---
# System prepended metadata

title: ECOWAS CTF(Hackerlab) Pre-Qual 2022

---

# ECOWAS CTF(Hackerlab) Pre-Qual 2022

## Ecowas Portal challenge

```python
Is my program secure?
Flag: CTF_*
```
We’re given a binary, let's run it
```python
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/Ecowas]
└─$ ./ecowas_portal                           
ECOWAS ADMIN PORTAL : 
test
Flag wrong. Try again.  
```
Strings won’t help us.
I like using gdb for static analysis. Let’s look at main.

```py=
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/Ecowas]
└─$ gdb -q ecowas_portal
Reading symbols from ecowas_portal...
(No debugging symbols found in ecowas_portal)
(gdb) run
Starting program: /home/kali/CTFs/HackerlabCTF/Basic/Ecowas/ecowas_portal 
ECOWAS ADMIN PORTAL : 
test
Flag wrong. Try again.[Inferior 1 (process 19161) exited with code 01]
(gdb) disass main
Dump of assembler code for function main:
   0x000055555555517e <+0>:     push   rbp
   0x000055555555517f <+1>:     mov    rbp,rsp
   0x0000555555555182 <+4>:     push   rbx
   0x0000555555555183 <+5>:     sub    rsp,0x118
   0x000055555555518a <+12>:    lea    rax,[rip+0xe73]        # 0x555555556004
   0x0000555555555191 <+19>:    mov    rdi,rax
   0x0000555555555194 <+22>:    call   0x555555555030 <puts@plt>
   0x0000555555555199 <+27>:    mov    DWORD PTR [rbp-0x120],0x2f
   0x00005555555551a3 <+37>:    mov    DWORD PTR [rbp-0x11c],0x41
   0x00005555555551ad <+47>:    mov    DWORD PTR [rbp-0x118],0x30
   0x00005555555551b7 <+57>:    mov    DWORD PTR [rbp-0x114],0x48
   0x00005555555551c1 <+67>:    mov    DWORD PTR [rbp-0x110],0x4a
   0x00005555555551cb <+77>:    mov    DWORD PTR [rbp-0x10c],0x25
   0x00005555555551d5 <+87>:    mov    DWORD PTR [rbp-0x108],0x27
   0x00005555555551df <+97>:    mov    DWORD PTR [rbp-0x104],0x1a
   0x00005555555551e9 <+107>:   mov    DWORD PTR [rbp-0x100],0x27
   0x00005555555551f3 <+117>:   mov    DWORD PTR [rbp-0xfc],0x57
   0x00005555555551fd <+127>:   mov    DWORD PTR [rbp-0xf8],0x15
   0x0000555555555207 <+137>:   mov    DWORD PTR [rbp-0xf4],0x49
   0x0000555555555211 <+147>:   mov    DWORD PTR [rbp-0xf0],0x10
   0x000055555555521b <+157>:   mov    DWORD PTR [rbp-0xec],0x2d
   0x0000555555555225 <+167>:   mov    DWORD PTR [rbp-0xe8],0x11
   0x000055555555522f <+177>:   mov    DWORD PTR [rbp-0xe4],0x2b
   0x0000555555555239 <+187>:   mov    DWORD PTR [rbp-0xe0],0xc
   0x0000555555555243 <+197>:   mov    DWORD PTR [rbp-0xdc],0xe
   0x000055555555524d <+207>:   mov    DWORD PTR [rbp-0xd8],0xc
   0x0000555555555257 <+217>:   mov    DWORD PTR [rbp-0xd4],0x37
   0x0000555555555261 <+227>:   mov    DWORD PTR [rbp-0xd0],0xb
   0x000055555555526b <+237>:   mov    DWORD PTR [rbp-0xcc],0xb
--Type <RET> for more, q to quit, c to continue without paging--
   0x0000555555555275 <+247>:   mov    DWORD PTR [rbp-0xc8],0xa
   0x000055555555527f <+257>:   mov    DWORD PTR [rbp-0xc4],0xa
   0x0000555555555289 <+267>:   mov    DWORD PTR [rbp-0xc0],0x6
   0x0000555555555293 <+277>:   mov    QWORD PTR [rbp-0x20],0x19
   0x000055555555529b <+285>:   mov    rdx,QWORD PTR [rip+0x2d8e]        # 0x555555558030 <stdin@GLIBC_2.2.5>
   0x00005555555552a2 <+292>:   lea    rax,[rbp-0xb0]
   0x00005555555552a9 <+299>:   mov    esi,0x80
   0x00005555555552ae <+304>:   mov    rdi,rax
   0x00005555555552b1 <+307>:   call   0x555555555060 <fgets@plt>
   0x00005555555552b6 <+312>:   lea    rax,[rbp-0xb0]

