-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Javascript challenge #47
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| FROM php:7.4.7-apache |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # JavaScript | ||
|
|
||
| > web | ||
|
|
||
| Author: [Simon Thiboutôt (lilc4t)](https://github.com/masterT) | ||
|
|
||
| http://127.0.0.1:12001/ | ||
|
|
||
| ## Setup | ||
|
|
||
| Requirements: | ||
| - docker | ||
|
|
||
| Start: | ||
|
|
||
| ```shell | ||
| docker-compose up | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| version: "2" | ||
| services: | ||
| web: | ||
| image: php:7.4.7-apache | ||
| ports: | ||
| - "12001:80" | ||
| volumes: | ||
| - "./src/:/var/www/html" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| <!doctype html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | ||
| <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css" integrity="sha384-9aIt2nRpC12Uk9gS9baDl411NQApFmC26EwAOH8WgZl5MYYxFfc+NcPb1dKGj7Sk" crossorigin="anonymous"> | ||
| <title>Login 2</title> | ||
| <style> | ||
| html, | ||
| body { | ||
| height: 100%; | ||
| } | ||
|
|
||
| body { | ||
| display: -ms-flexbox; | ||
| display: flex; | ||
| -ms-flex-align: center; | ||
| align-items: center; | ||
| padding-top: 40px; | ||
| padding-bottom: 40px; | ||
| background-color: #f5f5f5; | ||
| } | ||
|
|
||
| .form-signin { | ||
| width: 100%; | ||
| max-width: 330px; | ||
| padding: 15px; | ||
| margin: auto; | ||
| } | ||
| .form-signin .checkbox { | ||
| font-weight: 400; | ||
| } | ||
| .form-signin .form-control { | ||
| position: relative; | ||
| box-sizing: border-box; | ||
| height: auto; | ||
| padding: 10px; | ||
| font-size: 16px; | ||
| } | ||
| .form-signin .form-control:focus { | ||
| z-index: 2; | ||
| } | ||
| .form-signin input[type="email"] { | ||
| margin-bottom: -1px; | ||
| border-bottom-right-radius: 0; | ||
| border-bottom-left-radius: 0; | ||
| } | ||
| .form-signin input[type="password"] { | ||
| margin-bottom: 10px; | ||
| border-top-left-radius: 0; | ||
| border-top-right-radius: 0; | ||
| } | ||
| </style> | ||
| <script> | ||
| function fuzz (value) { | ||
| if (value % 2 == 0) { | ||
| return value + 3; | ||
| } else { | ||
| return value - 1; | ||
| } | ||
| } | ||
|
|
||
| function keyValueAt(key, index) { | ||
| var value; | ||
| var keyIndex = index % key.length; | ||
| var integer = parseInt(key[keyIndex]); | ||
| if (integer && !isNaN(integer)) { | ||
| value = integer; | ||
| } else { | ||
| value = key.charCodeAt(keyIndex); | ||
| } | ||
| return value; | ||
| } | ||
|
|
||
| function encrypt (key, plaintext) { | ||
| var cipher = []; | ||
| for (let index = 0; index < plaintext.length; index++) { | ||
| cipher.push(fuzz(plaintext.charCodeAt(index) ^ keyValueAt(key, index))); | ||
| } | ||
| return btoa(cipher.join(':')); | ||
| } | ||
|
|
||
| function login (event) { | ||
| var key = "2718587a3f"; | ||
| var encryptedFlag = "NzE6NzQ6Njc6Nzg6NDM6NTY6OTY6MjoxMDU6Nzo1MzoxMDU6NTA6NTY6OTg6NTE6OTg6ODM6NDg6OTc6NTU6NTQ6NTY6NjU6MTA1OjEwNDo1MDo4Mzo2MTo4OTo1Mjo2NToxMDE6NjU6NTQ6MTEzOjYyOjM="; | ||
| var inputEmail = document.getElementById('inputEmail'); | ||
| var inputPassword = document.getElementById('inputPassword'); | ||
| var email = inputEmail.value; | ||
| var password = inputPassword.value; | ||
|
|
||
| if (email === "admin@local" && password.length === 38 && encryptedFlag === encrypt(key, password)) { | ||
| alert("Welcome back admin! Here is your flag:\n" + password) | ||
