Juniors CTF 2016 :: Hackers Blog

hey what's up everybody John Hammond coming back at you with a couple more videos for the jr. CTF capture flag competition I'm recording this one now separate from when I hadn't been recording the other videos it's been a few hours I managed to solve a few more challenges so up on the school board I'm back in the top 10 time with the open to all teams that's kind of nice and ahead of one of our rival teams so that's that's good stuff and good news anyway I want to showcase some of the new challenges that I solved and here we'll move along I want to show off the hackers blog it's a 500-point web challenge so the describe the description here the challenge prompt is hey stranger I need your help blah blah blah I'm trying to hack this bloggers websites but I can't believe you so good take a look and you got to be using the VPN to do this so the VPN is a nother challenge that I don't have a video yet for but it's not very hard to showcase I will go ahead and down and get there your CPF it's in the team then we have all of our thanks so you can just sudo Open VPN to get the VPN running so once the VPN has a connection set up now we should be able to actually access that web page so I just use two Open VPN to do that now I can access these pages so here's the hackers blog and it's all in Russian so I do not speak Russian nor can I read the language or anything like that so this is kind of difficult challenge for me to solve so big credit and kudos goes out to some of their friends and some of the revisions that I talked to this challenge through with and stuff like that so I looked at some of these pages I try to look around to see what all these things were looks like a bunch of posts I'm assuming because of his blog thing so I can control you and view the source I don't see a whole lot of interesting things in here initially I'm seeing how they're stretching the background image this all like regular HTML so nothing particularly interesting there some of the Russian text which I can translate if I needed to and I see password here so I thought that was interesting I selected that and translated it which you can do too it's just a Google search to google translator but it's just for like okay people using default passwords on routers and stuff like that so a red herring and other posts and other stuff I noticed each of these posts have a specific ID so if you go to one of them it's ID equals five or ID equals zero up in the URL like get met but get message you pass through it so if you try and give it an ID number that doesn't actually exist like 0 or 99 it just redirects you back to the homepage so that's nothing really interesting there but I kept viewing the source I saw an interesting thing here and that you can comment on these on these you can give it like a name I'm assuming a name based off this and a text so I thought I was interesting I didn't initially play with it a whole lot until I went back to it later on but I'll try and talk more about my thought process when I was going through because I looked through all these challenges and stuff all these posts all these messages that people have been posting and at the very end of the page that I was on and as well as the home page it looks like all of them because of the footer they have this HTML company that it's a secret admin panel and this is very clearly base64 with the equal sign there the trilling equal sign so I copied that and just took a look at it we get a prompt that we can look at so i echoed that into day 64 to decode it and it gave us the IP address with a new page admin 64 641 blah blah blah so I copied that and went to the page and there's some Russian text holders I don't know what it was so I google translate okay so it says invalid username and password access is denied so I didn't actually at any point enter a username and a password so I was like what the heck how do i how do I get into this webpage I tried pass here and like username variables and password variables in like the get HTTP variables I even tried doing it with curl I would just try and send like post data with a dash D flag and send username and password that way that didn't get me anywhere I even tried to find I saw those numbers were weird so I cried like a admin dot PHP page which is a thing I tried Google translating this to but I couldn't get any actual output of it when I had googled this like I did just Google that text itself I think earlier I saw I ended up seeing like some github thing that was defining this is the error message for like authentication not found or like wrong and bad username and password stuff I saw in github for PHP so if you define the other language but again that was just a red herring so what I've ended up doing was testing around with those input boxes those messages you could post those comments you could leave on some of the some of the posts here so what you come to find out is once you leave a message here if you were to post it the message that you receive is actually it tells you like hey please wait for an admin to review your message so this Russian text here if you type check that out the translator this is please wait until an administrator approve your messages so that gets me thinking okay can I do some like cross-site scripting stuff for XSS XSS cross-site scripting so if the admin views the message if the admin looks up I wonder if can I steal like the admins cookie and that kind of set up to be able to see if and cookie has any valuable information like a flag or credentials that I might be able to give to the admin page because I apparently need to be able to give credentials to the admin page so that was the idea the plan of attack and I'll showcase it to you and what we ended up doing here because I have a cookie catcher setup which if you don't have one set up for yourself you should for some CTF challenges and I'll show you how I have to have mine set up but it's on my domain that I own it's on a website that I own just called like my name like John Hammond org and there's nothing on the page it'll just says oh hello there but it is a PHP page that excuse me that grabs your cookie and stores it in another following page called cookies on HTML so it grabs an IP address and the cookie and I tried to get date and time and a website refer but I actually think I just left those blank so there's a bunch of things you can scroll through as you can see how people or BOTS like try to look at my