```

At this point the program initializes a bunch of local variables and print `ECOWAS ADMIN PORTAL :` and wait for our input.
Then compare the length of our input with the value 25 at `[rbp-0x20]` and display `Flag wrong. try again` if the length is not `0x19`, 25 in `decimal`

```py!
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/Ecowas]
└─$ ./ecowas_portal                           
ECOWAS ADMIN PORTAL : 
test
Flag wrong. Try again. 
```

If the lenght is 25 the program and the flag is wrong the program display `Check failed`

```py=
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/Ecowas]
└─$./ecowas_portal                                                                                                      ECOWAS ADMIN PORTAL : 
AAAAAAAAAAAAAAAAAAAAAAAAA        
Check failed   
```
Let's find out what this check is

We know that our flag starts with `CTF_`, let's do some test in `gdb` with `CTF_AAAAAAAAAAAAAAAAAAAAA`.
we will go through our program instruction by instruction and understand how it works.

Let's execute the program in gdb with a `breakpoint` on `main` and browse the flow with the instruction `ni`, shortcut for `next instruction`. When the program asks for it, we put our crafted flag.

```py
(gdb) 
0x00005555555552b1 in main ()
(gdb) 
CTF_AAAAAAAAAAAAAAAAAAAAA
0x00005555555552b6 in main ()
(gdb) 

```
Let's continue with our next instruction command
At this point the program subtracts `1` from the value of rax(the result of the strlen() function), compares rax to rbx `0` then jump if below. it is clearly a loop that will iterate until 25 (the length of our flag)

```py
(gdb) info registers 
rax            0x1a                26
rbx            0x0                 0
rcx            0x0                 0
rdx            0xfffbfefefc000000  -1127003780546560
rsi            0x5555555596b1      93824992253617
rdi            0x7fffffffde30      140737488346672
rbp            0x7fffffffdee0      0x7fffffffdee0
rsp            0x7fffffffddc0      0x7fffffffddc0
r8             0xfefe              65278
r9             0x7ffff7fa1c00      140737353751552
r10            0xfffffffffffffb87  -1145
r11            0x7ffff7e70d80      140737352502656
r12            0x555555555080      93824992235648
r13            0x0                 0
r14            0x0                 0
r15            0x0                 0
rip            0x555555555361      0x555555555361 <main+483>
eflags         0x202               [ IF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0
(gdb) x/3i $rip
=> 0x555555555361 <main+483>:   sub    rax,0x1
   0x555555555365 <main+487>:   cmp    rbx,rax
   0x555555555368 <main+490>:   jb     0x5555555552f6 <main+376>
(gdb) 

```
Let's continue with our next instruction command.
then the program calls an `encrypt` function to which it passes two parameters `esi` and `edi`

```py
0x0000555555555312 <+404>:   movsx  eax,al
0x0000555555555315 <+407>:   mov    edx,DWORD PTR [rbp-0x14]
0x0000555555555318 <+410>:   mov    esi,edx
0x000055555555531a <+412>:   mov    edi,eax
0x000055555555531c <+414>:   call   0x555555555169 <encrypt>
0x0000555555555321 <+419>:   mov    BYTE PTR [rbp-0x22],al
0x0000555555555324 <+422>:   movzx  eax,BYTE PTR [rbp-0x22]
0x0000555555555328 <+426>:   cmp    al,BYTE PTR [rbp-0x21]
0x000055555555532b <+429>:   je     0x555555555348 <main+458>

```
let's look at these parameters.

```py
(gdb) p $esi
$5 = 0
(gdb) p $edi
$6 = 67
(gdb) x/2i $rip
=> 0x55555555531c <main+414>:   call   0x555555555169 <encrypt>
   0x555555555321 <main+419>:   mov    BYTE PTR [rbp-0x22],al
(gdb) 

```

```py
└─$ python               
>>> chr(67)
'C'
>>> 
```
The program passes `$edi=67` and `$esi=0` to the encrypt function. Let's take a closer look at this function.

