diff --git a/.DS_Store b/.DS_Store index 098777e..bf18c97 100644 Binary files a/.DS_Store and b/.DS_Store differ diff --git a/.gitignore b/.gitignore index bc51b40..c7ef092 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,14 @@ htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/challenge/ + +insomnihack24/mobile/.venv/ + +insomnihack24/mobile/Notes/ + +insomnihack24/mobile/CryptoTest/.idea/ + +insomnihack24/mobile/CryptoTest/out/ + +insomnihack24/misc/puzzled/solutions/ + +insomnihack24/misc/puzzled/pieces/ diff --git a/insomnihack24/.DS_Store b/insomnihack24/.DS_Store new file mode 100644 index 0000000..e28663e Binary files /dev/null and b/insomnihack24/.DS_Store differ diff --git a/insomnihack24/misc/puzzled/.gitignore b/insomnihack24/misc/puzzled/.gitignore new file mode 100644 index 0000000..21d0b89 --- /dev/null +++ b/insomnihack24/misc/puzzled/.gitignore @@ -0,0 +1 @@ +.venv/ diff --git a/insomnihack24/misc/puzzled/output.txt b/insomnihack24/misc/puzzled/output.txt new file mode 100644 index 0000000..db7a44b --- /dev/null +++ b/insomnihack24/misc/puzzled/output.txt @@ -0,0 +1,28 @@ +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE +Data: Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. INS{Im-puzzl3d-6c2bd4d3-e739-4f8d-b8cd-6bd663bde735} Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. +Type: QRCODE diff --git a/insomnihack24/misc/puzzled/puzzled.py b/insomnihack24/misc/puzzled/puzzled.py new file mode 100644 index 0000000..5e7b277 --- /dev/null +++ b/insomnihack24/misc/puzzled/puzzled.py @@ -0,0 +1,126 @@ +from PIL import Image +import random +import itertools +from pyzbar.pyzbar import decode + + +def cutPieces(image_path, output_name_scheme): + # Open the image + original_image = Image.open(image_path) + + # Get the size of the image + width, height = original_image.size + assert (width == height) + + # Calculate the size of each grid cell + cell_width = width // 3 + cell_height = height // 3 + + # Split the original image into 9 pieces + for i in range(16): + # Calculate the coordinates of the current grid cell + x1 = (i % 3) * cell_width + y1 = (i // 3) * cell_height + x2 = x1 + cell_width + y2 = y1 + cell_height + + # Crop the corresponding part of the original image + cropped_piece = original_image.crop((x1, y1, x2, y2)) + + # Save the cropped piece + output_path = output_name_scheme.format(i) + cropped_piece.save(output_path) + + +def generateQRCodes(topLeft, topRight, bottomLeft, pieces): + # Create a new image to store rearranged pieces + new_image = Image.new("RGB", (234, 234)) + + # Paste the QR codes onto the new image + new_image.paste(topLeft, (0, 0)) + new_image.paste(topRight, (156, 0)) + new_image.paste(bottomLeft, (0, 156)) + + print(pieces) + + possible_combos = itertools.permutations(pieces, 6) + + i = 0 + for a, b, c, d, e, f in possible_combos: + # Paste the remaining pieces onto the new image + new_image.paste(Image.open(a), (78, 0)) + new_image.paste(Image.open(b), (156, 78)) + new_image.paste(Image.open(c), (0, 78)) + new_image.paste(Image.open(d), (78, 78)) + new_image.paste(Image.open(e), (156, 156)) + new_image.paste(Image.open(f), (78, 156)) + + # Save the rearranged image + new_image.save(f"solutions/possible_qr{i}.png") + i += 1 + + +def decodeQRCode(image_path): + image = Image.open(image_path) + + # Decode the QR code + decoded_objects = decode(image) + + # Check if any QR code was found + if decoded_objects: + # Iterate through all the detected QR codes and print their data + for obj in decoded_objects: + print("Data:", obj.data.decode('utf-8')) + print("Type:", obj.type) + + +def shuffle3x3GridImage(image_path, output_path): + # Open the image + original_image = Image.open(image_path) + + # Get the size of the image + width, height = original_image.size + assert (width == 234 and height == 234) + + # Calculate the size of each grid cell + cell_width = width // 3 + cell_height = height // 3 + + # Create a new image to store rearranged pieces + new_image = Image.new("RGB", (width, height)) + + # Create a list to store shuffled grid positions + positions = [(x, y) for x in range(3) for y in range(3)] + random.shuffle(positions) + + # Split the original image into 16 pieces and rearrange them + for i, pos in enumerate(positions): + # Calculate the coordinates of the current grid cell + x1 = pos[0] * cell_width + y1 = pos[1] * cell_height + x2 = x1 + cell_width + y2 = y1 + cell_height + + # Crop the corresponding part of the original image + cropped_piece = original_image.crop((x1, y1, x2, y2)) + + # Calculate the coordinates to paste the cropped piece + new_x = (i % 3) * cell_width + new_y = (i // 3) * cell_height + + # Paste the cropped piece onto the new image + new_image.paste(cropped_piece, (new_x, new_y)) + + # Save the rearranged image + new_image.save(output_path) + + +# key = "Not the real key!" +# random.seed(key) +# shuffle3x3GridImage("fullVersion25QRcode.png", "puzzledVersion25QRcode.png") + +# cutPieces("puzzledVersion25QRcode.png", "puzzledVersion25QRcode_piece{}.png") + +paths = [f"solutions/possible_qr{i}.png" for i in range(720)] +for path in paths: + decodeQRCode(path) diff --git a/insomnihack24/misc/puzzled/puzzledVersion25QRcode.png b/insomnihack24/misc/puzzled/puzzledVersion25QRcode.png new file mode 100644 index 0000000..e953d2d Binary files /dev/null and b/insomnihack24/misc/puzzled/puzzledVersion25QRcode.png differ diff --git a/insomnihack24/mobile/.DS_Store b/insomnihack24/mobile/.DS_Store new file mode 100644 index 0000000..298a68d Binary files /dev/null and b/insomnihack24/mobile/.DS_Store differ diff --git a/insomnihack24/mobile/CryptoTest/.DS_Store b/insomnihack24/mobile/CryptoTest/.DS_Store new file mode 100644 index 0000000..ac119a3 Binary files /dev/null and b/insomnihack24/mobile/CryptoTest/.DS_Store differ diff --git a/insomnihack24/mobile/CryptoTest/CryptoTest.iml b/insomnihack24/mobile/CryptoTest/CryptoTest.iml new file mode 100644 index 0000000..c90834f --- /dev/null +++ b/insomnihack24/mobile/CryptoTest/CryptoTest.iml @@ -0,0 +1,11 @@ + + + + + + + + + + + \ No newline at end of file diff --git a/insomnihack24/mobile/CryptoTest/src/.DS_Store b/insomnihack24/mobile/CryptoTest/src/.DS_Store new file mode 100644 index 0000000..5008ddf Binary files /dev/null and b/insomnihack24/mobile/CryptoTest/src/.DS_Store differ diff --git a/insomnihack24/mobile/CryptoTest/src/Main.java b/insomnihack24/mobile/CryptoTest/src/Main.java new file mode 100644 index 0000000..ea32500 --- /dev/null +++ b/insomnihack24/mobile/CryptoTest/src/Main.java @@ -0,0 +1,37 @@ +import javax.crypto.Cipher; +import javax.crypto.spec.SecretKeySpec; +import java.io.BufferedReader; +import java.util.Base64; +public class Main { + public static void main(String[] args) throws Exception { + String encoded_text = "uS0D11dq3RM9QimRWfXcewwQdoxYwrZRNUGT205pDfQ="; + try(BufferedReader br = new BufferedReader(new java.io.FileReader("src/rockyouAES_Keys.txt"))) { + String passphrase; + while((passphrase = br.readLine())!= null) { + System.out.println("Trying: " + passphrase); + try { + String output = decrypt(encoded_text, passphrase); + if(output.startsWith("INS{")) { + System.out.println("Flag: " + output); + break; + } + } catch (Exception e) { + continue; + } + } + } + } + + private static String decrypt(String str2, String str3) throws Exception { + SecretKeySpec secretKeySpec = new SecretKeySpec(str3.getBytes(), "AES"); + byte[] decode = Base64.getDecoder().decode(str2); + Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding"); + cipher.init(2, secretKeySpec); + for (int i = 0; i < 313370; i++) { + decode = cipher.doFinal(decode); + } + Cipher cipher2 = Cipher.getInstance("AES/ECB/PKCS5Padding"); + cipher2.init(2, secretKeySpec); + return new String(cipher2.doFinal(decode), "UTF-8"); + } +} \ No newline at end of file diff --git a/insomnihack24/mobile/CryptoTest/src/rockyouAES_Keys.txt b/insomnihack24/mobile/CryptoTest/src/rockyouAES_Keys.txt new file mode 100644 index 0000000..86badb8 --- /dev/null +++ b/insomnihack24/mobile/CryptoTest/src/rockyouAES_Keys.txt @@ -0,0 +1,407 @@ +letsyouupdateyourfunnotesandmore +11111111111111111111111111111111 +
+9475d62e1f8b13676deab3824492367a +93948601&usertrace=$!3q7gESu0FxA +92965710534a9ec4b30f27b1e7f6062a +92839853879156166491915372959629 +91072456950danielazapataquintana +88888888888888888888888888888888 +837112034971964732852589631470.0 +80f5a0267920942a73693596fe181fb7 +77angggggggggggggggggggggggggggg +77777777777777777777777777777777 +76882fb85a1a8c6a83486aba03c031c9 +6rbtop_mayyada-el7ob_elli_kan.rm +6a60e0e51a3eb2e9fed6a546705de1bf +6843b9efec36f428deabce22c0fc1805 +67411262262842teamomividaeduardo +64685004072674860962426156282878 +5dfbcd6390b77d06df9027c8d7d4fe84 +5905277youwillrestinpeace5905277 +46254247and0401816812and46211577 +45262691895d3zst9ed2efc7p5joydos +4374968e935a9a0f8d56785ea682eb5f +35ำ81ก06ษรทญฟร35 +30101967130719921306196722071992 +23810511236173248085633529165498 +22222222222222222222222222222222 +21368651ayna77777777777777777777 +19534386020320052326226419298452 +19*+alevivajose02411**04valencia +16081989suiramuiorudut0728687420 +13420513420508061999134205134205 +123456to32mariaelmoata@yahoo.com +123456789mychemicalromancemarily +123456789mihaia1a2a3a4a5a6a7a8a9 +12345678999999999999999999999999 +12345678912345678912345678912345 +12345678910111213141651617181920 +12345678910111213141516171819820 +1234567891011121314151617181920i +12345678900987654321ugnlpl]hgsd] +11223344556677889910101111121213 +10351884103518841035188410351884 +100605selmaundma100605selmaundma +09876543210987654321098765432109 +09096008690090960086900909600869 +09062671639091585851100927336592 +07901491565079015267820790149501 +0753929001291091112580111091991a +0745253728narcotice1989745253728 +05670567056705670567056705670567 +0410412e7194adc1b419a87a47979c36 +02531570911123456221620101506288 +01265805220102068765010445939101 +01091989040320071202199124022008 +01076459405774934012545741133265 +01053972002064201001613206420214 +.aalexa-voleybalystano1isthebest +................................ +-จตตจจถจคตต- ++-*/7845123265842624867593518246 +*kiki*ingerashumeu$cumpik*:-*:-* +%๒๖ืีท๗๑ฒ๘ฬ% +################################ diff --git a/insomnihack24/mobile/Notes.apk b/insomnihack24/mobile/Notes.apk new file mode 100644 index 0000000..899023b Binary files /dev/null and b/insomnihack24/mobile/Notes.apk differ diff --git a/insomnihack24/mobile/notes.md b/insomnihack24/mobile/notes.md new file mode 100644 index 0000000..016fd58 --- /dev/null +++ b/insomnihack24/mobile/notes.md @@ -0,0 +1,7 @@ +first step Login: +username: admin +password: fbG6pXd0wm1cz + +second step Enter passphrase: +Base64 encoded Flag: uS0D11dq3RM9QimRWfXcewwQdoxYwrZRNUGT205pDfQ= +Bruteforced Passphrase: letsyouupdateyourfunNotesandmore \ No newline at end of file diff --git a/insomnihack24/mobile/passphrase_break.py b/insomnihack24/mobile/passphrase_break.py new file mode 100644 index 0000000..728dac9 --- /dev/null +++ b/insomnihack24/mobile/passphrase_break.py @@ -0,0 +1,33 @@ +from Crypto.Cipher import AES +from Crypto.Util.Padding import pad +import base64 + +key = b'A'*32 # Unknown 32-byte key +encrypted_flag = base64.decodebytes(b"uS0D11dq3RM9QimRWfXcewwQdoxYwrZRNUGT205pDfQ=") + +def encrypt(plaintext, flag): + padded = pad(plaintext + flag, 32) + cipher = AES.new(key, AES.MODE_ECB) + + ciphertext = cipher.encrypt(padded) + return ciphertext.hex() + + +def bruteforce(): + flag = '' + total = 64 - 1 + chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-~!?#%&@{}' + + while True: + payload = '1' * (total - len(flag)) + ciphertext_1 = encrypt((payload+flag).encode()) + + for c in chars: + ciphertext_2 = encrypt((payload + flag + c).encode()) + # Comapare the middle blocks ([32:64]) of each encrypted text + if ciphertext_2[64:128] == ciphertext_1[64:128]: + flag += c + print(flag) + break + +bruteforce() diff --git a/insomnihack24/pwn/welcomeChall/bin b/insomnihack24/pwn/welcomeChall/bin new file mode 100755 index 0000000..6f3219a Binary files /dev/null and b/insomnihack24/pwn/welcomeChall/bin differ diff --git a/insomnihack24/web/app.py b/insomnihack24/web/app.py new file mode 100644 index 0000000..c2e604a --- /dev/null +++ b/insomnihack24/web/app.py @@ -0,0 +1,34 @@ +from flask import Flask, render_template, request +from flask_sqlalchemy import SQLAlchemy +from const import FLAG, CRENDENTIALS + +app = Flask(__name__) +app.config['SQLALCHEMY_DATABASE_URI'] = f'postgresql://{CRENDENTIALS}@db:5432/application' +db = SQLAlchemy(app) + +@app.route('/') +def index(): + return render_template('index.html') + +@app.route('/login', methods=['GET','POST']) +def login(): + if request.method == 'GET': + return render_template('index.html') + + username = request.form['username'] + password = request.form['password'] + + if username != 'admin' or password[:5] != 'admin' or password[-5:] != 'admin': + return 'Login failed. Please check your username and password.' + + + query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'" + user = db.session.execute(db.text(query)).fetchone() + + if user: + return 'Hello admin ' + FLAG + else: + return 'Login failed. Please check your username and password.' + +if __name__ == '__main__': + app.run(debug=False, host='0.0.0.0')