{"id":268,"date":"2020-07-04T08:28:16","date_gmt":"2020-07-04T00:28:16","guid":{"rendered":"https:\/\/byy3.com\/?p=268"},"modified":"2021-01-09T10:10:28","modified_gmt":"2021-01-09T02:10:28","slug":"hacking-walkthrough-thm-scripting","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=268","title":{"rendered":"[Hacking walkthrough] THM: Scripting"},"content":{"rendered":"\n<figure class=\"wp-block-image\"><img decoding=\"async\" data-original=\"https:\/\/i1.wp.com\/www.embeddedhacker.com\/wp-content\/uploads\/2019\/09\/titlecard-12.png?w=1200&amp;ssl=1\" src=\"https:\/\/byy3.com\/wp-content\/themes\/MNews%20V2.4\/images\/post-loading.gif\" class=\"wp-image-2105\" title=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe\" alt=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Howdy, welcome to another&nbsp;<a href=\"https:\/\/byy3.com\/go\/?url=https:\/\/tryhackme.com\/room\/scripting\" rel=\"nofollow\" >tryhackme CTF<\/a>&nbsp;walkthrough. This is my personal favorite room because it involves scripting and ciphering. As you know, I\u2019m a die-hard fan for forensic and programming :p . For your information, There are a total of 3 stages for this challenge where the first stage is decoding base64, port capture on stage 2 and finally, the hardest stage (perhaps), decrypting the AES-GCM block cipher. Let\u2019s get started<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Task 1: Base64<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You are required to write a script to decode the base64 for 50 times. Bash and python, both works for you but I prefer python. Copy the following script and execute along with the file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#b64.py\nimport base64\nimport sys\n\nwith open(sys.argv&#91;1],'r') as my_file:\n data = my_file.read()\n\nfor i in range (0,50):\n data = base64.b64decode(data)\n\nprint(data) \nmy_file.close()<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>$ python b64.py b64.txt<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" data-original=\"https:\/\/i2.wp.com\/www.embeddedhacker.com\/wp-content\/uploads\/2019\/09\/task1.png?w=1200&amp;ssl=1\" src=\"https:\/\/byy3.com\/wp-content\/themes\/MNews%20V2.4\/images\/post-loading.gif\" class=\"wp-image-2098\" title=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe1\" alt=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe1\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Simple huh. Well, the best is yet to come.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Answer:<\/strong>&nbsp;HackBack2019=<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Task 2: Capture the port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a fun challenge, to be honest. Your task is to follow the port and reveal the mathematic operation. You need to have basic knowledge on&nbsp;<a href=\"https:\/\/byy3.com\/go\/?url=https:\/\/docs.python.org\/3\/howto\/sockets.html\" rel=\"nofollow\" >python socket<\/a>, If you need a full guide on the socket python, I highly recommend this&nbsp;<a href=\"https:\/\/byy3.com\/go\/?url=https:\/\/realpython.com\/python-sockets\/\" rel=\"nofollow\" >article<\/a>. For me, I am a lazy person, well no doubt. So, I letting the python do the mathematic for me.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These are the flow of my code<br>1: Initialize port 1337 as staring port (Why? Read the page, duh)<br>2. Initialize the socket<br>3. Send an HTTP GET request<br>4. Read the response<br>5. Process the response (trim, replace, split)<br>6. Perform arithmetic<br>7. Repeat step 2 to 6 until STOP response<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid the script getting terminate due to connection refused error, I used \u2018try\u2019 and \u2018except\u2019 with \u2018pass\u2019. Alright, the code is right here (I know you need it)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import socket \nimport sys\nimport time\n\nhost=sys.argv&#91;1]\nport = 1337\nnumber = 0\n\nwhile 1:\n\ttry:\n\t\ts = socket.socket()\n\t\ts.connect((host,port))\n\t\tif (port == 9765):\n\t\t\tbreak\n\t\told_port = port\n\t\trequest = \"GET \/ HTTP\/1.1\\r\\nHost:%s\\r\\n\\r\\n\" % host\n\t\ts.send(request.encode())\n\t\tresponse = s.recv(4096)\n\t\thttp_response = repr(response)\n\t\thttp_trim = http_response&#91;167:]\n\t\thttp_trim = http_trim.replace('\\'','')\n\t\tdata_list = list(http_trim.split(\" \"))\n\t\tport = int(data_list&#91;2])\n\t\tprint('Operation: '+data_list&#91;0]+', number: '+ data_list&#91;1]+', next port: '+ data_list&#91;2])\n\t\tif(port != old_port):\n\t\t\tif(data_list&#91;0] == 'add'):\n\t\t\t\tnumber += float(data_list&#91;1])\n\t\t\telif(data_list&#91;0] == 'minus'):\n\t\t\t\tnumber -= float(data_list&#91;1])\n\t\t\telif(data_list&#91;0] == 'multiply'):\n\t\t\t\tnumber *= float(data_list&#91;1])\n\t\t\telif(data_list&#91;0] == 'divide'):\n\t\t\t\tnumber \/= float(data_list&#91;1])\n\t\ts.close()\n\texcept:\n\t\ts.close()\n\t\tpass\n\nprint(number)<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>$ python pn.py &lt;Machine IP><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For your information, the port on the webserver is recycling (there are a total of 35 ports). Which mean the port changing sequence is always fixed. If you miss a port because of the poor connection, don\u2019t worry, you just need to wait for another round (140-second per round). Sit back and relax until you get the number. Just let me know if you have a better script ?