Hello Navi

#!/usr/bin/env python3
"""Recover the JavaScript Mission 7 password from the obfuscated source.

The level ships two hex-string arrays and rebuilds a <button> at run time by
turning a numeric char-code list into HTML:

    var _0x4e9d=["\\x66\\x72\\x6F\\x6D\\x43\\x68\\x61\\x72\\x43\\x6F\\x64\\x65",
                 "\\x77\\x72\\x69\\x74\\x65"];

Step 1 unescapes the \\xNN literals into identifier names
("fromCharCode","write"); step 2 turns the numeric char-code list into the
button HTML and reads the compared literal out of it -- the password.
"""
import re

src = open("lvl7.html", encoding="utf-8", errors="replace").read()

# Step 1: \xNN string literals -> identifier names
arr = re.search(r"_0x4e9d=\[(.*?)\]", src, re.S).group(1)
names = [bytes(b, "latin1").decode("unicode_escape")
         for b in re.findall(r'"((?:\\x[0-9a-fA-F]{2})+)"', arr)]
print("identifiers:", names)

# Step 2: rebuild the button HTML from the String.fromCharCode() code list
call = re.search(r"String\[_0x4e9d\[0x0\]\]\(([^)]*)\)", src, re.S).group(1)
codes = [int(x, 16) for x in re.findall(r"0x([0-9a-fA-F]+)", call)]
button = "".join(chr(c) for c in codes)
print("button HTML:")
print(button)

# Step 3: the compared literal inside the button is the password
password = re.search(r'value=="([^"]+)"', button).group(1)
print("password:", password)

#!/usr/bin/env python3
"""Recover the JavaScript Mission 6 password from the external script.

index.php loads /missions/javascript/6/checkpass.js; the winning comparison
there is  pass == rawr+" "+moo  with  dairycow="moo",  rawr="moo",  moo="pwns".

The inline check() (RawrRawr / "hack_this_site" / about:blank) is dead code;
the form calls checkpassw() which forwards to the external checkpass().
The password is exactly "rawr + ' ' + moo" -- the single space included.
"""
import re
import urllib.parse


def main():
    js = open("checkpass.js", encoding="utf-8", errors="replace").read()
    vals = dict(re.findall(r'(\w+)\s*=\s*"([^"]*)"', js))
    missing = {name for name in ("rawr", "moo") if name not in vals}
    if missing:
        raise SystemExit("missing required assignment(s): " + ", ".join(sorted(missing)))
    password = "%s %s" % (vals["rawr"], vals["moo"])
    print("rawr     :", vals["rawr"])
    print("moo      :", vals["moo"])
    print("password :", repr(password))
    print("query    : lvl_password=" + urllib.parse.quote(password))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Recover the JavaScript Mission 5 password from the fetched page source.

The page assigns the expected value at load time:

    moo = unescape('%69%6C%6F%76%65%6D%6F%6F');

`unescape()` is the legacy percent-decoder, so the password is just that
literal decoded once.  urllib.parse.unquote is the modern equivalent.
"""
import re
import urllib.parse


def main():
    src = open("lvl5.html", encoding="utf-8", errors="replace").read()
    match = re.search(r"unescape\('([^']*)'\)", src)
    if match is None:
        raise SystemExit("could not find an unescape() literal in lvl5.html")
    encoded = match.group(1)
    password = urllib.parse.unquote(encoded)
    print("encoded  :", encoded)
    print("decoded  :", repr(password))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""HackThisSite JavaScript 2 ("Disable Javascript").

The level page only runs `window.location = ".../2/fail.php"`; the win link is
hidden in the same HTML.  index.php regenerates the challengePass token on
every load, so fetch and submit must happen back to back in one session:

    usage: HTS_COOKIE=<live-cookie> ./solve.py
"""
import os
import re
import sys
import urllib.parse
import urllib.request

BASE = "https://www.hackthissite.org/missions/javascript/2/"
COOKIE = os.environ.get("HTS_COOKIE", "<mission-cookie>")

def get(url, referer):
    req = urllib.request.Request(url)
    req.add_header("Cookie", "HackThisSite=" + COOKIE)
    req.add_header("Referer", referer)
    with urllib.request.urlopen(req) as rsp:
        return rsp.read().decode("latin-1")

def main():
    page = get(BASE, BASE)
    match = re.search(r'challengePass=([^"&]+)', page)
    if not match:
        sys.exit("no challengePass token in page")
    token = match.group(1)
    print("token:", token)
    win_url = BASE + "index.php?" + urllib.parse.urlencode({"challengePass": token})
    body = get(win_url, BASE)
    print("submitted:", win_url)
    print(body[:200])

