Hacking Write-Ups

Security WarGame By PAC Security  So first of all I opened the link and it have the zip file I downloaded it and then try to open it.  It was password encrypted so I use john to decrypt it. So here we can see that the password of the zip was password itself Now I opened it . It was containing a “pac.apk” file so first I ran the file command  Using file it is confirm that it is not a apk file so I use “cat” to print the output and I see a text with ==  so I rush to used base 64 but it was not base 64 so I google the cipher which gives the output with ‘=='  and I found blowfish cipher there so I googled the decoder of blowfish cipher and bingo I got the result that is:- I picked up from ‘o+7...’ because there is a space between them and the site name was revealed. I opened it I found this page so first thing is that I use dirb on this page and I got the result as follows URL /~adm URL /~404 And...

  What this could be? This is the file we got after visiting the link. The only hint we know is “Special Characters” This looks like some esoteric programming language which is written  using some special characters. After searching we got to know that it is an esoteric programming language “JSfuck”. Now let’s go and decrypt this using an online JSfuck decoder.      After decrypting we got the flag: "flag{5uch_j4v4_5crip7_much_w0w}"     Author: Somya Agrawal

This walkthrough will demonstrate the simple challenge based on command injection Calculat3 M3 This is the challenge page we got after visiting the given link. I provided random input in this calculator and intercepted the request with BurpSuite I got one parameter "expression" taking the values  Tried for command injection with ";ls" Forwarding the above request finally Got the Flag

Lab Environment Attacker's Machine:   Linux kali 5.3.0-kali2-amd64 #1 SMP Debian 5.3.9-3kali1 (2019-11-20) x86_64 GNU/Linux Victim's Machine:   My File Server: 1 Mapping the local network to determine the IP of vulnerable machine. Command Used: arp-scan --local Nmap Scan Command Used: nmap -A Victim's IP Results: samba service on port 445 After knowing the samba service is active I fired up smbmap to enumerate it further. Command Used: smbmap -H Victim's IP Result: username - smbuser I decided for further enumeration and used Nikto to scan the target. Command Used: nikto -h Victim's IP Results: /readme.txt Visited the url to view if something useful can be found in readme.txt Results: my password is rootroot1 Now I am having username "smbuser" and password "rootroot1" to connect to victim's machine via ssh and when tried to connect it timed out my connection. So, I thought of generat...

This was the basic injection challenge which clearly gives the hint of injecting malicious code. So, I was presented with Input Screen to enter something. Initiated with taking a view of source code and I got something that can be useful. As mentioned in above image to try some names, I started inserting the names and insertion of Luke in the field displays the message that he made this problem. Then I tried basic injection payload to see what can happen. 1'or'1''='1 And flag appeared

Back Again with a new boot2root CTF Lab Environment Attacker's Machine:  Linux kali 5.3.0-kali2-amd64 #1 SMP Debian 5.3.9-3kali1 (2019-11-20) x86_64 GNU/Linux Victim's Machine: TBBT: FunWithFlags Mapping the local network to determine the IP of Vulnerable Machine Command Used: arp-scan --local  Now Scanning and enumerating the IP address with Nmap All Ports Scan Command Used: Nmap -p- 192.168.1.105 ftp, ssh, http, waste services are active Since, http service is active dirb can burst the directories and can reveal some import directories if present. Command Used: dirb http://192.168.1.105  Results: Wordpress Directory  Now since we know that there is a Wordpress directory so Wpscan is a better option to enumerate. Command Used: wpscan --url http://192.168.1.105/music/wordpress --enumerate ap Explanation: ap means All Plugins  Results: One plugin Found which is out of date named reflex-gall...