domain and do interesting things I saw I have some interesting results like like pizza Imperia and I think there's another Imperial one yeah Burger Imperia so those are those are funny and there are a lot of these results from different audiences so I do see interesting things I guess when you set up a cookiecutter like that to see BOTS scanning your your your domain anyway I want to show you how this is done so I'll move over to that box this is just a GoDaddy domain that I own just a regular web server so I have the index dot PHP which actually is the cookie catcher what it does is it grabs a HTTP variable the cookie in this case it tries to grab an IP address from the server PHP variables here and refer stuff like that and it opens up that cookies HTML file and it writes on it with a it depends on a cookie and all those stuff all in HTML and then closes it and then it just displays in the screen hello there so it doesn't do much of anything and the commented lines aren't necessary see I don't add the date I just have a period here so those are necessary all we're interested in the cookie and that's just how we get it I just pass it in as a get variable when I do my cross-site scripting but that's how it's done that's how I receive it and it's added to a log cookies on HTML file so when I come for the actual injection that I have I taken a note of here in my cookie catch JavaScript so that I'll showcase it for you here the syntax that I actually end up doing for the JavaScript cross-site scripting is just a regular dogma location like to redirect them and I give them I pass in the HTTP GET request variable cookie in this case and I have an escape their actual the document cookie so if an administrator or a bot or automated administrator or whatever the case may be for the challenge purposes goes to this web page and they are all of a sudden injected with my cross-site scripting JavaScript and I redirect them to my domain and have them pass in their cookie I can see it I could log it now I saw in the telegram chat in the in the conversations for the CTF in like the IRC channel equivalent the hint that they release for this hackers blog challenge is that redirection is not allowed they blocked redirection so this document.location syntax and JavaScript wouldn't work for me so I did a little bit of research I talked with some friends and we could get this idea in solution so you actually create a new image and set up the source for it and that should be able to get an he just encodes it the actual document cookie the same way I think I did with escape I don't know the difference between those two functions admittedly but this is what we ended up rolling with if free Direction is not allowed so this is our XSS or JavaScript we can inject and place in our comment because assuming it will actually read the HTML and interpret it in the wrong way so they get redirected to our web page in our cookie catcher which you can set up very easily if you wanted to again with this code or just googling cookie catchers and knowing how to set them up just going through some guides and some tutorials so they're cool they're interesting I think yeah this is even the code that I stole and copied all right so let's do it I want to showcase this for you guys so let's say like my name is John and I want to post in this XSS payload I can go ahead and submit this or I get an error probably because it wants me to wait some time okay yeah it's right over in a comment within a 10 minute delay so because I've posted that one earlier it's not gonna really let me do it or showcase it to you but I still have the cooking everything saved so what happens is that you would go ahead and submit that payload of the actual JavaScript XSS payload and you would get the same response hey please wait for an administrator to actually look at this and then you monitor and keep track of your log which I suppose you could use mine even at the very very bottom I have this new cookie that I saw from a random IP address an interesting website but I have this this one was new earlier today when I resolve this challenge and it has a login and a password for the cookie so awesome ah we can just add these in create these now we can go ahead and create these for the challenge because if it's just going to that admin page that we wanted was it six four one six four one I don't remember what it was okay thankfully I still have it we can go to this page and with our cookie we can go ahead and set these up in the cookie manager for Firefox we'll search for this domain okay it looks like I don't actually have one so left to add a new one so we can say new cookie for I guess the password is the name of it right we'll set the value in here the domain should be this guy and the path can be anywhere for the entire domain and now we'll set up another cookie which is they said what they wanted login equals admin so log in content can be admin again for this domain path of any type we can save that now ideally we will get our flag when we refresh this or something and we don't fail so it doesn't seem to work well enough for me what I'm using the cookie manager one I don't know if I can get the domain or whatever the thing right so I actually just went ahead and did it with curl and that seems to work just fine for us so if I just curl that address and I pass in a cookie variable now we can use what we're given just straight up real easily just copy it I didn't mean to vote Firebug there and paste it in now and reload the page hey we get a flag one true hackers leet XSS cross-site scripting so that's it using our cookie catcher and just passing in the cookie that we get from the admin that visits the page we do get our flag with taking advantage of the admin page we saw earlier and take advantage of the cross-site scripting that we that we found in the comments so that's it that's how you solved that challenge it was a good challenge I honestly used to struggle with it for a long while because I was convinced there was XSS I wasn't convinced it was cross-site scripting in the comments and I didn't I really didn't know what to do with that admin page because I couldn't get a login I couldn't give it credentials at all at least seemingly but we work through a little bit more and we ended up get it so awesome awesome thanks for watching guys hope you enjoyed this one see ya pretty nifty 500 points here and I'll try and showcase some other cool challenges in a future video so see you soon