt
|
```txt
|
||||||
263-170-6234
|
263-170-6234
|
||||||
@@ -734,7 +734,7 @@ if __name__ == "__main__":
|
|||||||
446-996-9104
|
446-996-9104
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Recon
|
## Recon
|
||||||
|
|
||||||
@@ -793,7 +793,7 @@ for a,b in zip(key, secret):
|
|||||||
print(flag)
|
print(flag)
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< code language="py" title="Full code" isCollapsed="true" >}}
|
{{< collapsible-block badge="py" title="Full code" isCollapsed="true" >}}
|
||||||
|
|
||||||
```py
|
```py
|
||||||
from mt19937predictor import MT19937Predictor
|
from mt19937predictor import MT19937Predictor
|
||||||
@@ -816,7 +816,7 @@ for a,b in zip(key, secret):
|
|||||||
print(flag)
|
print(flag)
|
||||||
```
|
```
|
||||||
|
|
||||||
{{< /code >}}
|
{{< /collapsible-block >}}
|
||||||
|
|
||||||
## Solution
|
## Solution
|
||||||
|
|
||||||
|
|||||||