The function encrypt subtracts `0x14`, 20 in decimal from the value of `edi` and `xor` the result with the value of `esi`
```py
(gdb) disass encrypt
Dump of assembler code for function encrypt:
   0x0000555555555169 <+0>:     push   rbp
   0x000055555555516a <+1>:     mov    rbp,rsp
   0x000055555555516d <+4>:     mov    DWORD PTR [rbp-0x4],edi
   0x0000555555555170 <+7>:     mov    DWORD PTR [rbp-0x8],esi
   0x0000555555555173 <+10>:    mov    eax,DWORD PTR [rbp-0x4]
   0x0000555555555176 <+13>:    sub    eax,0x14
   0x0000555555555179 <+16>:    xor    eax,DWORD PTR [rbp-0x8]
   0x000055555555517c <+19>:    pop    rbp
   0x000055555555517d <+20>:    ret    
End of assembler dump.

```
Let's take a closer look at what happens after the encrypt function is executed.
The return value of the encrypt function is stored in the `$rax` register, a byte (value at `al` register) of this value is copied to the memory address `[rbp-0x22]` and is compared to a byte of the value at the memory address `[rbp-0x21]`. if the values are equal then the program flow continues otherwise we get the message `check failed`.

```py
0x000055555555531c <+414>:   call   0x555555555169 <encrypt>
0x0000555555555321 <+419>:   mov    BYTE PTR [rbp-0x22],al
0x0000555555555324 <+422>:   movzx  eax,BYTE PTR [rbp-0x22]
0x0000555555555328 <+426>:   cmp    al,BYTE PTR [rbp-0x21]
0x000055555555532b <+429>:   je     0x555555555348 <main+458>
```
At this stage the values are equal and our program can continue its execution.
```py
(gdb) p/x $al
$12 = 0x2f

(gdb) x/b $rbp-0x21
0x7fffffffdebf: 0x2f
```

Let's start again from the beginning but this time with breakpoints
Let's place the first breakpoint at the input of the encrypt function and the second break before the jump if equal at the exit of the encrypt function.

let's launch the execution of our program with our crafted flag and at each loop let's eximinate the values of the `esi` and `edi` registers at the first break, then the values of the `al` register and the memory address `[rbp-0x21]` at the second break 

```py
(gdb) break *0x000055555555531c
Breakpoint 3 at 0x55555555531c
(gdb) break *0x000055555555532b
Breakpoint 4 at 0x55555555532b
(gdb) run
Starting program: /home/kali/CTFs/HackerlabCTF/Basic/Ecowas/ecowas_portal 
ECOWAS ADMIN PORTAL : 
CTF_AAAAAAAAAAAAAAAAAAAAA

gdb) c
Continuing.
Breakpoint 3, 0x000055555555531c in main ()
(gdb) p $esi
$2 = 0
(gdb) p $edi
$3 = 67
(gdb) c
Continuing.

Breakpoint 4, 0x000055555555532b in main ()
(gdb) x/b $rbp-0x21
0x7fffffffdebf: 0x2f
(gdb) p/x $al
$4 = 0x2f
(gdb) c
Continuing.

Breakpoint 3, 0x000055555555531c in main ()
(gdb) p $esi
$5 = 1
(gdb) p $edi
$6 = 84
(gdb) c
Continuing.

Breakpoint 4, 0x000055555555532b in main ()
(gdb) x/b $rbp-0x21
0x7fffffffdebf: 0x41
(gdb) p/x $al
$7 = 0x41
(gdb) c
Continuing.

Breakpoint 3, 0x000055555555531c in main ()
(gdb) p $esi
$8 = 2
(gdb) p $edi
$9 = 70
(gdb) c
Continuing.

Breakpoint 4, 0x000055555555532b in main ()
(gdb) p/x $al
$10 = 0x30
(gdb) x/b $rbp-0x21
0x7fffffffdebf: 0x30

Breakpoint 3, 0x000055555555531c in main ()
(gdb) p $esi
$11 = 3
(gdb) p $edi
$12 = 95
(gdb) c
Continuing.

Breakpoint 4, 0x000055555555532b in main ()
(gdb) p/x $al
$13 = 0x48
(gdb) x/b $rbp-0x21
0x7fffffffdebf: 0x48
(gdb) 


