From 9f5a8777be0ce33ee2aea2b1f64d6eeacaa2c66c Mon Sep 17 00:00:00 2001 From: Enrique Date: Wed, 6 Feb 2019 19:23:06 -0600 Subject: [PATCH] Modificar directorios, agregar writeups de NeverLAN --- {pico => 2018/pico}/aca-shell-a.md | 0 {pico => 2018/pico}/client-side.md | 0 {pico => 2018/pico}/heres-johny.md | 0 {pico => 2018/pico}/lista_resueltos | 0 {pico => 2018/pico}/logon.md | 0 {pico => 2018/pico}/progreso.png | Bin {square => 2018/square}/de-anonymization.md | 0 {square => 2018/square}/rp.png | Bin 2019/neverlan/bashninja | 58 ++++++++++++++++++++ 2019/neverlan/purvesta | 21 +++++++ 2019/neverlan/sqlfun1 | 19 +++++++ 2019/neverlan/sqlfun2 | 24 ++++++++ 2019/neverlan/thingsarenot | 14 +++++ 13 files changed, 136 insertions(+) rename {pico => 2018/pico}/aca-shell-a.md (100%) rename {pico => 2018/pico}/client-side.md (100%) rename {pico => 2018/pico}/heres-johny.md (100%) rename {pico => 2018/pico}/lista_resueltos (100%) rename {pico => 2018/pico}/logon.md (100%) rename {pico => 2018/pico}/progreso.png (100%) rename {square => 2018/square}/de-anonymization.md (100%) rename {square => 2018/square}/rp.png (100%) create mode 100644 2019/neverlan/bashninja create mode 100644 2019/neverlan/purvesta create mode 100644 2019/neverlan/sqlfun1 create mode 100644 2019/neverlan/sqlfun2 create mode 100644 2019/neverlan/thingsarenot diff --git a/pico/aca-shell-a.md b/2018/pico/aca-shell-a.md similarity index 100% rename from pico/aca-shell-a.md rename to 2018/pico/aca-shell-a.md diff --git a/pico/client-side.md b/2018/pico/client-side.md similarity index 100% rename from pico/client-side.md rename to 2018/pico/client-side.md diff --git a/pico/heres-johny.md b/2018/pico/heres-johny.md similarity index 100% rename from pico/heres-johny.md rename to 2018/pico/heres-johny.md diff --git a/pico/lista_resueltos b/2018/pico/lista_resueltos similarity index 100% rename from pico/lista_resueltos rename to 2018/pico/lista_resueltos diff --git a/pico/logon.md b/2018/pico/logon.md similarity index 100% rename from pico/logon.md rename to 2018/pico/logon.md diff --git a/pico/progreso.png b/2018/pico/progreso.png similarity index 100% rename from pico/progreso.png rename to 2018/pico/progreso.png diff --git a/square/de-anonymization.md b/2018/square/de-anonymization.md similarity index 100% rename from square/de-anonymization.md rename to 2018/square/de-anonymization.md diff --git a/square/rp.png b/2018/square/rp.png similarity index 100% rename from square/rp.png rename to 2018/square/rp.png diff --git a/2019/neverlan/bashninja b/2019/neverlan/bashninja new file mode 100644 index 0000000..33dc36c --- /dev/null +++ b/2019/neverlan/bashninja @@ -0,0 +1,58 @@ +# Things are not always what they seem + +### Bash Ninja Games + +Similares a los juegos de [Bandit](https://overthewire.org/wargames/bandit), son niveles +que prueban los conocimientos básicos e intermedios de el uso de la shell Bash. + +### 1 + +Entrar al servidor mediante el protocolo SSH. + +``` +act-with-honor-and-honor-will-aid-you +``` + +### 2 + +Listar los archivos ocultos + +``` +the-only-path-to-honor-is-to-stick-to-your-chosen-code +``` + +### 3 + +Hallar la contraseña en un archivo de texto enorme. Dado que las lineas se +repiten, podemos obtener las lineas únicas ordenando el archivo (`sort -d`) y +eliminando sus duplicados (`uniq -u`). + +``` +child-of-honor +``` + +### 4 + +Similar a _3_, pero ahora con un archivo binario (`strings`). + +``` +only*hack^things%you$own +``` + +### 5 + +Encontramos una imágen, para poder visualizarla la copiamos al cliente mediante +el protocolo SSH (`scp`). + +``` +have-you-memorized-the-code-yet +``` + +### 6 + +El contenido del archivo de texto se encuentra codificado en Base64 (`base64`). + +``` +white-hats-have-values-and-rules +``` + diff --git a/2019/neverlan/purvesta b/2019/neverlan/purvesta new file mode 100644 index 0000000..a683425 --- /dev/null +++ b/2019/neverlan/purvesta @@ -0,0 +1,21 @@ +# purvesta + +### Recon, 75 + +--- +I love Github. Use it all the time! Just wish they could host a webpage... +--- + +Analizando lo que nos dice el problema podemos buscar que Github tiene un +servicio para __hostear__ paginas web: GitHub Pages. + +Tomando en cuenta el nombre del reto ingresamos a: + +[https://github.com/purvesta](https://github.com/purvesta) + +Ahi encontraremos un repositorio llamado **purvesta.github.io** el cual guarda +un archivo llamado `lol`, donde se encuentra la flag. + +``` +flag{Th1s_g1thub_l00ks_a_l1l_sparc3} +``` diff --git a/2019/neverlan/sqlfun1 b/2019/neverlan/sqlfun1 new file mode 100644 index 0000000..4c0b4ad --- /dev/null +++ b/2019/neverlan/sqlfun1 @@ -0,0 +1,19 @@ +# SQL Fun 1 + +## Web, 50 + +--- +My Customer forgot his Password. His Fname is Jimmy. Can you get his password for me? It should be in the users table +--- + +Esto es uso de SQL, tenemos que encontrar el usuario Jimmy en la tabla users + +```sql +select * from users where Fname='jimmy' +``` + +En el registro de la columna `Password` encontraremos la flag. + +``` +flag{SQL_F0r_Th3_W1n} +``` diff --git a/2019/neverlan/sqlfun2 b/2019/neverlan/sqlfun2 new file mode 100644 index 0000000..2233ceb --- /dev/null +++ b/2019/neverlan/sqlfun2 @@ -0,0 +1,24 @@ +# SQL Fun 2 + +## Web, 50 + +--- +A Client forgot his Password... again. Could you get it for me? He has a users account and his Lname is Miller if that helps at all. Oh! and Ken was saying something about a new table called passwd; said it was better to separate things. +--- + +Para este caso fue necesario hacer una union entre las distintas tablas. + +```sql +select * from users join passwd where Lname='Miller' +``` + +Ahi encontramos la cadena `ZmxhZ3tXMWxsX1kwdV9KMDFOX00zP30=`, decodificando obtendremos la flag. + +``` +echo "ZmxhZ3tXMWxsX1kwdV9KMDFOX00zP30=" | base64 -d +``` + + +``` +flag{W1ll_Y0u_J01N_M3?} +``` diff --git a/2019/neverlan/thingsarenot b/2019/neverlan/thingsarenot new file mode 100644 index 0000000..a2608f6 --- /dev/null +++ b/2019/neverlan/thingsarenot @@ -0,0 +1,14 @@ + +# Things are not always what they seem + +### Web, 50 + +--- +If you can't find it you're not looking hard enough. +--- + +Revisando el código fuente de la página encontramos la flag. + +``` +flag{Whale_w0u1d_y0u_l00k3y_th3r3} +```