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Solve HackThisSite Programming Mission 12."""

import html
import os
import re

import requests

BASE = "https://www.hackthissite.org"
LEVEL_URL = f"{BASE}/missions/prog/12/"
USER_AGENT = (
    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
    "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
)
PRIMES = {2, 3, 5, 7}
COMPOSITES = {4, 6, 8, 9}


def make_session():
    cookie = os.environ.get("HTS_COOKIE", "").strip().strip("'\"")
    if not cookie:
        raise SystemExit("HTS_COOKIE is not set")
    client = requests.Session()
    client.headers.update(
        {
            "User-Agent": USER_AGENT,
            "Cookie": cookie,
            "Referer": f"{BASE}/missions/programming/",
            "Accept-Language": "en-US,en;q=0.9",
        }
    )
    return client


def body_text(source):
    source = re.sub(r"<script.*?</script>", "", source, flags=re.S)
    source = re.sub(r"<br\s*/?>", "\n", source)
    source = re.sub(r"</(?:p|div|tr)>", "\n", source)
    source = re.sub(r"<[^>]+>", " ", source)
    source = html.unescape(source)
    return re.sub(r"\n\s*\n+", "\n", re.sub(r"[ \t]+", " ", source))


def parse(page_text):
    match = re.search(r'<input type="text" value="([^"]+)"', page_text)
    if match is None:
        raise SystemExit("random string not found in page")
    return match.group(1)


def solve(value):
    digits = [int(char) for char in value if char.isdigit()]
    composite_sum = sum(digit for digit in digits if digit in COMPOSITES)
    prime_sum = sum(digit for digit in digits if digit in PRIMES)
    product = composite_sum * prime_sum
    first25 = [char for char in value if not char.isdigit()][:25]
    shifted = "".join(chr(ord(char) + 1) for char in first25)
    return shifted + str(product), (composite_sum, prime_sum, product)


def verdict(response_text):
    text = body_text(response_text).lower()
    success = any(
        marker in text
        for marker in (
            "congratulation",
            "you have completed",
            "completed this",
            "successfully",
            "correct",
            "well done",
            "mission accomplished",
            "complete!",
        )
    )
    failure = any(
        marker in text
        for marker in (
            "wrong",
            "incorrect",
            "not correct",
            "try again",
            "failed",
            "too late",
            "time is up",
            "sorry",
        )
    )
    if success and not failure:
        return True
    if failure and not success:
        return False
    return None


def submit(client, answer):
    response = client.post(
        f"{LEVEL_URL}index.php",
        data={"solution": answer, "submitbutton": "submit"},
        headers={"Referer": LEVEL_URL},
        timeout=30,
    )
    response.raise_for_status()
    return verdict(response.text)


def main():
    client = make_session()
    page = client.get(LEVEL_URL, timeout=20)
    page.raise_for_status()
    value = parse(page.text)
    answer, info = solve(value)
    composite_sum, prime_sum, product = info
    print("input prefix:", value[:60])
    print(
        "sums: composite=%d prime=%d product=%d"
        % (composite_sum, prime_sum, product)
    )
    print("answer:", answer)
    print("verdict:", submit(client, answer))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Solve HackThisSite Programming Mission 11."""

import html
import os
import re

import requests

BASE = "https://www.hackthissite.org"
LEVEL_URL = f"{BASE}/missions/prog/11/"
USER_AGENT = (
    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
    "(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
)


def make_session():
    cookie = os.environ.get("HTS_COOKIE", "").strip().strip("'\"")
    if not cookie:
        raise SystemExit("HTS_COOKIE is not set")
    client = requests.Session()
    client.headers.update(
        {
            "User-Agent": USER_AGENT,
            "Cookie": cookie,
            "Referer": f"{BASE}/missions/programming/",
            "Accept-Language": "en-US,en;q=0.9",
        }
    )
    return client


def body_text(source):
    source = re.sub(r"<script.*?</script>", "", source, flags=re.S)
    source = re.sub(r"<br\s*/?>", "\n", source)
    source = re.sub(r"</(?:p|div|tr)>", "\n", source)
    source = re.sub(r"<[^>]+>", " ", source)
    source = html.unescape(source)
    return re.sub(r"\n\s*\n+", "\n", re.sub(r"[ \t]+", " ", source))


def parse(page_text):
    section = page_text.split("Generated String:", 1)[1].split("Shift:", 1)[0]
    codes = [int(value) for value in re.findall(r"\d+", section)]
    match = re.search(r"Shift:\s*(\d+)", page_text)
    if match is None:
        raise SystemExit("shift value not found")
    return codes, int(match.group(1))