| } else { | ||
| alert('Bad credentials!') | ||
| } | ||
|
|
||
| return false; | ||
| } | ||
| </script> | ||
| </head> | ||
| <body class="text-center"> | ||
| <form class="form-signin" onsubmit="login()"> | ||
| <h1 class="h3 mb-3 font-weight-normal">Login 2</h1> | ||
| <label for="inputEmail" class="sr-only">Email address</label> | ||
| <input type="email" id="inputEmail" class="form-control" placeholder="Email address" required autofocus> | ||
| <label for="inputPassword" class="sr-only">Password</label> | ||
| <input type="password" id="inputPassword" class="form-control" placeholder="Password" required> | ||
| <button class="btn btn-lg btn-primary btn-block" type="submit">Login</button> | ||
| </form> | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| <!doctype html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | ||
| <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css" integrity="sha384-9aIt2nRpC12Uk9gS9baDl411NQApFmC26EwAOH8WgZl5MYYxFfc+NcPb1dKGj7Sk" crossorigin="anonymous"> | ||
| <title>JavaScript</title> | ||
| <style> | ||
| html, | ||
| body { | ||
| height: 100%; | ||
| } | ||
|
|
||
| body { | ||
| display: -ms-flexbox; | ||
| display: flex; | ||
| padding-top: 40px; | ||
| padding-bottom: 40px; | ||
| background-color: #f5f5f5; | ||
| } | ||
| </style> | ||
| </head> | ||
| <body> | ||
| <div class="container"> | ||
| <div class="row"> | ||
| <div class="col-md-6 offset-md-3"> | ||
| <h1>JavaScript</h1> | ||
| <p>The browser's programming language, it's good for many things, but it's code while always be accessible.</p> | ||
| <h3>Challenges</h3> | ||
| <ul> | ||
| <li> | ||
| <a href="/login-1.html">Login 1</a> | ||
| </li> | ||
| <li> | ||
| <a href="/login-2.html">Login 2</a> | ||
| </li> | ||
| </ul> | ||
| </div> | ||
| </div> | ||
| </div> | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| <!doctype html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | ||
| <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css" integrity="sha384-9aIt2nRpC12Uk9gS9baDl411NQApFmC26EwAOH8WgZl5MYYxFfc+NcPb1dKGj7Sk" crossorigin="anonymous"> | ||
| <title>Login 1</title> | ||
| <style> | ||
| html, | ||
| body { | ||
| height: 100%; | ||
| } | ||
|
|
||
| body { | ||
| display: -ms-flexbox; | ||
| display: flex; | ||
| padding-top: 40px; | ||
| padding-bottom: 40px; | ||
| background-color: #f5f5f5; | ||
| } | ||
|
|
||
| .form-signin { | ||
| width: 100%; | ||
| max-width: 330px; | ||
| padding: 15px; | ||
| margin: auto; | ||
| } | ||
| .form-signin .checkbox { | ||
| font-weight: 400; | ||
| } | ||
| .form-signin .form-control { | ||
| position: relative; | ||
| box-sizing: border-box; | ||
| height: auto; | ||
| padding: 10px; | ||
| font-size: 16px; | ||
| } | ||
| .form-signin .form-control:focus { | ||
| z-index: 2; | ||
| } | ||
| .form-signin input[type="email"] { | ||
| margin-bottom: -1px; | ||
| border-bottom-right-radius: 0; | ||
| border-bottom-left-radius: 0; | ||
| } | ||
| .form-signin input[type="password"] { | ||
| margin-bottom: 10px; | ||
| border-top-left-radius: 0; | ||
| border-top-right-radius: 0; | ||
| } | ||
| </style> | ||
| <script> | ||
| function login (event) { | ||
| // I changed my password and update the login to make it more secure... | ||
| var flag = "\x46\x4c\x41\x47\x2d\x65\x37\x65\x62\x66\x62\x62\x39\x64\x63\x66\x35\x63\x66\x62\x36\x30\x61\x65\x31\x62\x62\x35\x39\x64\x34\x30\x66\x37\x36\x39\x35"; | ||
| var email = "\x61\x64\x6d\x69\x6e\x40\x6c\x6f\x63\x61\x6c"; | ||