```
Have you noticed anything?
Yes, that's exactly it. At each iteration, one character of our flag and the loop counter are passed to the encrypt function. 
It's not over yet.
Look at the values in the al register and the bunch of variables I mentioned at the beginning.
Yes, the byte of the value at memory address [rbp-0x21] to which the value of the al register is compared at each iteration is indeed one of these values.
```py
└─$ python 
>>>
>>> chr(67)
'C'
>>> chr(84)
'T'
>>> chr(70)
'F'
>>> chr(95)
'_'
>>> 
```

let's summarize

The program declares and initializes a bunch of variables, then it asks for a user input `(the 25 characters flag)`, then it passes character by character the flag to a function `encrypt` which `subtracts 0x14` from each character of the flag and `xor` the result with the `counter value of the loop`. The result of this function is then compared in turn to the variables previously initialized by the program. If there is a match the program continues to the second character otherwise the program stops with the message `check failed`.


Now that we know how the program works, we can reverse it. 
I have written a python program to do this.

I converted to decimal the first 25 variables that our program initializes that I stored in a list then I browse the list by doing the reverse of what the encrypt function does.

```py
#!/usr/bin/env python3
from pwn import xor

variables = [47,65,48,72,74,37,39,26,39,87,21,73,16,45,17,43,12,14,12,55,11,11,10,10,6]
flag=''

for i in range(len(variables)):
   flag=flag+chr(ord(xor(variables[i],i))+20)
   i = i+1
print(flag)
```
```py
└─$ python reverse.py       
CTF_b451Cr3V0438032832012

```
Done!!!

## Exfiltration Challenge

The first 300pts challenge...

```
Exfiltration

MEDIUM FORENSIC

A conversation between two terrorist groups has been intercepted. It is possible that very sensitive data was transmitted during the communication.

Flag : CTF_*
```
we were given a pcap file. Let's open it with Wireshark to see the content.

A ton of DNS requests.

A while ago I was watching a replay of a DEF CON presentation (the most famous hacker convention in the world) where the presenter was talking about this technique that allows to exfiltrate data through DNS requests. You have to know that in a network, the least monitored flow is the DNS flow, what an ingenious idea to steal a company's data under the nose of the engineers and their firewall army.

Let's start by looking at the statistics of all this stream. The pcap file is divided into 2 types of dns requests (A and CNAME). Take a look at this site [iana.org](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml)
 or on the internet to see more about the types of dns requests and their value.

```py
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ tshark -r capture.pcap -qz dns,tree                                                                                                 

======================================================================================================================================================
DNS:
Topic / Item                           Count         Average       Min Val       Max Val       Rate (ms)     Percent       Burst Rate    Burst Start  
------------------------------------------------------------------------------------------------------------------------
--snip--

 Query Type                            1550                                                    0.0141        100.00%       0.0400        12.539       
  CNAME (Canonical NAME for an alias)  1172                                                    0.0106        75.61%        0.0200        12.284       
  A (Host Address)                     378                                                     0.0034        24.39%        0.0200        0.000        
 Class                                 1550                                                    0.0141        100.00%       0.0400        12.539    

 --snip--

