Hackthissite ‐ Basic Missions - taylorjohn/hacking GitHub Wiki
Basic Level 1
view source
Basic Level 2
Network Security Sam set up a password protection script. He made it load the real password from an unencrypted text file and compare it to the password the user enters. However, he neglected to upload the password file...
Dude never upload password file so just hit submit with blank field. If you put in a password it will fail. I doubt this will be the case in real life but never hurts to try all possible avenues.
Basic Level 3
This time Network Security Sam remembered to upload the password file, but there were deeper problems than that.
view source
<input type="hidden" name="file" value="password.php" />
goto
https://www.hackthissite.org/missions/basic/3/password.php
view source
<body>2694e834</body>
the password is '2694e834'
<input type="hidden" name="to" value="[email protected]" />
Change email "[email protected]" to one you have access to (a throwaway one in practice) and the form will mail you the password to [email protected].
(Note: If this is not the email address on your HackThisSite profile, no email will actually be sent.)
Change email "[email protected]" to one you have access to (a throwaway one in practice) and the form will mail you the password to [email protected].
Password reminder successfully sent to [email protected]
(Note: If this is not the email address on your HackThisSite profile, no email will actually be sent.)
Network Security Sam has encrypted his password. The encryption system is publically available and can be accessed with this form:
Please enter a string to have it encrypted.
[ ] [ Encrypt ]
You have recovered his encrypted password. It is:
41;8hh8>
Decrypt the password and enter it below to advance to the next level.
Password:
[ ] [ Decrypt ]
so enter so characters like 'aaaaa' becomes
Your encrypted string is: 'abcde'
ok lets analyze this for a pattern.
so a +0 then a+1, then a+2 then a+3 you see where this going a+4
so to decrypt or reverse the ascii value we need to do the reverse a-0, then b-1 then c-2, then d-3 and finally e-4
and we get back to 'aaaaa'
I made a quick python file to solve this
Decrypted: 4095dc27
Basic Mission 7
This time Network Security sam has saved the unencrypted level7 password in an obscurely named file saved in this very directory.
In other unrelated news, Sam has set up a script that returns the output from the UNIX cal command. Here is the script:
Enter the year you wish to view and hit 'view'.
Password:
goto https://www.hackthissite.org/missions/basic/7/cal.pl
&& ls
there its is hanging out in there
k1kh31b1n55h.php
Injection of following code to the input text field in the form :
<!--#exec cmd="ls" --> l
we in the tmp dir so we need to back out to the correct one.
<!--#exec cmd="ls ../" -->
au12ha39vc.php so goto
https://www.hackthissite.org/missions/basic/8/au12ha39vc.php
and you get the password '4676ffe4'
Same vulnerability can be used from previous mission however you will need to go back to mission 8 and navigate into mission 9
<!--#exec cmd="ls ../../9/" -->
navigate to that url in the correct /9/ not the temp or level 8.
p91e283zc3.php
https://www.hackthissite.org/missions/basic/9/p91e283zc3.php
and you will see the password.
5ae99402
boom!!
edit cookie from No to Yes
save cooke and submit.
you can also do this by intercepting and forwarding the cookie. will add this method later.
All Elton John Songs
Eventually https://www.hackthissite.org/missions/basic/11/e/ works. Click through the ensuing directories you discover and you'll end up at https://www.hackthissite.org/missions/basic/11/e/l/t/o/n/. his directory seems empty, but try accessing the .htaccess file at https://www.hackthissite.org/missions/basic/11/e/l/t/o/n/.htaccess.
knowledge of the .htaccess file comes in handy here. used to block google and other bots from crawling and indexing files on your site.
`IndexIgnore DaAnswer.* .htaccess
<Files .htaccess>
require all granted
</Files>`
goto https://www.hackthissite.org/missions/basic/11/e/l/t/o/n/DaAnswer/
says
The answer is available! Just look a little harder.
which is a stupid riddle for the password being 'available'
got https://www.hackthissite.org/missions/basic/11/index.php
to enter it
boom Basic is completed