Solution for www.net-force.nl : Level 404 Hiding in a pipe

Solution for www.net-force.nl : Level 404 Hiding in a pipe

This is the link to the original challenge: http://www.net-force.nl/challenge/level404/portal.php

Quest:

Hack this 'portal' to find the password :-)

This puzzle is an easy one. The hint given to us is hiding in a pipe. The portal provide us with 3 forms which allow us to DES crypt, finger a user and ping itself. As shown below...

 

Now we all know that ping is a standard command... could it be that the server take in the text box value and pass it off as a command? let us try to modify ping netforce.nl to ls instead... ah... somehow it failed... there must be some sort of filtering... but wait what will happen if we were to pipe another command behind this ping? Let us try "ping netforce.nl | ls" in the textbox...

wow... we got something here.... whats in info.txt?

try this link: http://www.net-force.nl/challenge/level404/info.txt
it states... Nice one, you have finished the first part...proceed

=( continue to part 2... there is a protected folder... question is how do we get to the folder when an authentication is required...

ah... remember in the portal.php? there is a finger user textbox with a default username in it: "BasTijs". But no password is given... let us just try the username with no password... bingo we got in! It shows us the files in the protected folder and solution.php is the password to this puzzle.

Password: pijpme!

Cheers

3lucidat0r

Solution for bright-shadows.net : JavaScript - Hard but possible.

Solution for Bright-Shadows.net : JavaScript - Hard but possible.

This is the link to the original challenge: http://bright-shadows.net/challenges/levelj4/index.php

However, you will need to register before you can make an attempt to solve this. 

Quest:

Only input a valid username and you will get to the solution page.

As this is the easiest one, let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  function testEncode(form){
    input_user = document.formular.user.value;
    if (input_user == "thebestoneisthis") {
        window.location.href="thebestoneisthis.php";
    }else{
        window.location.href=input_user +".php";
    }
}
</script>

As we can see, it is trying to validate whether our input value matches "thebestoneisthis"

You see "thebestoneisthis" and that's the password.

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for bright-shadows.net : Crypto - Easy starter!

Solution for Bright-Shadows.net : Crypto - Easy starter!

This is the link to the original challenge: http://bright-shadows.net/challenges/levelc1/crypto1.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

The decrypted text will tell you the solution.
tedespqtcdezypozyzeqzcrpeesleespalddhzcotdlsopqufvwrcmodprq

The first thing that came to my mind for all basic crypto challenges is Caesar's Cipher.
Immediately, i thought of using this to help me to do a quick check whether my hunch is correct.
 

After some tampering with the shifting, it seems that N got to be 15. In other words, shift 11 to the right and we got back the following:

itsthefirstonedonotforgetthatthepasswordisahdefjuklgrbdsegf

The author of this challenge just concatenate it altogether and the password to the challenge is "ahdefjuklgrbdsegf" without the double quotes.

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for bright-shadows.net : JavaScript - Easy script

Solution for Bright-Shadows.net : JavaScript - Easy script

This is the link to the original challenge: http://www.bright-shadows.net/challenges/scripts/js5/index.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

Please enter your username!

As this is the easiest one, let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  function check() {
    pass     = unescape('%44%61%67%6F%62%65%72%74%20%44%75%63%6B');
    solution = pass.substr(0,8)+pass.substring(9,13)+pass.substring(8,9);
    passwd = document.formular.user.value;
    if (passwd == solution) {
      window.location.href=solution+".php";
    }
    else {
      alert("False!!!");
    }
  }
</script>

As we can see, it is trying to validate our input value against solution whereby solution is extracted from pass.


A simple solution to this is simply to place an alert right after the following:

passwd = document.formular.user.value;

alert(solution); 

and before the following: 

if (passwd == solution) {

You see "DagobertDuck " and that's the password. Please be reminded that there is a "space" in the end of the password.

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for Crackmes.de - HonestGamer's Crackme

Solution for Crackmes.de - Beezdul's Keygenme #1

This is the link to the original crackme: http://www.crackmes.de/users/honestgamer/crackme/

However, you will need to register before you can download the binary. 

Hints:

Crackme is coded in C# (.NET) using Visual Studio 2010.

=========================

The User ID should be an integer that is less than 4 digits.

The User Code should be an integer as well...