```
Let's get the data we are interested in. Tshark the command line version of wireshark does a good job. The first time I didn't notice, but as you can see there are duplicates. We will filter the type A and CNAME queries in different files

```py
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/Exfiltration]
└─$ tshark -r capture.pcap -Y "dns.qry.type==1" -T fields -e dns.qry.name
89504e470d0a1a0a0000000d49484452000002f5000001cb0802000000c7b8f.hackerlab.africa
89504e470d0a1a0a0000000d49484452000002f5000001cb0802000000c7b8f.hackerlab.africa
09a000000017352474200aece1ce90000000467414d410000b18f0bfc610500.hackerlab.africa
09a000000017352474200aece1ce90000000467414d410000b18f0bfc610500.hackerlab.africa
0000097048597300000ec300000ec301c76fa86400000013744558744175746.hackerlab.africa
0000097048597300000ec300000ec301c76fa86400000013744558744175746.hackerlab.africa
86f7200636861726c696570792d504307794fa4000016ad49444154785eeddd.hackerlab.africa
86f7200636861726c696570792d504307794fa4000016ad49444154785eeddd.hackerlab.africa
db61db3a1605d0a9cb05a51e5793665c4c86d42337b2240220018ada5eeb6b2.hackerlab.africa
db61db3a1605d0a9cb05a51e5793665c4c86d42337b2240220018ada5eeb6b2.hackerlab.africa
6d702403c0eb61c47fedf1f00802cf20d009046be0100d2c83700401af90600.hackerlab.africa
6d702403c0eb61c47fedf1f00802cf20d009046be0100d2c83700401af90600.hackerlab.africa
4823df000069e41b00208d7c0300a4916f008034f20d009046be0100d2c8370.hackerlab.africa
4823df000069e41b00208d7c0300a4916f008034f20d009046be0100d2c8370.hackerlab.africa
0401af906004823df000069e41b00208d7c0300a4916f008034f20d009046be.hackerlab.africa
--snip--
```
#### A records

the A requests have been used to send an image. On the image file it says `ROCKYOU ft. l33t`

```py
──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ tshark -r capture.pcap -Y "dns.qry.type==1" -T fields -e dns.qry.name | cut -d "." -f1 | uniq|xxd -r -p > file1                                      
                                                                                                                                                              
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ file file1                  
file1: PNG image data, 757 x 459, 8-bit/color RGB, non-interlaced

```
#### CNAME records

The CNAME requests have been used to send a Zip file. 

```py
──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ tshark -r capture.pcap -Y "dns.qry.type==5" -T fields -e dns.qry.name | cut -d "." -f1 | uniq|xxd -r -p > file2
                                                                                                                                                              
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ file file2
file2: Zip archive data, at least v2.0 to extract

```
On this one, the author of the challenge made us a big joke. We have to go through several layers of archive before we get to the file we are interested in. Can you imagine all those letters of the alphabet are actually archival extensions. Unkind isn't it?

```py
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Stages/Exfiltration]
└─$ unzip file2   
Archive:  file2
  inflating: flag.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w 
```
As usual, I wrote my own little script to get the job done. I wasn't going to do all that work again. I admit I could have done better. But anyway, it does the job.

```py

┌──(kali㉿kali)-[~/…/HackerlabCTF/Stages/Exfiltration]
└─$ cat script.sh                     

unzip_all(){
        FILE=$(ls | head -n1)
        if file $FILE | grep "Zip archive data"; then
                unzip $FILE
            unzip_all

        elif file $FILE | grep "XZ compressed data"; then
                ZIPFILE=$(mv "$FILE" "${FILE%.*}.xz")
                xz -d *.xz
                unzip_all

        elif file $FILE | grep "bzip2 compressed data"; then
                bunzip2 $FILE
                unzip_all

        elif file $FILE | grep "gzip compressed data"; then
                ZIPFILE=$(mv "$FILE" "${FILE%.*}.gz")
                gunzip  *.gz
                unzip_all
        fi
}
unzip_all

```
at the end of my script I am asked to enter a password. The image was about rockyou ft l33t. I'll have to do some bruteforce.

