Hack This Site: Realistic Mission 5 - Damn Telemarketers!

Click here: LEVEL 5

I remember that here I write SPOILERS!

I RECOMMEND to win the level alone, using also Google for Theory of arguments

So...

First of all, take a tour of the website.

It's VERY important that we read the descriptions. We will note two things:

- "Everything they use is 10 years old"
- "new password seems to be a 'message digest'"

With that, you should have a look around. You will notice that you have a lot of email addresses on the pages. These are good to keep in case you need to start guessing usernames (you don't, but just saying). On the news page you will notice something about google finding links that it shouldn't. Immediately, you should think to take a look at the robots.txt file.

In the robots.txt file, you will notice a few directories that they don't want you looking into.

These directories are "secret" and "lib".

Directory "secret" we can see also by source code of website.

However, if we go to:

https://www.hackthissite.org/missions/realistic/5/robots.txt

we see some info...

Let's do directory traversal (or path traversal) attack to the "secret" directory. We have 2 file .php:

admin.bak.php

admin.php

Check the backup script file and you'll find out a hash value:

From the hint above:

everything they used was 10 years out of date and the new password seems to be a 'message digest' 

we understand that Message Digest is MD, and "10 years out of date" refers to MD4.

We need to find out the algorithm and decrypt the hash value.

There are so many algorithm to decrypt the password. Of course, you could brute force it, but I wanna save time. So, follow the direction to look around the server.

http://en.wikipedia.org/wiki/Cryptographic_hash_function

I remember that, checking robots.txt file, in "lib" directory there is a file called "hash".

Open the hash file, there are some garbage text and some system information. "MD4" is what we're looking for.

We can use "john the ripper" to crack it

root@sp:/pentest/passwords/john# ./john --format=raw-md4 ./md4.txt 

or other ways, like using Cain & Abel. In this way, open Cain & Abel, click on "Cracker" tab, then, on left, click on "MD4 Hashes", click on File/Add to List, and insert hash code found before into admin.bak.php

Then, click with right mouse button on code just inserted and click on "Brute-Force Attack" and click on START!

The password that we'll go to insert on

https://www.hackthissite.org/missions/realistic/5/submit.html

will be:

===============> HTS: Realistic Mission 6

Hack This Site: Realistic Mission 4 - Fischer's Animal Products

Click here: LEVEL 4

I remember that here I write SPOILERS!

I RECOMMEND to win the level alone, using also Google for Theory of arguments

We note that links are from type ?category=<something>. So it's possible using SQL Injection. In addition, email form doesn't check data. 

Let's go to products. As you can see by the URL, the data for the coats is also held in an sql database:

category=1

We note that there are two "input points".  The first is a small form asking for you
 to enter your email.  The second is the link to the products pages (products.php?category=1).  Any input can be fuzzed.

There should be two tables, one for the products and the other for the email ID. To get table name of email ID, we must type on email form into homepage a string that isn't a email. The developers of the site have not bothered to mask their error messages (quite common in real life) and so we get, by error message, the name of table that is "email".

Clearly the sql injection attempt is being blocked.  There is no way to do blind sql injection at this point since we don't have a way to view the information. (Yes you could try pinging and stuff, but this is just a test).

If I type
products.php?category=1 or 1=1


it produces a page with all products on it.  Further more, if you put in a sql statement that generates an error, you get a nice little blank page.

Let's exploit:

Sql has a command that is called Union All.  Basically, this command allows you to combine the results from two select statements.  The key is that the column numbers have to match.  By looking at the product page, you can try and guess how many columns are being returned in the original query.  There seems to be a link to an image, a description, and a price.  There is probably also an id of some kind.  That makes 4 columns.

However, other way to check the number of columns is typing:

 https://www.hackthissite.org/missions/realistic/4/products.php?category=1 order by <any number>

Keep increasing the number. There are x columns, if, when x+1 is entered, a broken image appears.

However, in our case, we have 4 columns.

So, we type: 

http://.../realistic/4/products.php?category=1 UNION ALL SELECT null, *, null, null FROM email

* means everything, and email probably only has 1 column.

We place the * at the second position because request will place the pictures at first position and description at second position. By placing our target field as the second position enables to view the content.