=========================

This crackme is no big deal, so best of luck! :)

Regards,
HonestGamer

Difficulty: 1 - Very easy, for newbies
Platform: Windows
Language: .NET

Published: 15. Feb, 2011

Tools Required:
ilSpy - http://wiki.sharpdevelop.net/ilspy.ashx



This is another of those level 1 as difficulty type of crackme and is a .NET binary, let's open it with ilSpy immediately and we immediately found the portion that is required to code our KeyGenMe. :D

Let's take a look at the main function for this binary.

private static void Main(string[] args){
            Console.WriteLine("Crackme By HonestGamer");
            int num = 0;
            char c;
            do
            {
                Keygen keygen = new Keygen();
                keygen.Generate();
                keygen.Check(ref num);
                if (num == 0)
                {
                    Console.Write("\nInvalid Code, Try Again (Y/N)? ");
                    c = Convert.ToChar(Console.ReadLine());
                }
                else
                {
                    c = 'N';
                    Console.WriteLine("\nValid Code, Well Done! Write A Keygen Now...");
                }
            }
            while (c == 'Y' || c == 'y');
            Console.WriteLine("\nHit The Enter Key To End...");
            Console.ReadLine();
}

As we can see from the above code snippet that we have extracted with ilSpy, it is doing a keygen.Generate and keygen before validation.

Let's take a look at the 2 functions.

private Keygen(){
            do
            {
                Console.Write("\nEnter User ID: ");
                this.UserID = Convert.ToInt32(Console.ReadLine());
                if (this.UserID > 0 && this.UserID < 10000)
                {
                    this.UFlag = 1;
                }
                else
                {
                    this.UFlag = 0;
                    Console.WriteLine("\nUser ID Is Out Of Range! Please Enter Number Less Than 4 Digits...");
                }
            }
            while (this.UFlag == 0);
            Console.Write("\nEnter Code: ");
            this.UserCode = Convert.ToInt32(Console.ReadLine());
}

private void Generate(){
            int num = this.UserID * 786;
            this.ValidCode = num * 17;
            num = this.ValidCode / 12;
            this.ValidCode = num + 1991;
}

private void Check(ref int RFlag){
            if (this.ValidCode == this.UserCode)
            {
                RFlag = 1;
            }
            else
            {
                RFlag = 0;
            }
}

Judging from the above code snippets, the UserID had to be bigger than 0 and less than 1000.
Then it uses the user's input value for UserID to generate the serial and validate it with Check function.


Based on the Generate function, it's pretty easy for us to code the solution for this KeyGenMe now that we know the inner algorithm for it.

I have developed the solution to this crackme and placed it here.
But i will release the source code later.


I do hope that people will learn from this and find it enriching. xDDD

Cheers

0x4A61636F62

Solution for Crackmes.de - Beezdul's Keygenme #1

Solution for Crackmes.de - Beezdul's Keygenme #1

This is the link to the original crackme: http://crackmes.de/users/beezdul/keygenme_1/

However, you will need to register before you can download the binary. 

Hints:

This crackme / keygenme was made in .net; have fun cracking it! Rules : NO PATCHING!, no selfgen. You need to make a cool keygen with cool graphics and an epic chiptune. Cheers!

Difficulty: 1 - Very easy, for newbies
Platform: Windows
Language: .NET

Published: 08. Feb, 2012

Tools Required:
ilSpy - http://wiki.sharpdevelop.net/ilspy.ashx



Since the author of this Keygenme described this as difficulty 1 and is a .NET binary, let's open it with ilSpy immediately and we immediately found the portion that is required to code our KeyGenMe. :D

private void Button1_Click(object sender, EventArgs e)
{
    bool flag = this.TextBox1.TextLength != 14;
    checked
    {
        if (!flag)
        {
            flag = (Strings.Asc(this.TextBox1.Text[4]) != 45);
            if (!flag)
            {
                flag = (Strings.Asc(this.TextBox1.Text[9]) != 45);
                if (!flag)
                {
                    object left = string.Concat(new string[]
                    {
                        Conversions.ToString(this.TextBox1.Text[0]),
                        Conversions.ToString(this.TextBox1.Text[1]),
                        Conversions.ToString(this.TextBox1.Text[2]),
                        Conversions.ToString(this.TextBox1.Text[3]),
                        "-",
                        Conversions.ToString(Strings.Asc(this.TextBox1.Text[0]) + Strings.Asc(this.TextBox1.Text[2]) * 10 + 3324),
                        "-"
                    });
                    object right = Strings.Asc(this.TextBox1.Text[1]) + Strings.Asc(this.TextBox1.Text[3]) * 10 + 1000;
                    flag = Conversions.ToBoolean(Operators.NotObject(Operators.CompareObjectEqual(this.TextBox1.Text, Operators.ConcatenateObject(left, right), false)));
                    if (!flag)
                    {
                        Interaction.MsgBox("Great job! Make a keygen!", MsgBoxStyle.Information, null);
                        return;
                    }
                }
            }
        }
        Interaction.MsgBox("You Failed :( Keep trying!", MsgBoxStyle.Information, null);
    }
}

Analysing the Algorithm behind this Crackme:
As we can see from the extracted code from the crackme, the length of the serial had to have a length of 14 and the 5th and 10th character had to be "-" without the double quotes if we look up http://www.asciitable.com/

The first 4 characters can be any random characters, the 1st and 3rd character of the 4 random characters are used to generate the 2nd set in the serial and the 2nd & 4th character of the 4 random characters are used to generate the 3rd set in the serial.