#### zip2john.py

I first rename the archive I got into something easier to handle. Then with `zip2john` I can extract the hash and crack it with the all powerful `john`

```py
┌──(kali㉿kali)-[~/…/HackerlabCTF/Stages/Exfiltration]
└─$ /usr/sbin/zip2john flag.zip > hash
```
The clue `l33t` which could have been written `leet` tells us that we will have to make transformations on the Rockyou dictionary to find the password. I tried to find the right rule file but without success. So let's make it simple.

```py
┌──(kali㉿kali)-[~/…/HackerlabCTF/Stages/Exfiltration]
└─$ john hash                                            
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
Proceeding with incremental:ASCII
3c0w45           (flag.zip/flag.txt)
1g 0:00:08:36 DONE 3/3 (2022-09-04 09:41) 0.001936g/s 5373Kp/s 5373Kc/s 5373KC/s 3c0gbi..3c0igd
Use the "--show" option to display all of the cracked passwords reliably
Session completed

```
When we unzip the last archive we get a file `flag.txt` which contains a QR code that we will have to read and get the flag.

```py
┌──(kali㉿kali)-[~/…/HackerlabCTF/Stages/Exfiltration]
└─$ cat flag.txt                      
                                                                                  
                                                                                  
                                                                                  
                                                                                  
        ##############  ##      ##  ######  ##  ####  ##    ##############        
        ##          ##  ##  ######            ####          ##          ##        
        ##  ######  ##  ##  ##  ##  ####          ########  ##  ######  ##        
        ##  ######  ##    ########  ##  ####    ######  ##  ##  ######  ##        
        ##  ######  ##    ##  ######        ##  ####        ##  ######  ##        
        ##          ##  ##      ##    ######  ####    ####  ##          ##        
        ##############  ##  ##  ##  ##  ##  ##  ##  ##  ##  ##############        
                        ####  ######  ##      ##  ######                          
            ######  ##  ##  ####  ####  ####  ##  ######  ######    ######        
        ##      ##            ##  ########      ######    ##        ##            
                ########    ####  ##  ##  ##########    ##########    ##          
            ##        ####  ####  ##  ####    ##  ############      ##            
          ####  ##  ####      ####  ########      ##    ####      ##              
        ##  ########  ####  ##  ######      ##      ##      ####  ##              
        ##      ##  ##  ##  ####      ######      ####  ##          ####          
        ##  ##        ##########    ##########  ####          ##    ##            
                ##  ##  ##  ##    ####      ####    ##              ####          
        ####  ####    ##########  ##    ##  ######    ##########    ##            
        ##  ##  ########  ##      ##        ####          ####  ####  ####        
          ##  ##      ##########        ##  ##  ########    ##  ######            
              ##    ##  ##  ########    ##  ##    ####    ####    ########        
        ##        ##  ####  ##  ##  ####  ##    ####    ##        ##  ##          
        ##  ##  ######      ##  ##    ##  ####      ##    ####    ######          
        ##    ######      ####    ##    ##    ##  ####  ######    ######          
        ##  ##  ##  ##      ########  ##      ##        ##########    ##          
                        ############  ######  ####  ######      ##########        
        ##############    ########    ####    ####  ##  ##  ##  ######            
        ##          ##                      ##        ####      ##########        
        ##  ######  ##  ####  ####  ########  ##  ####  ##############            
        ##  ######  ##  ##  ####  ##    ##    ##  ##  ######  ##  ##  ##          
        ##  ######  ##  ######      ########    ##      ####                      
        ##          ##    ######        ##    ##  ##  ##    ####  ##              
        ##############    ##    ####  ########      ##  ##          ####          
                                                                                  

```
And voila!

`CTF_W3lc0Me_h4CKER5_338333371819`

Done!!!


## JSFuck challenge

```
JSFuck

EASY WEB JS
Check the hackerlab website https://hackerlab.africa/

Flag : CTF_*

```
Another site to visit

At first sight there is nothing like a flag on the site, maybe in the source code?
Let's take a closer look.

In the source code also nothing, the attached files then? JSFuck sounds more javascript. Let's look at the javascript files of the site. 
A file with a rather unreadable content draws the attention, probably an encoding.

```
[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]

--snip--
```

since I don't even know what encoding it is I got 2 options 
*option 1 [Cyberchef](https://gchq.github.io/CyberChef/) and option 2 [decode](https://www.dcode.fr/identification-chiffrement)*. This time I choose option 2, and since the content is quite large I copy a part that I try to identify..Bingo!!! decode says it's JSFuck.