| var password = "\x50\x40\x61\x73\x73\x77\x30\x72\x64\x21"; | ||
| var inputEmail = document.getElementById('inputEmail'); | ||
| var inputPassword = document.getElementById('inputPassword'); | ||
|
|
||
| if (inputEmail.value === email && inputPassword.value === password) { | ||
| alert("Welcome back admin! Here is your flag:\n" + flag); | ||
| } else { | ||
| alert('Bad credentials!'); | ||
| } | ||
|
|
||
| return false; | ||
| } | ||
| </script> | ||
| </head> | ||
| <body class="text-center"> | ||
| <form class="form-signin" onsubmit="login()"> | ||
| <h1 class="h3 mb-3 font-weight-normal">Login 1</h1> | ||
| <label for="inputEmail" class="sr-only">Email address</label> | ||
| <input type="email" id="inputEmail" class="form-control" placeholder="Email address" required autofocus> | ||
| <label for="inputPassword" class="sr-only">Password</label> | ||
| <input type="password" id="inputPassword" class="form-control" placeholder="Password" required> | ||
| <button class="btn btn-lg btn-primary btn-block" type="submit">Login</button> | ||
| </form> | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| <!doctype html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | ||
| <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css" integrity="sha384-9aIt2nRpC12Uk9gS9baDl411NQApFmC26EwAOH8WgZl5MYYxFfc+NcPb1dKGj7Sk" crossorigin="anonymous"> | ||
| <title>Login 2</title> | ||
| <style> | ||
| html, | ||
| body { | ||
| height: 100%; | ||
| } | ||
|
|
||
| body { | ||
| display: -ms-flexbox; | ||
| display: flex; | ||
| padding-top: 40px; | ||
| padding-bottom: 40px; | ||
| background-color: #f5f5f5; | ||
| } | ||
|
|
||
| .form-signin { | ||
| width: 100%; | ||
| max-width: 330px; | ||
| padding: 15px; | ||
| margin: auto; | ||
| } | ||
| .form-signin .checkbox { | ||
| font-weight: 400; | ||
| } | ||
| .form-signin .form-control { | ||
| position: relative; | ||
| box-sizing: border-box; | ||
| height: auto; | ||
| padding: 10px; | ||
| font-size: 16px; | ||
| } | ||
| .form-signin .form-control:focus { | ||
| z-index: 2; | ||
| } | ||
| .form-signin input[type="email"] { | ||
| margin-bottom: -1px; | ||
| border-bottom-right-radius: 0; | ||
| border-bottom-left-radius: 0; | ||
| } | ||
| .form-signin input[type="password"] { | ||
| margin-bottom: 10px; | ||
| border-top-left-radius: 0; | ||
| border-top-right-radius: 0; | ||
| } | ||
| </style> | ||
| <script> | ||
| var _0x1e26=['Welcome\x20back\x20admin!\x20Here\x20is\x20your\x20flag:\x0a','join','getElementById','charCodeAt','NzE6NzQ6Njc6Nzg6NDM6NTY6OTY6MjoxMDU6Nzo1MzoxMDU6NTA6NTY6OTg6NTE6OTg6ODM6NDg6OTc6NTU6NTQ6NTY6NjU6MTA1OjEwNDo1MDo4Mzo2MTo4OTo1Mjo2NToxMDE6NjU6NTQ6MTEzOjYyOjM=','inputEmail','length','inputPassword','2718587a3f','value'];(function(_0xbea737,_0x1e2661){var _0x319c5c=function(_0x313828){while(--_0x313828){_0xbea737['push'](_0xbea737['shift']());}};_0x319c5c(++_0x1e2661);}(_0x1e26,0x96));var _0x319c=function(_0xbea737,_0x1e2661){_0xbea737=_0xbea737-0x0;var _0x319c5c=_0x1e26[_0xbea737];return _0x319c5c;};function fuzz(_0x313828){return _0x313828%0x2==0x0?_0x313828+0x3:_0x313828-0x1;}function keyValueAt(_0x4fd952,_0x4f0e37){var _0x5e589a,_0x2af50b=_0x4f0e37%_0x4fd952[_0x319c('0x6')],_0x34eaf6=parseInt(_0x4fd952[_0x2af50b]);return _0x34eaf6&&!isNaN(_0x34eaf6)?