Root-me - Revision history

MLeitgeb: add smashthestack wiki reference

2024-12-17T22:26:32Z

add smashthestack wiki reference

← Older revision		Revision as of 22:26, 17 December 2024
Line 475:		Line 475:
	✔️ If a beginner joins the TryHackMe community, he/she will be able to find write-ups and walkthroughs to challenges on the Internet, when help is needed, as TryHackMe is popular in the penetration testing learning platform field. On the platform there are so called Rooms, which a member can join and solve different tasks regarding a topic. They vary in difficulty and category and are part of learning paths, which are predefined to make the learning uncomplicated. Each room includes directly deployable virtual machines (VM), called AttackBox, that are hosted in the cloud of the platform. By trying to deliver a fun and gamified cyber security learning experience, the platform excels at its best.		✔️ If a beginner joins the TryHackMe community, he/she will be able to find write-ups and walkthroughs to challenges on the Internet, when help is needed, as TryHackMe is popular in the penetration testing learning platform field. On the platform there are so called Rooms, which a member can join and solve different tasks regarding a topic. They vary in difficulty and category and are part of learning paths, which are predefined to make the learning uncomplicated. Each room includes directly deployable virtual machines (VM), called AttackBox, that are hosted in the cloud of the platform. By trying to deliver a fun and gamified cyber security learning experience, the platform excels at its best.

	* [https://smashthestack.org/ SmashTheStack]		* [https://smashthestack.org/ SmashTheStack - Website]
			* [https://wiki.elvis.science/index.php?title=SmashTheStack SmashTheStack - Wiki Article]
	✔️ SmashTheStack offers a unique approach to penetration testing learning through its seven core challenges, each consisting of approximately 10 progressive levels. What sets this platform apart is its focus on SSH-based access to challenge machines, requiring no registration for participation. The platform covers various security topics, though they aren't explicitly categorized like in other platforms. Users can prove their success by leaving their mark in a text file upon completing challenges. While smaller in scale with around 70 total challenges, SmashTheStack maintains a dedicated community-driven approach, relying on user contributions for service maintenance and expansion. Its minimalist approach and SSH-based challenge system make it particularly appealing for users who prefer a more traditional, command-line oriented learning experience.		✔️ SmashTheStack offers a unique approach to penetration testing learning through its seven core challenges, each consisting of approximately 10 progressive levels. What sets this platform apart is its focus on SSH-based access to challenge machines, requiring no registration for participation. The platform covers various security topics, though they aren't explicitly categorized like in other platforms. Users can prove their success by leaving their mark in a text file upon completing challenges. While smaller in scale with around 70 total challenges, SmashTheStack maintains a dedicated community-driven approach, relying on user contributions for service maintenance and expansion. Its minimalist approach and SSH-based challenge system make it particularly appealing for users who prefer a more traditional, command-line oriented learning experience.

MLeitgeb: add Alternatives including smashthestack

2024-12-17T22:12:03Z

add Alternatives including smashthestack

@@ Line 466: / Line 466: @@
 * The importance of server-side data validation and sanitization
 * Understanding how HTML forms transmit data to the server
 = Summary =

MLeitgeb: add student developed Challenge

2024-12-17T22:01:35Z

add student developed Challenge

← Older revision		Revision as of 22:01, 17 December 2024
Line 427:		Line 427:
	# Access the service to retrieve the secret message.		# Access the service to retrieve the secret message.

			== The Faulty Soulmate Vegetable Form ==

			This section describes the process of creating a custom challenge for the Web-Client category, demonstrating how client-side form can be altered.

			=== Challenge Concept ===
			The challenge presents users with a web form asking various questions to determine their "soulmate vegetable." After completing and submitting the form, users receive an error message indicating that no "Username" was entered. The goal of the challenge is to bypass this error.
			=== Technical Implementation ===
			The challenge exploits a common web security oversight where users can change client-side HTML. When users submit the form, they encounter an error message:


			[[File:Form Error.png\|400px]]

			==== Solution Process ====
			To solve the challenge, users need to:
			# Open their browser's Developer Tools
			# Inspect the HTML form structure
			# Add a new input element with the following attributes:
			<source lang="html">
			<input type="text" name="Username"/>
			</source>
			It's crucial to note that the "name" attribute is essential for the solution. Form data is transmitted to the backend using the "name" attribute as the identifier. Without this attribute, the input value won't be included in the form submission. The required attribute name can be deduced from the descriptive error message.
			While an "id" attribute could be added, it's not necessary for the solution as it's primarily used for JavaScript DOM manipulation.