<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" data-original=\"https:\/\/i2.wp.com\/www.embeddedhacker.com\/wp-content\/uploads\/2019\/09\/task2.png?w=1200&amp;ssl=1\" src=\"https:\/\/byy3.com\/wp-content\/themes\/MNews%20V2.4\/images\/post-loading.gif\" class=\"wp-image-2101\" title=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe2\" alt=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe2\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Here you go.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Answer:<\/strong>&nbsp;344769.12<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Task 3: AES-GCM<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here comes my favorite part, the block cipher. Oh yes!!!!!! Block cipher FTW. (cough) sorry. For this task, you are required to decrypt the&nbsp;<a href=\"https:\/\/byy3.com\/go\/?url=https:\/\/cryptography.io\/en\/latest\/hazmat\/primitives\/symmetric-encryption\/#cryptography.hazmat.primitives.ciphers.modes.GCM\" rel=\"nofollow\" >AES-GCM mode block cipher<\/a>. But before that, you need to make a socket connection (like the previous task) with the UDP server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Alright, this is the flow of my code<br>1) Send payload \u2018hello\u2019 to receive the first response<br>2) Send payload \u2018ready\u2019 to reveal Keys, IV, and checksum for the flag<br>3) send payload \u2018final\u2019 TWICE to receive encrypted flag followed by the tag<br>4) Decrypt the flag<br>5) Check the plaintext with checksum. If checksum not match, repeat step 4<br>6) Print the plaintext if checksum match<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import socket\nimport sys\nimport hashlib\n\nfrom cryptography.hazmat.backends import default_backend\nfrom cryptography.hazmat.primitives.ciphers import (\n Cipher, algorithms, modes\n)\n\nhost = sys.argv&#91;1]\nport = 4000\n\ndef AES_GCM_decrypt(key, iv, ciphertext, tag):\n\tassociated_data = ''\n\tdecryptor = Cipher(algorithms.AES(key), modes.GCM(iv,tag), backend=default_backend()).decryptor()\n\tdecryptor.authenticate_additional_data(associated_data)\n\treturn decryptor.update(ciphertext) + decryptor.finalize()\n\ndef SHA256_hash(hash_string):\n sha_signature = hashlib.sha256(hash_string.encode()).hexdigest()\n return sha_signature\n\ns = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\ns.connect((host,port))\n\ns.send(b'hello\\n')\ndata = s.recv(2048)\nprint(data)\n\ns.send(b'ready\\n')\nready = s.recv(2048)\nprint(ready)\nchecksum = ready&#91;104:136]\nhex_checksum = checksum.encode('hex')\nprint(\"checksum in hex: \"+hex_checksum)\n\nwhile 1:\n\ts.send(b'final\\n')\n\tflag = s.recv(2048)\n\n\ts.send(b'final\\n')\n\ttag = s.recv(2048)\n\n\tkey = b'thisisaverysecretkeyl337'\n\tiv = b'secureivl337'\n\ttag = bytes(tag)\n\tciphertext = bytes(flag)\n\tplaintext = AES_GCM_decrypt(key, iv, ciphertext, tag)\n\n\thash_string = SHA256_hash(plaintext)\n\tif(hash_string == hex_checksum):\n\t\tprint('flag is: '+plaintext)\n\t\tbreak\n\ns.close()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" data-original=\"https:\/\/i1.wp.com\/www.embeddedhacker.com\/wp-content\/uploads\/2019\/09\/task3.png?w=1200&amp;ssl=1\" src=\"https:\/\/byy3.com\/wp-content\/themes\/MNews%20V2.4\/images\/post-loading.gif\" class=\"wp-image-2103\" title=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe3\" alt=\"[Hacking walkthrough] THM: Scripting\u63d2\u56fe3\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Not that hard huh.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Answer:<\/strong>&nbsp;THM{eW-sCrIpTiNg-AnD-cRyPtO}<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s all for the short and simple scripting challenge. Hope you enjoy it. See you nex time ?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Howdy, welcome to another&nbsp;tryhackme CTF&nbsp;walkt [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,1],"tags":[352],"class_list":["post-268","post","type-post","status-publish","format-standard","hentry","category-python","category-net-security","tag-python"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=268"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/268\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}