def decode(codes, shift, direction):
    return "".join(chr(code + direction * shift) for code in codes)


def verdict(response_text):
    text = body_text(response_text).lower()
    success = any(
        marker in text
        for marker in (
            "congratulation",
            "you have completed",
            "completed this",
            "successfully",
            "correct",
            "well done",
            "mission accomplished",
            "complete!",
        )
    )
    failure = any(
        marker in text
        for marker in (
            "wrong",
            "incorrect",
            "not correct",
            "try again",
            "failed",
            "too late",
            "time is up",
            "sorry",
        )
    )
    if success and not failure:
        return True
    if failure and not success:
        return False
    return None


def submit(client, answer):
    response = client.post(
        f"{LEVEL_URL}index.php",
        data={"solution": answer, "submitbutton": "submit"},
        headers={"Referer": LEVEL_URL},
        timeout=30,
    )
    response.raise_for_status()
    return verdict(response.text), response.text


def main():
    client = make_session()
    page = client.get(LEVEL_URL, timeout=20)
    page.raise_for_status()
    codes, shift = parse(body_text(page.text))
    for direction in (-1, 1):
        answer = decode(codes, shift, direction)
        print(f"try shift {direction * shift:+d} -> {answer!r}")
        ok, _ = submit(client, answer)
        print("verdict:", ok)
        if ok:
            return
        if direction == -1:
            page = client.get(LEVEL_URL, timeout=20)
            page.raise_for_status()
            codes, shift = parse(body_text(page.text))
            print("retry codes:", codes, "shift", shift)
    raise SystemExit("both directions rejected")


if __name__ == "__main__":
    main()

import struct

d = open('image1.png', 'rb').read()
i = 8
while i < len(d):
    ln = struct.unpack('>I', d[i:i + 4])[0]
    typ = d[i + 4:i + 8].decode('latin1')
    print(typ, ln, 'at', i)
    i += 12 + ln
print('total', len(d), 'end at', i)
print('trailing:', d[i:][:100])

from PIL import Image
import collections

im = Image.open('image1.png').convert('RGB')
w, h = im.size
px = im.load()
cols = collections.Counter(px[x, y] for y in range(h) for x in range(w))
print(im.mode, im.size)
for c, n in cols.most_common(6):
    print(c, n)
print('unique colors:', len(cols))
print('R values', set(c[0] for c in cols), 'G', set(c[1] for c in cols))

import hashlib
import string
import time

digest = 'e39654b46edc59284c40bad96887ec541e476f96d6b7e81b3dff92601eebcfec'
t0 = time.time()
n = 0
for lo in string.ascii_lowercase:
    for up in string.ascii_uppercase:
        for mask in range(1 << 10):
            pw = ''.join(up if (mask >> i) & 1 else lo for i in range(10))
            n += 1
            if hashlib.sha256(pw.encode()).hexdigest() == digest:
                print('found', pw, 'after', n, 'hashes in', round(time.time() - t0, 2), 's')
                raise SystemExit

raw = im.tobytes()
at = lambda x, y: raw[3 * (y * w + x):3 * (y * w + x) + 3]

#!/usr/bin/env python3
"""HackThisSite Programming mission 10 -- Automated Steganography (45 s limit).

Pipeline (all in one process, one instance fetch):

 1. GET  https://www.hackthissite.org/missions/prog/10/            -> form + random image URL
 2. GET  .../missions/prog/10/image.php?<rand>                     -> 255x128 RGB PNG
 3. The PNG is a 255x128 triangle-wave gradient drawn in ONE randomly
    chosen channel (R, G or B).  The grader hides one byte per row in the
    *x position* of the single pixel that also carries a non-zero value in
    one of the other two channels:
        char = chr(x_of_the_off_gradient_pixel)
    Only 88 of the 128 rows carry a marker; concatenating those chars in row
    order yields the base64 string.
 4. base64-decode -> 64 hex chars -> a SHA-256 digest.
 5. The answer is a 10-character password built from exactly two distinct
    characters (one lower case, one upper case) in random order, so it is
    found by hashing all 26*26 pairs x 2^10 orderings and comparing to the
    digest (~0.7 s in CPython; no external tools needed).
 6. POST the password back to .../missions/prog/10/index.php (field `solution`).

