Basic Web Hacking 17 :: java decompiler

by Arxleol on Tuesday 26.01.2010, under Java, hellboundhackers.org, tutorial

As you know java uses interpreter for executing on target system. Why am I talking about java now.

Because, java also allows applets web applications executed in web browser. Now let’s continue to our mission.

Enter Your Password to Login

only.Samurai made this login thinking it wasn’t vulnerable to any injection, he was right, however; there was another hole.

From introduction we see that this mission is not vulnerable to anything used in previous examples.

However, if we inspect code you will find something similar to this:

&lt; applet width="150" height="40" code="basic17.class"&gt;
&lt;/applet&gt;

Here we have link to source: basic17.class you can download this file from: http://www.hellboundhackers.org/challenges/basic17/basic17.class

Now since we have compiled java class try downloading java decompiler. Next step is to open basic17.class with decompiler and obtain java code.

import java.applet.Applet;
import java.applet.AppletContext;
import java.awt.Color;
import java.awt.TextField;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.net.MalformedURLException;
import java.net.URL;
 
public class basic17 extends Applet
  implements ActionListener
{
  String file4 = "baysick-seventeen.complete.php?pass=";
  TextField inputLine = new TextField(15);
  String file2 = "test";
 
  public void init() {
    setBackground(Color.WHITE);
  }
 
  public basic17() {
    add(this.inputLine);
    this.inputLine.addActionListener(this);
    this.file2 = "challenges";
  }
 
  public void actionPerformed(ActionEvent paramActionEvent) {
    String str1 = this.inputLine.getText();
    if (str1.equals("ifYOU'REhereYOU'REelite"))
    {
      URL localURL = null;
      String str2 = "http://www.hellboundhackers.org/";
 
      String str3 = "basic17";
      try {
        localURL = new URL(getDocumentBase(), str2 + "/" + this.file2 + "/" + str3 + "/" + this.file4 + new String("elite")); } catch (MalformedURLException localMalformedURLException) {
      }
      getAppletContext().showDocument(localURL);
    }
    else
    {
      this.inputLine.setText("not yet");
    }
  }
}

After inspecting this code for some time you will notice following line:

    if (str1.equals("ifYOU'REhereYOU'REelite"))

This in fact means that password we need is:

“ifYOU’REhereYOU’REelite

M	T	W	T	F	S	S
« Dec				Feb »
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31

Axino.net