			[[File:Form With Element.png\|600px]]


			After adding the input element and entering any value, submitting the form will reveal both the "soulmate vegetable" result and the challenge's passphrase.


			[[File:Form Result.png\|400px]]


			=== Educational Value ===
			This challenge was designed to highlight several important web security concepts:
			* Browser Developer Tools provide extensive capabilities for modifying HTML structure and form elements
			* Client-side validation can easily be circumvented
			* The importance of server-side data validation and sanitization
			* Understanding how HTML forms transmit data to the server

	= Summary =		= Summary =

MLeitgeb: restructure

2024-12-17T21:40:42Z

restructure

← Older revision		Revision as of 21:40, 17 December 2024
Line 351:		Line 351:
	[[File:hiding_message_in_picture.png\|600px]]		[[File:hiding_message_in_picture.png\|600px]]

	== Port Knocking==		== Advanced Port-Knocking Guide with IP Firewall ==

			=== Introduction and Context ===
			Port Knocking is a technique for enhancing server service security. This advanced guide incorporates an IP firewall to default block access to HTTP Port 80, offering a hands-on opportunity to apply Port Knocking and firewall rules in a true-to-life setting.

			===Port Knocking Explanation===
	Port Knocking is an technique in the realm of network security that serves as an additional layer of security. Essentially, it is a method of controlling network access where a special sequence of port "knocking" or connection attempts is required to allow access to a protected service or server. This technique offers an effective way of protecting services from unauthorized access by minimizing the visibility of the ports required to access these services [1, 2].		Port Knocking is an technique in the realm of network security that serves as an additional layer of security. Essentially, it is a method of controlling network access where a special sequence of port "knocking" or connection attempts is required to allow access to a protected service or server. This technique offers an effective way of protecting services from unauthorized access by minimizing the visibility of the ports required to access these services [1, 2].

Line 361:		Line 366:

	Although Port Knocking offers an additional layer of security, it is not without weaknesses. One of the main vulnerabilities is the risk of Man-in-the-Middle attacks. In such a scenario, an attacker could intercept the communication between the client and the server and steal the knocking sequence. Once the sequence is compromised, the attacker can use it to unlock the protected service and gain access. Additionally, a carefully executed timing attack could also compromise the knocking sequence. Therefore, it is important to consider additional security measures such as encryption and two-factor authentication to enhance the effectiveness of Port Knocking [4, 1].		Although Port Knocking offers an additional layer of security, it is not without weaknesses. One of the main vulnerabilities is the risk of Man-in-the-Middle attacks. In such a scenario, an attacker could intercept the communication between the client and the server and steal the knocking sequence. Once the sequence is compromised, the attacker can use it to unlock the protected service and gain access. Additionally, a carefully executed timing attack could also compromise the knocking sequence. Therefore, it is important to consider additional security measures such as encryption and two-factor authentication to enhance the effectiveness of Port Knocking [4, 1].

	~~== ROOT ME Challenge: Advanced Port-Knocking Guide with IP Firewall ==~~

	~~=== Introduction and Context ===~~
	Port Knocking is a technique for enhancing server service security. This advanced guide incorporates an IP firewall to default block access to HTTP Port 80, offering a hands-on opportunity to apply Port Knocking and firewall rules in a true-to-life setting.

