Hello Navi

challenges

Game 08

Vulnerability: Brute Force

Hint: Login as 'admin' with password in range 0 ~ 9999

Tool: ZAProxy

Attack

Use fuzzing to brute force the password parameter from 0 to 9999.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

POST http://suninatas.com/challenge/web08/web08.asp HTTP/1.1
host: suninatas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Content-Type: application/x-www-form-urlencoded
Content-Length: 13
Origin: http://suninatas.com
Connection: keep-alive
Referer: http://suninatas.com/challenge/web08/web08.asp
Cookie: ASPSESSIONIDQSBTDCST=FNDPAPJCJDFBJAAENDCKDGDK
Upgrade-Insecure-Requests: 1
Priority: u=0, i

id=admin&pw=$$

challenges

Game 09

Challenge: Reverse engineering a Windows executable

Step 1: Extract Archive

1

7z x SuNiNaTaS.zip

Step 2: Identify File

1

file Project1.exe

Output: PE32 executable for MS Windows 4.00 (GUI), Intel i386, 8 sections

Step 3: Analyze with IDA

Run the executable in a virtual environment (Windows 10, VirtualBox).

The program displays an input box with two buttons.

Use IDA Pro and press Shift+F12 to view strings. Look for the "Congratulation!" message, then double-click to find cross-references.

Step 4: Find Password

From IDA disassembly:

1
2
3
4
5
6
7
8
9
10

CODE:00450388 ; ---------------------------------------------------------------------------
CODE:00450389                 align 4
CODE:0045038C _str_913465     _strings <0FFFFFFFFh, 6, '913465'>
CODE:0045038C                                         ; DATA XREF: _TForm1_Button1Click+1B↑o
CODE:0045039B                 align 4
CODE:0045039C ; const CHAR aSuninatas[]
CODE:0045039C aSuninatas      db 'SuNiNaTaS',0        ; DATA XREF: _TForm1_Button1Click+45↑o
CODE:004503A6                 align 4
CODE:004503A8 ; const CHAR aCongratulation[]
CODE:004503A8 aCongratulation db 'Congratulation!',0  ; DATA XREF: _TForm1_Button1Click+4A↑o

challenges

Game 10

Challenge: Reverse engineering a .NET Windows executable

Step 1: Extract and Identify

1
2

7z x reversing.zip
file reversing.exe

Output: PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections

Step 2: Hex Analysis

From hex view, strings are readable in Unicode format:

1

2theT@P, Authkey: Did U use the Peid?, SuNiNaTaS, Try again!, explorer, http://suninatas.com, textBox1, button1, OK, label2, Made by 2theT0P, button2, QUIT, Form1, WindowsFormsApplication1, Properties, Resources

The program is based on WinForms.

Step 3: Decompile with dnSpyEx

Use dnSpyEx (run in Windows) and drag the file to decompile.

Decompiled Code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

// WindowsFormsApplication1.Form1
// Token: 0x06000003 RID: 3 RVA: 0x00002068 File Offset: 0x00000268
private void button1_Click(object sender, EventArgs e)
{
    string text = "2theT@P";
    string text2 = "Authkey : Did U use the Peid?";
    if (this.textBox1.Text == text)
    {
        MessageBox.Show(text2, "SuNiNaTaS");
        this.textBox1.Text = "";
        return;
    }
    MessageBox.Show("Try again!", "SuNiNaTaS");
    this.textBox1.Text = "";
}

challenges

Game 11

Challenge: Reverse engineering a Windows executable with string manipulation

Step 1: Identify File

1

file Project1.exe

Output: PE32 executable for MS Windows 4.00 (GUI), Intel i386, 8 sections

Step 2: Extract Strings from Hex

From IDA disassembly, key strings:

1
2
3
4
5
6

CODE:0045041C  Congratulation!
CODE:00450434  Authkey :
CODE:004504B8  2abbe4b6
CODE:004504CC  44536ca0
CODE:004504E0  81aae922
CODE:004504F4  e32fa0de