Usage:
    cd <hts-workspace>
    export HTS_COOKIE='HackThisSite=...'
    uv run python challenges/hts-prog/10/solve.py            # solve + submit
    uv run python challenges/hts-prog/10/solve.py --dry-run  # decode only

The cookie is read from HTS_COOKIE at runtime and is never written to disk.
"""

import argparse
import base64
import hashlib
import io
import os
import re
import string
import sys
import time

from PIL import Image
import requests

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
from common import BASE, body_text, fetch_level, session, submit  # noqa: E402

LEVEL = 10
IMAGE_RE = re.compile(r'src="(/missions/prog/10/image\.php[^"]*)"')
ALGOS = ("sha256", "sha512", "sha1", "md5", "sha384", "sha224")

def find_image_url(page_text):
    m = IMAGE_RE.search(page_text)
    if not m:
        raise SystemExit("image.php URL not found on level page (not logged in?)")
    return m.group(1)

def download_image(s, url):
    r = s.get(BASE + url, timeout=20)
    r.raise_for_status()
    return r.content

def extract_base64(png_bytes):
    """Return (base64_string, per-row marker offsets).

    The instance renders a triangle-wave gradient in ONE randomly chosen
    channel (R, G or B) and hides one byte per row in the x-offset of the
    single pixel that also carries a value in another channel.  Detect the
    gradient channel as the one with the most distinct values, then take,
    for every row, the x of the first pixel whose other channels are non-zero.
    """
    im = Image.open(io.BytesIO(png_bytes)).convert("RGB")
    w, h = im.size
    raw = im.tobytes()
    print(f"[1/4] image: {w}x{h} {im.mode}")
    at = lambda x, y: raw[3 * (y * w + x):3 * (y * w + x) + 3]

    spread = {c: len({at(x, y)[c] for y in range(h) for x in range(w)})
              for c in range(3)}
    grad = max(spread, key=lambda c: spread[c])
    others = [c for c in range(3) if c != grad]
    print(f"      gradient channel: {'RGB'[grad]} (distinct values {spread})")

    xs = []
    for y in range(h):
        hits = [x for x in range(w)
                if any(at(x, y)[c] != 0 for c in others)]
        if hits:
            xs.append(hits[0])
    s = "".join(chr(x) for x in xs)
    print(f"[2/4] rows carrying a marker: {len(xs)}/{h}")
    print(f"      marker offsets (first 20): {xs[:20]}")
    print(f"      layer 1 (chars from offsets): {s}")
    return s, xs

def decode_layer1(b64_str):
    pad = b64_str + "=" * (-len(b64_str) % 4)
    raw = base64.b64decode(pad)
    digest = raw.decode("ascii").strip()
    print(f"[3/4] layer 2 (base64): {raw!r}")
    if not re.fullmatch(r"[0-9a-f]+", digest):
        raise SystemExit("decoded value is not a hex digest")
    print(f"      layer 3 (digest): {digest}  ({len(digest)} hex chars)")
    return digest

def candidates():
    """Every 10-char string built from one lower + one upper case letter."""
    for lo in string.ascii_lowercase:
        for up in string.ascii_uppercase:
            for mask in range(1 << 10):
                yield "".join(up if (mask >> i) & 1 else lo for i in range(10))

def brute_force(digest):
    """Hash candidates algo-major so the common case (sha256) is ~0.5 s."""
    t0 = time.time()
    for algo in ALGOS:
        tried = 0
        for pw in candidates():
            tried += 1
            if hashlib.new(algo, pw.encode()).hexdigest() == digest:
                print(f"[4/4] cracked {algo} after {tried} hashes "
                      f"in {time.time() - t0:.2f}s")
                return pw, algo
    raise SystemExit("no password matched (unexpected hash algorithm?)")

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--dry-run", action="store_true",
                    help="decode only, do not submit")
    args = ap.parse_args()

    t_start = time.time()
    s = session()
    page = fetch_level(s, LEVEL)
    print("[0/4] level page fetched "
          f"({len(page)} bytes, {time.time() - t_start:.2f}s)")

    url = find_image_url(page)
    print(f"      image URL: {url}")
    png = download_image(s, url)
    print(f"      image bytes: {len(png)}  ({time.time() - t_start:.2f}s)")

    b64_str, _ = extract_base64(png)
    digest = decode_layer1(b64_str)
    password, algo = brute_force(digest)
    print(f"      PASSWORD: {password!r}  (distinct chars: {sorted(set(password))})")

    if args.dry_run:
        print(f"dry run: not submitting. total {time.time() - t_start:.2f}s")
        return

    ok, resp = submit(s, LEVEL, password)
    print(f"      submitted, verdict={ok}  total {time.time() - t_start:.2f}s")
    print(body_text(resp)[-600:])
    if ok is not True:
        sys.exit(1)

if __name__ == "__main__":
    main()