	=== Prerequisites ===		=== Prerequisites ===
Line 429:		Line 429:


	== Summary ==		= Summary =

	Penetration testing tools are a powerful weapon which can be used in a variety of ways for different purposes. Ethical hacking is more than ever needed in our society, especially for big companies which possess vast amounts of sensitive data from their customers. It is crucial to identify weaknesses of the system to protect its data from intruders. The way to achieve this goal is to know how hackers are working and what tools they are using in order to know how to defend the system. Root-Me provides a platform for learning penetration testing for free in an effective and efficient way. Users can not only hit challenges but also every member can add their own input: new challenges, interesting articles or own solutions.		Penetration testing tools are a powerful weapon which can be used in a variety of ways for different purposes. Ethical hacking is more than ever needed in our society, especially for big companies which possess vast amounts of sensitive data from their customers. It is crucial to identify weaknesses of the system to protect its data from intruders. The way to achieve this goal is to know how hackers are working and what tools they are using in order to know how to defend the system. Root-Me provides a platform for learning penetration testing for free in an effective and efficient way. Users can not only hit challenges but also every member can add their own input: new challenges, interesting articles or own solutions.

	== References ==		= References =

	* https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/		* https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/

MLeitgeb: /* Web-Client Challenge */

2024-12-17T21:32:35Z

Web-Client Challenge

← Older revision		Revision as of 21:32, 17 December 2024
Line 286:		Line 286:
	By the title of this challenge it is evident, that the prerequisite is intermediate knowledge and understanding of the scripting language Javascript. As Javascript is a client-side web technology, the idea is to use the integrated web browser console to manipulate the code and get the flag. Additionally the challenge contains resources, which might be helpful to understand the JavaScript obfuscation concept used in this challenge and how it is abused to make the code harder to understand and still keep its functionality.		By the title of this challenge it is evident, that the prerequisite is intermediate knowledge and understanding of the scripting language Javascript. As Javascript is a client-side web technology, the idea is to use the integrated web browser console to manipulate the code and get the flag. Additionally the challenge contains resources, which might be helpful to understand the JavaScript obfuscation concept used in this challenge and how it is abused to make the code harder to understand and still keep its functionality.

	[[File:Js obfuscation3.png\|600px]]~~<ref name="ROOT"/>~~		[[File:Js obfuscation3.png\|600px]]

	After starting the challenge, a website opens up, which prompts the user to enter the password. At this point we can just try to intuitively enter a common password to see what the output/response is going to be. We are going to try ''”admin”'' as our input and see, that an alert pops up with a ''”FAUX PASSWORD HAHA”'' message, which is French and stands for false password haha.		After starting the challenge, a website opens up, which prompts the user to enter the password. At this point we can just try to intuitively enter a common password to see what the output/response is going to be. We are going to try ''”admin”'' as our input and see, that an alert pops up with a ''”FAUX PASSWORD HAHA”'' message, which is French and stands for false password haha.
Line 313:		Line 313:
	By observing the code we can detect a function '''dechiffre(pass enc)''', starting at line 1, which takes a pass enc parameter. By going through the function it is obvious, that it always returns the pass variable, defined on line 2. This means, that trying different promp/function inputs will make no difference, as the default ''”FAUX PASSWORD HAHA”'' message will be displayed. The pass variable is Character Code and as a matter of fact can also be converted back to string format, by using the predefined JavaScript '''String.fromCharCode(value)''' function. We can try this by using the built-in web browser console and see the result.		By observing the code we can detect a function '''dechiffre(pass enc)''', starting at line 1, which takes a pass enc parameter. By going through the function it is obvious, that it always returns the pass variable, defined on line 2. This means, that trying different promp/function inputs will make no difference, as the default ''”FAUX PASSWORD HAHA”'' message will be displayed. The pass variable is Character Code and as a matter of fact can also be converted back to string format, by using the predefined JavaScript '''String.fromCharCode(value)''' function. We can try this by using the built-in web browser console and see the result.

	[[File:Console faux.png\|600px]]~~<ref name="ROOT"/>~~		[[File:Console faux.png\|600px]]

	At this point, we are familiar with the '''String.fromCharCode(value)''' function and therefore line 15 seems odd. It is a fact that the code has been obfuscated, ’uglified’ or in other words purposely harder to understand. Line 15 can be interpreted as a hint as the value passed to the '''dechiffre()''' function is in HEX. We already learned that the JavaScript console is a useful tool, which can also be used to perform the HEX to ASCII characters conversion. This can be done, by simply pasting the HEX string into the console as following:		At this point, we are familiar with the '''String.fromCharCode(value)''' function and therefore line 15 seems odd. It is a fact that the code has been obfuscated, ’uglified’ or in other words purposely harder to understand. Line 15 can be interpreted as a hint as the value passed to the '''dechiffre()''' function is in HEX. We already learned that the JavaScript console is a useful tool, which can also be used to perform the HEX to ASCII characters conversion. This can be done, by simply pasting the HEX string into the console as following:
Line 325:		Line 325:
	Last step was verifying our success on the Root Me platform by validating the challenge with the flag and we mastered the challenge!		Last step was verifying our success on the Root Me platform by validating the challenge with the flag and we mastered the challenge!