The objective of an UNION ALL request is to concatenate the results of a given request with the results of another request. In order to work, both the requests must return the same number and types of fields.

However, at the end, we have to send the list of grabbed emails in a mail to SaveTheWhales.

Go to your profile, click on your name. On the right, click on your name again.Then, send message to SaveTheWhales with all emails

Source:  

http://www.aldeid.com/wiki/Hackthissite/Realistic/Level4

http://www.shamirc.com/2011/04/hackthissite-realistic-4-solution.html

===============> HTS: Realistic Mission 5

Hack This Site: Realistic Mission 3 - Peace Poetry: HACKED

Click here: LEVEL 3

I remember that here I write SPOILERS!

I RECOMMEND to win the level alone, using also Google for Theory of arguments

 

First of all, we go into source page.

We note that, below the page in the last rows, there is a comment that says:

 So, we go to:

https://www.hackthissite.org/missions/realistic/3/oldindex.html

and this link leads us to old index page of Peace Poetry.

Then, we click on "Submit Poetry", moving us to

https://www.hackthissite.org/missions/realistic/3/submitpoems.php

The submission form for new poems doesn't check entries. It is easy to erase content of the entire website using this vulnerability!

So, if you simply type in the name of your poem, it will be saved in the current directory. You need to submit the source of the oldindex.html as index.html and also in the correct place. For that you need to go up one directory. This is accomplished by '../' , which is prefixed to the name of our file 'index.html'.

We can overwrite index.html with oldindex.html because, the site, instead of automatically renaming files with the same name, it pastes them directly over the old one, so it overwrites them.

So, into "Name of poem" form, we type

../index.html

and into "Poem" form we paste the source code of oldindex.html page

Then, we click on ADD POEM!

I remember that:
The Unix command ../ tells us to go into the parent file directory (Back-Up A Directory Basically) and adding ../index.html tells the server to back-up a directory and save this as index.html.

Since we added the source code for the young ladies site as the content for the file (poem), it overwrites the propaganda site (@ index.html) with our young ladies "Peace Poetry" site, thus re-instating HER site as the main index.html page, NOT the hackers.
That is also how the hacker "hacked" his own propaganda site in the first place!
She should really make sure her server sanitizes requests!

===============> HTS: Realistic Mission 4

Hack This Site: Realistic Mission 2 - Chicago American Nazi Party

Click here: LEVEL 2

I remember that here I write SPOILERS!

I RECOMMEND to win the level alone, using also Google for Theory of arguments

Here, first thing to do is to go to source page.

We note that there is a file "update.php" that is hidden into homepage:

 We see it only if we mark it by cursor

Moreover, there is a second file "update2.php" that leads us to failed login page.

However, clicking on update.php, it reminds us to login page. 

In this way, we try to exploit by SQL Injection, typing into both Username and Password field the following:

' or 1=1--

===============> HTS: Realistic Mission 3

Hack This Site: Realistic Mission 1 - Uncle Arnold's Local Band Review

Click here: LEVEL 1

I remember that here I write SPOILERS!

I RECOMMEND to win the level alone, using also Google for Theory of arguments

 

Here

our target is to increase the average rating of Raging Inferno band.

We have two ways:

1- Use Firebug (or similar) and go to part of code where there is last "vote" bottom and the scores.

Change value of, for example, 5... So:

After this, choose 5 points and click on bottom "vote"!

2- Let's use JavaScript code.

We type on url bar this JavaScript code:

javascript:void(document.forms[4].vote[0].value="1000");alert(document.forms[4].vote[0].value);

In this way, we say it that it must edit the point 1 in 1000 point. So, when we run JavaScript code, then we vote for 1 point!

WHY DOES IT HAPPEN?

• The reason this attack works is that the value you have altered and sent was not being checked on  the server side e.g. there was no statement like this:

 if($_POST("voteVal") < 1 || $_POST("voteVal") > 5)
       handleError();

• It is extremely important that form values are checked both client and server side. However, as you have just seen it is more important to check them server side to make sure the value isn't just executed with the code. The need to check client-side is more of an efficiency method so that genuine-bad input (accidental input) does not take up server resources by handling http requests. You will see how important this really is when we come to do SQL Injections.
• The other method I spoke of was to save the web page locally to your machine and then alter the form values within the HTML.

===============> HTS: Realistic Mission 2