Here we are. This is a javascript code. How to run it? 
My approach, although a bit long, i create a `.js file`, log the result of the code in a console with `console.log()` and also create an html code in which I call my javascript file and the browser does the rest.

```
cipher = [67, 85, 68, 92, 55, 49, 51, 94, 90, 56, 109, 99, 59, 50, 63, 61, 35, 37] var f = "" function xor_xor(x,y){ return x ^ y; } for (var i=0; i < cipher.length ; i++){ f+= xor_xor(cipher[i] ^ i); }
```
When we run the code we get a sequence of numbers,

`67847095515253898249103104556349505152`

A quick look at [decode](https://www.dcode.fr/identification-chiffrement) and it tells us that there is a chance that it has something to do with ascii. it proposes to decode it for us.

And bingo!!!!

`CTF_345YR1gh7?1234`

Done!!!

## Secret PDF Challenge

```
Secret PDF

EASY BRUTEFORCE
Can you open it?

Flag : CTF_*
```

For this challenge we are given a pdf document that we have to read. Easy, just open it and read the flag?? Gift points.

Let's open our file to get the flag and validate our gift points. 

```
 ┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/pdf]
 └─$ evince secret.pdf  
```

Ooh We need a password to read the content of our document. I knew that they weren't the gift-giving type. 
I know a nice tool from the john suite that can help us.

### pdf2john.py or pdf2john.pl

Basically the tool extracts the hash inside the encrypted pdf that we can crack with the almighty `john`.

```
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/pdf]
└─$ ./pdf2john secret.pdf > hash 
                                                                                                                                                              
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/pdf]
└─$ cat hash 
secret.pdf:$pdf$4*4*128*-1060*1*16*15c0aee17f397540bdec4edb020a2247*32*447e5ab472a0d9557b9f8664bb73c00900000000000000000000000000000000*32*cc34bdea75a5d9ac0346d4a2adcb39ac72d8aeb6dc275e4b187fb19d3cdd2cf1:::::secret.pdf                                                                                                                             
```
it should be noted that with python3 you will have rather this. 

```
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/pdf]
└─$ python pdf2john secret.pdf                                         
b'secret.pdf':b'$pdf$4*4*128*-1060*1*16*15c0aee17f397540bdec4edb020a2247*32*447e5ab472a0d9557b9f8664bb73c00900000000000000000000000000000000*32*cc34bdea75a5d9ac0346d4a2adcb39ac72d8aeb6dc275e4b187fb19d3cdd2cf1':::::b'secret.pdf'

```
 which does not work as expected.

 Let's crack it quietly with john. And bingo!!! we have the password. The flag is waiting for us.

```
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/pdf]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
Cost 1 (revision) is 4 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
MyP@ssw0rd!      (secret.pdf)
1g 0:00:03:42 DONE (2022-09-02 08:39) 0.004485g/s 48484p/s 48484c/s 48484C/s MyPassword6..MyMayra1!
Use the "--show --format=PDF" options to display all of the cracked passwords reliably
Session completed

```

Oh no! at first sight the document is empty. what if we select the whole document? Oh well, there is a sequence of numbers at the bottom. It looks like something I know well.

A quick look at [decode](https://www.dcode.fr/identification-chiffrement) and it tells us that there is a chance that it has something to do with ascii. 

And voila!!!

`CTF_QRC0D3T0OCT4L?!!`

Done!!

## Youtube challenge

```
Youtube

EASY BITS
Check the announcement video of the hackerlab https://www.youtube.com/watch?v=77yjGguVM0U

Flag : CTF_*

```
once on the youtube channel and at the bottom of the video description we can see a binary sequence.
First reflex, a decoding tool, personally I use [asciitohex](https://www.asciitohex.com/) when I already know the encoding.

```
00100001 00100001 00100001 00110010 00110011 00110110 00110001 00110001 00110010 00110110 00110010 00110111 01101001 01110100 00110000 01000111 00110001 01011111 01000110 01010100 01000011
```
the result we get is not directly the flag. it is upside down

```
!!!236112627it0G1_FTC
```
a very nice little tool from kali and it's all done!!!

```
┌──(kali㉿kali)-[~/CTFs/HackerlabCTF/Basic/youtube]
└─$ echo '!!!236112627it0G1_FTC' | rev
CTF_1G0ti726211632!!!         
```
Done!!!