	[[File:ChallengeValidation.png\|300px]]~~<ref name="ROOT"/>~~		[[File:ChallengeValidation.png\|300px]]

	== Buliding your Own Challange ==		== Buliding your Own Challange ==

MLeitgeb: Add Web Client Example Challeng

2024-12-17T21:31:59Z

Add Web Client Example Challeng

← Older revision		Revision as of 21:31, 17 December 2024
Line 280:		Line 280:

	This challenge effectively combines several programming concepts: network socket programming, mathematical operations, string parsing with regular expressions, and handling time constraints. It demonstrates how automation can be used to solve problems that would be impossible to complete manually within the given time constraints.		This challenge effectively combines several programming concepts: network socket programming, mathematical operations, string parsing with regular expressions, and handling time constraints. It demonstrates how automation can be used to solve problems that would be impossible to complete manually within the given time constraints.

			=== Web-Client Challenge ===

			In this section, the solution to the ”Javascript - Obfuscation 3” challenge from the category Web-Client is presented.
			By the title of this challenge it is evident, that the prerequisite is intermediate knowledge and understanding of the scripting language Javascript. As Javascript is a client-side web technology, the idea is to use the integrated web browser console to manipulate the code and get the flag. Additionally the challenge contains resources, which might be helpful to understand the JavaScript obfuscation concept used in this challenge and how it is abused to make the code harder to understand and still keep its functionality.

			[[File:Js obfuscation3.png\|600px]]<ref name="ROOT"/>

			After starting the challenge, a website opens up, which prompts the user to enter the password. At this point we can just try to intuitively enter a common password to see what the output/response is going to be. We are going to try ''”admin”'' as our input and see, that an alert pops up with a ''”FAUX PASSWORD HAHA”'' message, which is French and stands for false password haha.
			As far as we can see, the website is blank and displays no HTML elements, which does not necessarily mean that there is no hidden content or code on the website. This is why the first of an advanced penetration tester will be, trying to interact with the website via browser by inspecting the content of the page.

			While analyzing the code and having the knowledge that this challenge is regarding JavaScript, we will be able to find an inline script in the HTML head element, which exposes the functionality of the password prompt. The inline script contains following content:

			1 function dechiffre(pass_enc){
			2 var pass = "70,65,85,88,32,80,65,83,83,87,79,82,68,32,72,65,72,65" var tab = pass_enc.split(’,’);
			3 var tab2 = pass.split(’,’);var i,j,k,l=0,m,n,o,p = ""; i = 0;j = tab.length;
			4 k = j + (l) + (n=0); n = tab2.length;
			5 for(i = (o=0); i < (k = j = n); i++ ){
			6 o = tab[i-l];
			7 p += String.fromCharCode((o = tab2[i])); if(i == 5)break;
			8 }
			9 for(i = (o=0); i < (k = j = n); i++ ){ o = tab[i-l];
			10 if(i > 5 && i < k-1)
			11 p += String.fromCharCode((o = tab2[i]));
			12 }
			13 p += String.fromCharCode(tab2[17]);
			14 pass = p;return pass;
			15 } String["fromCharCode"](dechiffre("\x35\x35\x2c\x35\x36\x2c\x35\x34\x2c\x37\x39\x2c\x31\x31\x35\x2c\x36\x39\x2c\x31\x31\x34\x2c\x31 \x31\x36\x2c\x31\x30\x37\x2c\x34\x39\x2c\x35\x30"));
			16 h = window.prompt(’Entrez le mot de passe / Enter password’);
			17 alert( dechiffre(h) );

			By observing the code we can detect a function '''dechiffre(pass enc)''', starting at line 1, which takes a pass enc parameter. By going through the function it is obvious, that it always returns the pass variable, defined on line 2. This means, that trying different promp/function inputs will make no difference, as the default ''”FAUX PASSWORD HAHA”'' message will be displayed. The pass variable is Character Code and as a matter of fact can also be converted back to string format, by using the predefined JavaScript '''String.fromCharCode(value)''' function. We can try this by using the built-in web browser console and see the result.