Step 3: Analyze Form Creation

In _TForm1_FormCreate, these strings are assigned to variables at offsets:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

lea     eax, [ebx+300h]
mov     edx, offset _str_2abbe4b6.Text
call    @System@@LStrAsg$qqrpvpxv

lea     eax, [ebx+304h]
mov     edx, offset _str_44536ca0.Text
call    @System@@LStrAsg$qqrpvpxv

lea     eax, [ebx+308h]
mov     edx, offset _str_81aae922.Text
call    @System@@LStrAsg$qqrpvpxv

lea     eax, [ebx+30Ch]
mov     edx, offset _str_e32fa0de.Text
call    @System@@LStrAsg$qqrpvpxv

All strings are concatenated in order:

1
2
3
4

push    dword ptr [ebx+300h]
push    dword ptr [ebx+308h]
push    dword ptr [ebx+304h]
push    dword ptr [ebx+30Ch]

Result: 逐字符爆破结束后得到 32 位 hex 串（见文末 spoiler）。

Alternative: Decompiled Code Analysis

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

int __fastcall TForm1_Button1Click(int a1)
{
  System::__linkproc__ LStrAsg(a1 + 784, &str_2V[1]);
  System::__linkproc__ LStrAsg(a1 + 788, &str_XS[1]);
  System::__linkproc__ LStrAsg(a1 + 792, &str_B6[1]);
  System::__linkproc__ LStrAsg(a1 + 796, &str_H1[1]);
  System::__linkproc__ LStrAsg(a1 + 800, &str_0F[1]);

  System::__linkproc__ LStrCatN(
    a1 + 816,
    5,
    v2,
    *(_DWORD *)(a1 + 792),  // B6
    *(_DWORD *)(a1 + 796),  // H1
    *(_DWORD *)(a1 + 788),  // XS
    *(_DWORD *)(a1 + 800)); // 0F
}

The strings are rearranged in the concatenation. Check assembly for the actual order.

Assembly Order

1
2
3
4
5
6
7

push    dword ptr [ebx+310h] ; 2V
push    dword ptr [ebx+318h] ; B6
push    dword ptr [ebx+31Ch] ; H1
push    dword ptr [ebx+314h] ; XS
push    dword ptr [ebx+320h] ; 0F

; Password: 2VB6H1XS0F

challenges

Game 12

Challenge: Reverse engineering a Flash SWF file

Step 1: Scan QR Code

Access the admin panel at http://suninatas.com/admin/ and scan the QR code.

QR Data:

1

MECARD:N:;TEL:;EMAIL:;NOTE:;URL:http://suninatas.com/admin/admlogin.asp;ADR:;

Step 2: Download SWF File

Navigate to the URL in the QR code and find the Flash embed:

1

<embed src="admlogin.swf">

Download the SWF file.

Step 3: Identify File

1

file admlogin.swf

Output: Macromedia Flash data (compressed), version 8

Step 4: Decompile with FFDec

Install FFDec (Free Flash Decompiler):

1
2

paru -Ss ffdec
# aur/ffdec 25.0.0-2 - Open Source Flash SWF decompiler and editor

Import the SWF file into FFDec and search for authentication logic.

Decompiled Code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

on(release){
    function receipt()
    {
        if(flashid != "admin" or flashpw != "myadmin!@")
        {
            flashmessage = "Wrong ID or PW";
            play();
        }
        else
        {
            flashmessage = "Auth : Today is a Good day~~~";
            play();
        }
    }
    receipt();
}

Credentials: - ID: admin - Password: myadmin!@

challenges

Game 13

Challenge: Forensics - Steganography in ZIP and images

Hint: The programmer's bad habit of backing up source code

Step 1: Find and Download ZIP

The hint suggests looking for a backup file:

1

http://suninatas.com/challenge/web13/web13.zip

Step 2: Extract ZIP File

The ZIP is password-protected. Try extracting:

1

7z x web13.zip

Output:

1
2
3
4
5

ERROR: Wrong password : whitehack1.jpg
ERROR: Wrong password : whitehack2.jpg
ERROR: Wrong password : whitehack3.jpg
ERROR: Wrong password : whitehack4.jpg
ERROR: Wrong password : 4ڸ.txt

Note: Set locale to Korean if needed. Use unar instead for automatic handling:

1

unar web13.zip

Output reveals: 압축비번은4자리정수 (The compression password is a 4-digit integer)

Step 3: Brute Force Password

Use John the Ripper with a 4-digit wordlist:

1
2

zip2john web13.zip > hash.txt
john hash.txt --wordlist=~/wordlists/SecLists/Fuzzing/4-digits-0000-9999.txt

Result: 7642 is the password

Step 4: Extract Files

After extracting with password 7642:

1

unar web13.zip

Open the text file with encoding EUC-KR.

