WeChall - Paranoid

Posted on In Views: Disqus:

very simple and interesting stegano, but need to be careful and be patient

Challenge

Gizmore 的第二个 stegano 题。页面有 answer box + captcha 验证，captcha 点击后刷新（timestamp jpg）。

URL

  • 挑战页: https://www.wechall.net/en/challenge/paranoid/index.php
  • Captcha 生成: https://www.wechall.net/en/Captcha/<text> — URL path 直接决定 captcha 图片文字

挑战描述

1
2
3
4
5
<b>W</b>ith pleasure I present you my second ste<i>g</i>ano.
<b>R</b>ight w<i>r</i>itten from scratch in a paranoid mind.
<b>O</b>r may<i>b</i>e I am just testing my website framework.
<b>N</b>evermind, I hope you enjoy this challen<i>ge</i>.
<b>G</b>ood Luck
  • Bold 首字母: W, R, O, N, G → WRONG（故意误导）
  • Italic 字母: g, r, b, ge → GRBGE（关键线索，源码注释确认重要）

关键线索 1: GRBGE

源码注释（www/challenge/paranoid/lang/chall_en.php）：

1
# It is important the the letters GRBGE are in <i> italic.

GRBGE = "Garbage" 的元音省略拼法（G-R-B-G-E，去掉了 A）。但 "garbage" 不是答案，GRBGE 指向的是 captcha 机制本身。

关键线索 2: Captcha 序列轮换

每次提交 wrong 答案后，页面上的 captcha 图片路径会切换到下一个。通过连续提交 wrong 答案，得到 12 个词的有序序列：

1
2
YOURE → LOOKN → FORDA → PASWD → THECA → PTCHA →
GRBGE → YADDA → HELLO → HACKR → HOWYA → DOING → (循环)

翻译成英文句子：

"You're looking for the password the captcha garbage yadda hello hacker how ya doing?"

其中 THECA + PTCHA 拼在一起就是 "THECAPTCHA" = "The Captcha"。

THECAPTCHA