			[[File:Console faux.png\|600px]]<ref name="ROOT"/>

			At this point, we are familiar with the '''String.fromCharCode(value)''' function and therefore line 15 seems odd. It is a fact that the code has been obfuscated, ’uglified’ or in other words purposely harder to understand. Line 15 can be interpreted as a hint as the value passed to the '''dechiffre()''' function is in HEX. We already learned that the JavaScript console is a useful tool, which can also be used to perform the HEX to ASCII characters conversion. This can be done, by simply pasting the HEX string into the console as following:

			[[File:Console hex.png\|1200px]]

			The result of this operation is in a format, we might recognize, from our previous steps. Keyword: '''Character Code'''. Now the character code can be passed as an input to the '''String.fromCharCode(value)''' and it might return the flag to solve the challenge. The final outcome of the operation is shown below.

			[[File:Console flag.png\|500px]]

			Last step was verifying our success on the Root Me platform by validating the challenge with the flag and we mastered the challenge!

			[[File:ChallengeValidation.png\|300px]]<ref name="ROOT"/>

	== Buliding your Own Challange ==		== Buliding your Own Challange ==

MLeitgeb: restructure chapter

2024-12-17T21:28:07Z

restructure chapter

@@ Line 283: / Line 283: @@
 == Buliding your Own Challange ==
-So how to find an idea for the design of such a challenge? Based on the knowledge that was accumulated by solving tasks in programming and steganography, the challenge can be derived from the combination of the two topics Programming and Steganography.
+[[File:how_to_submit_challenge.png|600px]]
 The question arises how to hide information directly in the image without it being simply conspicuous by a symbolism or the like. During the research on the topic, it turned out that information can be hidden in the so-called Alpha Channel.
@@ Line 295: / Line 305: @@
 [[File:hiding_message_in_picture.png|600px]]
 == Port Knocking==
 Port Knocking is an technique in the realm of network security that serves as an additional layer of security. Essentially, it is a method of controlling network access where a special sequence of port "knocking" or connection attempts is required to allow access to a protected service or server. This technique offers an effective way of protecting services from unauthorized access by minimizing the visibility of the ports required to access these services [1, 2].

MLeitgeb: remove unnecessary chapter

2024-12-17T21:24:25Z

remove unnecessary chapter

← Older revision		Revision as of 21:24, 17 December 2024
Line 280:		Line 280:

	This challenge effectively combines several programming concepts: network socket programming, mathematical operations, string parsing with regular expressions, and handling time constraints. It demonstrates how automation can be used to solve problems that would be impossible to complete manually within the given time constraints.		This challenge effectively combines several programming concepts: network socket programming, mathematical operations, string parsing with regular expressions, and handling time constraints. It demonstrates how automation can be used to solve problems that would be impossible to complete manually within the given time constraints.

	~~== Steganography ==~~

	The Steganography is the art or also science of the hidden storage or also transmission of information in a carrier medium. The goal of this science is the secrecy and confidentiality. Information is hidden in such a way that a third party cannot suspect anything when looking at the medium.

	~~=== How does a Challenge can look (based on example) ===~~

	The challenge in the field of steganography was to find a geo location information in the picture. This information can be obtained in the meta information fields of the given image. After obtaining the geo location the name of the village where location points to needs to be typed into the validation field of the challenges.

	== Buliding your Own Challange ==		== Buliding your Own Challange ==

MLeitgeb: remove since more detailed programming challenge description not exists

2024-12-17T21:18:44Z

remove since more detailed programming challenge description not exists

← Older revision		Revision as of 21:18, 17 December 2024
Line 288:		Line 288:

	The challenge in the field of steganography was to find a geo location information in the picture. This information can be obtained in the meta information fields of the given image. After obtaining the geo location the name of the village where location points to needs to be typed into the validation field of the challenges.		The challenge in the field of steganography was to find a geo location information in the picture. This information can be obtained in the meta information fields of the given image. After obtaining the geo location the name of the village where location points to needs to be typed into the validation field of the challenges.