Content: Combine the four images to find the key.

Step 5: Extract Data from Images

Use hex dump to find hidden data in each image:

whitehack1.jpg:

1

xxd whitehack1.jpg | head -20

Contains: first key : 3nda192n

whitehack2.jpg:

1

xxd whitehack2.jpg | head -20

Contains: second key : 84ed1cae

whitehack3.jpg:

1

xxd whitehack3.jpg | head -20

Contains: third key: 8abg9295

whitehack4.jpg:

1

xxd whitehack4.jpg | head -20

Contains: fourth key : cf9eda4d

Step 6: Combine Keys

Concatenate all four keys in order:

3nda192n + 84ed1cae + 8abg9295 + cf9eda4d

challenges

Game 14

Challenge: Password cracking from Linux shadow file

Tool: John the Ripper

Step 1: Extract Archive

1

tar xf evidence.tar

Step 2: Examine Shadow File

The shadow file contains a hashed password entry:

1

suninatas:$6$QlRlqGhj$BZoS9PuMMRHZZXz1Gde99W01u3kD9nP/zYtl8O2dsshdnwsJT/1lZXsLar8asQZpqTAioiey4rKVpsLm/bqrX/:15427:0:99999:7:::

Step 3: Prepare for Cracking

Combine passwd and shadow files:

1

unshadow passwd shadow > unshadow

Step 4: Crack Password

Use John the Ripper with a wordlist:

1

john unshadow --wordlist=~/wordlists/rockyou.txt

Output:

1

iloveu1         (suninatas)

challenges

Game 15

We're given an mp3 file (diary.mp3). The hex dump reveals ID3 tags and an embedded JPEG with Exif data:

1
2
3
4
5

00000000: 4944 3303 0000 0000 6f76 5450 4532 0000  ID3.....ovTPE2..
...
00000080: 0033 f700 0000 696d 6167 652f 6a70 6567  .3....image/jpeg
00000090: 0003 00ff d8ff e000 104a 4649 4600 0101  .........JFIF...
000000a0: 0101 2c01 2c00 00ff e101 8645 7869 6600  ..,.,......Exif.

The flag is in the metadata — exiftool shows it in the Conductor field:

1
2
3
4

❯ exiftool diary.mp3
...
Conductor                       : ********************
...

The embedded cover art can be extracted with binwalk:

1

❯ binwalk -e diary.mp3

challenges

Game 16

We have a PCAP (Packet Capture) file to analyze:

1
2
3

❯ 7z x packet_dump.zip
❯ file packet_dump.pcap
packet_dump.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4 (Ethernet, capture length 65535)

Extract credentials by searching for password parameters in the captured network traffic:

1
2
3
4
5
6

❯ strings packet_dump.pcap | grep Hpw=
Hid=suninatas&Hpw=suninatasc
Hid=blackkey&Hpw=blackkeyn
Hid=ultrashark&Hpw=sharkpass01~
Hid=ultrashark&Hpw=%3Dsharkpass01
Hid=ultrashark&Hpw=%3DSharkPass01

Try logging in with each credential pair until one succeeds:

1

Congratulation! Authkey : ********************************

challenges

Game 17

We have a QR code image that needs to be processed and decoded. Start by enhancing the image with ImageMagick:

1
2

❯ convert qr.png -threshold 85% out.png
❯ convert out.png -background black -alpha remove -alpha off oo.png

The processed image may be incomplete or corrupted. Use an image editor like Krita to overlay the three pattern images (position markers) on top of the QR code to restore it.

Once repaired, decode the QR code with zbarimg:

1

❯ zbarimg oo.png

This yields the flag:

1

Good Job! Congraturation! AuthKey is YouAreQRCodeMaster~!