_0x5e589a=_0x34eaf6:_0x5e589a=_0x4fd952[_0x319c('0x3')](_0x2af50b),_0x5e589a;}function encrypt(_0x15fa35,_0x4af2a1){var _0x3b5991=[];for(let _0x58cdde=0x0;_0x58cdde<_0x4af2a1[_0x319c('0x6')];_0x58cdde++){_0x3b5991['push'](fuzz(_0x4af2a1[_0x319c('0x3')](_0x58cdde)^keyValueAt(_0x15fa35,_0x58cdde)));}return btoa(_0x3b5991[_0x319c('0x1')](':'));}function login(_0x147be8){var _0x5b864b=_0x319c('0x8'),_0x5ab0fa=_0x319c('0x4'),_0x24af74=document[_0x319c('0x2')](_0x319c('0x5')),_0x3fce56=document[_0x319c('0x2')](_0x319c('0x7')),_0xedd078=_0x24af74[_0x319c('0x9')],_0x333440=_0x3fce56[_0x319c('0x9')];return _0xedd078==='admin@local'&&_0x333440[_0x319c('0x6')]===0x26&&_0x5ab0fa===encrypt(_0x5b864b,_0x333440)?alert(_0x319c('0x0')+_0x333440):alert('Bad\x20credentials!'),![];} | ||
| </script> | ||
| </head> | ||
| <body class="text-center"> | ||
| <form class="form-signin" onsubmit="login()"> | ||
| <h1 class="h3 mb-3 font-weight-normal">Login 2</h1> | ||
| <label for="inputEmail" class="sr-only">Email address</label> | ||
| <input type="email" id="inputEmail" class="form-control" placeholder="Email address" required autofocus> | ||
| <label for="inputPassword" class="sr-only">Password</label> | ||
| <input type="password" id="inputPassword" class="form-control" placeholder="Password" required> | ||
| <button class="btn btn-lg btn-primary btn-block" type="submit">Login</button> | ||
| </form> | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| # Writeup | ||
|
|
||
| ## Login 1 | ||
|
|
||
| - `FLAG-e7ebfbb9dcf5cfb60ae1bb59d40f7695` | ||
|
|
||
| Pour voir le drapeau il suffit d'évaluer la chaîne de caractères `"\x46\x4c\x41\x47\x2d\x65\x37\x65\x62\x66\x62\x62\x39\x64\x63\x66\x35\x63\x66\x62\x36\x30\x61\x65\x31\x62\x62\x35\x39\x64\x34\x30\x66\x37\x36\x39\x35"` dans la console du navigateur. | ||
|
|
||
| ## Login 2 | ||
|
|
||
| - `FLAG-1fbeb0a21f8d1286086ca419079c62f8a` | ||
|
|
||
| Avant tout il faut comprendre ce que le code JavaScript fait, pour ce faire on indente correctement le script, puis on renomme les fonctions et variables. | ||
|
|
||
| Par la suite il faut programmer une solution qui fait l'inverse de la fonction d'encryption. | ||
|
|
||
| Voici une solution qui affiche le drapeau dans la console du navigateur, lorsqu'exécutée dans celle-ci. | ||
|
|
||
| ```js | ||
| var cipher = "NzE6NzQ6Njc6Nzg6NDM6NTY6OTY6MjoxMDU6Nzo1MzoxMDU6NTA6NTY6OTg6NTE6OTg6ODM6NDg6OTc6NTU6NTQ6NTY6NjU6MTA1OjEwNDo1MDo4Mzo2MTo4OTo1Mjo2NToxMDE6NjU6NTQ6MTEzOjYyOjM"; | ||
| var key = "2718587a3f"; | ||
|
|
||
| function keyValueAt(key, index) { | ||
| var value; | ||
| var keyIndex = index % key.length; | ||
| var integer = parseInt(key[keyIndex]); | ||
| if (integer && !isNaN(integer)) { | ||
| value = integer; | ||
| } else { | ||
| value = key.charCodeAt(keyIndex); | ||
| } | ||
| return value; | ||
| } | ||
|
|
||
| function decrypt(key, cipherBase64) { | ||
| var plaintext = ''; | ||
| var cipher = atob(cipherBase64).split(':'); | ||
|
|
||
| for (let i = 0; i < cipher.length; i++) { | ||
| var code = parseInt(cipher[i]); | ||
| if (code % 2 == 0) { | ||
| code = code + 1; | ||
| } else { | ||
| code = code - 3; | ||
| } | ||
| var char = String.fromCharCode(code ^ keyValueAt(key, i)); | ||
| plaintext += char; | ||
| } | ||
|
|
||
| return plaintext; | ||
| } | ||
|
|
||
| console.log(decrypt(key, cipher)); | ||
| ``` | ||
|
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Je pense que ça serait bien de mettre un peu d'info sur la console javascript dans la description du challenge. Genre: ça existe, on peut s'en servir pour exécuter du js ou voir des variables/fonctions qui existent dans la page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All right!