	~~== Programming ==~~

	Programming is about automating tasks. On the platform of Root-me these are challenges in the shell coding area where assembler payloads or shellcodes must be created. Important here is the speed because all tasks usually have a time limit. In the tasks, programming languages such as Bash or Python are used because they are well suited for the development of fast scripts.

	~~=== How does a Challenge can look (based on example) ===~~

	This challenge is about decoding string in a timeframe of 2 seconds. To start this challenge, the programmer need to send a private message to a bot named Candy and the message needs to contain !ep2. After that the bot will reply with a private message consisting of a series of encrypted characters. This ciphertext must be decrypted in the given timeframe and send back to the bot. If the bot does not reply, that means the user is locked out and must wait for a few minutes.

	== Buliding your Own Challange ==		== Buliding your Own Challange ==

MLeitgeb: add programming example challenge

2024-12-17T21:17:31Z

add programming example challenge

← Older revision		Revision as of 21:17, 17 December 2024
Line 215:		Line 215:

	This challenge teaches important concepts of network analysis, such as the structure of Ethernet frames, the identification of protocol headers, and the use of Base64 encoding in HTTP authentication. Successful completion requires basic knowledge of ASCII conversion and a systematic approach to protocol analysis.		This challenge teaches important concepts of network analysis, such as the structure of Ethernet frames, the identification of protocol headers, and the use of Base64 encoding in HTTP authentication. Successful completion requires basic knowledge of ASCII conversion and a systematic approach to protocol analysis.

			===Programming Challenge===

			This example showcases a challenge from the Programming category that combines networking skills with mathematical calculations under time constraints.

			[[File:TCP BackToSchool CHallenge.png\|400px]]

			The challenge titled "TCP - Back to school" requires establishing a TCP connection to challenge01.root-me.org:52002. Upon connection, the server sends two random numbers. The task is to calculate the square root of the first number and multiply it by the second number. What makes this challenge particularly interesting is the two-second time limit for sending the result back to the server. This time constraint necessitates an automated solution rather than manual calculations.

			The solution was implemented in Python, utilizing sockets for network communication and regular expressions for parsing the server's response. Here's the code that solves the challenge:

			<source lang="python">
			#!/usr/bin/env python3
			import socket
			import math
			import re
			# Connection details
			HOST = "challenge01.root-me.org"
			PORT = 52002
			# Create socket
			sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
			sock.connect((HOST, PORT))

			# Receive the challenge
			data = sock.recv(1024).decode()
			print(f"Received: {data}")
			# Extract numbers using regex
			numbers = re.findall(r'\d+', data)
			if len(numbers) >= 2:
			num1 = float(numbers[1])
			num2 = float(numbers[2])

			# Calculate result
			result = math.sqrt(num1) * num2

			# Round to 2 decimal places
			formatted_result = "{:.2f}".format(result)

			# Send result back
			sock.send((formatted_result + "\n").encode())
			print(f"Sending: {formatted_result}")

			# Get response
			response = sock.recv(1024).decode()
			print(f"Response: {response}")

			sock.close()
			</source>

			When executed, the program receives the challenge data, performs the calculation, and sends back the result within the required timeframe. A successful run produces output similar to this:

			<pre>
			Received:
			====================
			GO BACK TO COLLEGE
			====================
			You should tell me the answer of this math operation
			in less than 2 seconds !
			Calculate the square root of 318 and multiply by 8120 =
			Sending: 144800.34
			Response:
			[+] Good job ! Here is your flag: RM{TCP_C0nnecT_4nD_m4Th}
			</pre>

			This challenge effectively combines several programming concepts: network socket programming, mathematical operations, string parsing with regular expressions, and handling time constraints. It demonstrates how automation can be used to solve problems that would be impossible to complete manually within the given time constraints.

	== Steganography ==		== Steganography ==