It's pretty easy now for us to code the solution for this KeyGenMe now that we now the inner algorithm for this crackme.

I have developed the solution to this crackme and placed it here.

But i will release the source code later.


I do hope that people will learn from this and find it enriching. xDDD

Cheers

0x4A61636F62

Solution for bright-shadows.net : JavaScript - Hash the future!

Solution for Bright-Shadows.net : JavaScript - Hash the Future!

This is the link to the original challenge: http://www.bright-shadows.net/challenges/scripts/js3/index.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

Immediately, we are an alert of "No, no, no. Try it again." Let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  date = new Date();
  year = date.getYear();
  add  = year;
  for (i = 1; i<= year;i++)
  {
    add +=year+i;
  }
  alert(add);
  if (add == 395425559298)
  {
    alert("Good job! You got it!");
    window.location.href=year+".php";
  }
  else
  {
    alert("No, no, no. Try it again!");
    window.location.href="/hackchallenge.php";
  }
</script>

 As we can see, it's trying to use the year to do some additions and check whether the final is equal to 395425559298.

Well after some tampering of the script, we found out that the value for year must be 513436 in order to solve this.

Cheers

0x4A61636F62

 

Solution for bright-shadows.net : JavaScript - Often used but easy to solve.

Solution for Bright-Shadows.net : JavaScript - Often used but easy to solve.

This is the link to the original challenge: http://www.bright-shadows.net/challenges/scripts/js1/index.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

Password

Immediately, we are prompted to enter the password. Let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  function password () {
    var d1, d2, d3, d4, d5, input;
    d1=window.document.bgColor;
    d2=window.document.linkColor;
    d3=d1.substring (1,5)+d2.substring (1,3);
    d4=d3.toUpperCase ();
    input=prompt("Password:","");
    if (input!=d3 && input!=d4) {
      alert("Are you crazy? Thats so easy!");
      window.location.href="/hackchallenge.php";
    }
    else {
      window.location.href=d3+".php";
    }
  }
</script>

<body onLoad="password()" class="usual" link="#FF9900" bgcolor="#D0D0D0">

As we can see, we are required to have d3 or d4 as password. 
Well, the easy way to solve this challenge is to either manually write out the substring or save the entire page and add the following line of code

alert(d4);

 
right before  

input=prompt("Password:",""); 

We will see an alert with D0D0FF and that is our answer for this challenge. 

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for bright-shadows.net : JavaScript - First one and very easy to do.

Solution for Bright-Shadows.net : JavaScript - First one and very easy to do.

This is the link to the original challenge: http://www.bright-shadows.net/challenges/scripts/js1/index.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

Please enter your username!

As this is the easiest one, let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  function usercheck() {
    input_user=document.formular.user.value;
    if (input_user=="warmup") {
      window.location.href=input_user +".php";
    }
    else {
      alert("Go home!");
      window.location.href="http://www.disney.com";
    }
  }
</script>

As we can see, the username is warmup and eventually we should be redirected to warmup.php and you can see "Well Done"

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for Net-Force.nl : Level 601 - Keep walking...

Solution for Net-Force.nl : Level 601 - Keep walking...

This is the link to the original challenge: http://www.net-force.nl/challenge/level601/

Quest:

This is a challenge to test your basic programming skills.

Pseudo code:
Set X = 1
Set Y = 1
Set previous answer = 1

answer = X * Y + previous answer + 3

After that => X + 1 and Y + 1 ('answer' becomes 'previous answer') and repeat this till you have X = 525.

The final answer is the value of 'answer' when X = 525. Fill it in below to check if it's the correct answer. If it is, you will get the password for the challenge page.

Example:
5 = 1 * 1 + 1 + 3
12 = 2 * 2 + 5 + 3
24 = 3 * 3 + 12 + 3
........................
........................

Since this is a programming challenge, let's look at the clues given to us.

Set X = 1
Set Y = 1
Set previous answer = 1

answer = X * Y + previous answer + 3

So we need 3 variables, x, y and answer as we can reuse "answer" as "previous answer". This will translate to something like the following.

x=1
y=1
answer = 1
answer = x * y + answer + 3

Based on the hints given, i've finally code an python script that gave me the answer.

import os, sys

def main():
    x=1
    y=1
    answer = 1

    for z in range(0,525):
        answer = x * y + answer + 3
        x+=1
        y+=1
        if x==524:
            print("\nprevious answer = %d") % (answer)
    print("\nx=%d, y=%d\nanswer = %d") % (x,y,answer)

if __name__ == '__main__':
    main()

Running my own script, i got back this:

previous answer = 47823644

x=526, y=526
answer = 48373851

Entering the answer in the challenge page and we smelled success again.

So the answer for this challenge is "pr0ggen"

Cheers

0x4A61636F62