Summary
Here’s a link to the room:
[https://tryhackme.com/room/flip]
TASK [1] Source Code
First, go ahead and review the source code before moving on to Task 2.
You can review the source code by clicking on the Download Task Files button at the top of this task to download the required file.
import socketserver
import socket, os
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
from Crypto.Random import get_random_bytes
from binascii import unhexlify
flag = open(‘flag’,‘r’).read().strip()
def encrypt_data(data,key,iv):
padded = pad(data.encode(),16,style=‘pkcs7’)
cipher = AES.new(key, AES.MODE_CBC,iv)
enc = cipher.encrypt(padded)
return enc.hex()
def decrypt_data(encryptedParams,key,iv):
cipher = AES.new(key, AES.MODE_CBC,iv)
paddedParams = cipher.decrypt( unhexlify(encryptedParams))
if b’admin&password=sUp3rPaSs1’ in unpad(paddedParams,16,style=‘pkcs7’):
return 1
else:
return 0
def send_message(server, message):
enc = message.encode()
server.send(enc)
def setup(server,username,password,key,iv):
message = ‘access_username=’ + username +‘&password=’ + password
send_message(server, “Leaked ciphertext: ” + encrypt_data(message,key,iv)+‘\n’)
send_message(server,“enter ciphertext: ”)
enc_message = server.recv(4096).decode().strip()
try:
check = decrypt_data(enc_message,key,iv)
except Exception as e:
send_message(server, str(e) + ‘\n’)
server.close()
if check:
send_message(server, ‘No way! You got it!\nA nice flag for you: ’+ flag)
server.close()
else:
send_message(server, ‘Flip off!’)
server.close()
def start(server):
key = get_random_bytes(16)
iv = get_random_bytes(16)
send_message(server, ‘Welcome! Please login as the admin!\n’)
send_message(server, ‘username: ’)
username = server.recv(4096).decode().strip()
send_message(server, username +“‘s password: ”)
password = server.recv(4096).decode().strip()
message = ‘access_username=’ + username +‘&password=’ + password
if “admin&password=sUp3rPaSs1” in message:
send_message(server, ‘Not that easy :)\nGoodbye!\n’)
else:
setup(server,username,password,key,iv)
class RequestHandler(socketserver.BaseRequestHandler):
def handle(self):
start(self.request)
if name == ‘main’:
socketserver.ThreadingTCPServer.allow_reuse_address = True
server = socketserver.ThreadingTCPServer((‘0.0.0.0’, 1337), RequestHandler)
server.serve_forever()
~ In the source code you could find the password : sUp3rPaSs1
TASK [2] What is the flag?
Log in as the admin and capture the flag!
If you can…
Whenever you are ready, click on the Start Machine button to fire up the Virtual Machine. Please allow 3–5 minutes for the VM to fully start.
The server is listening on port 1337 via TCP. You can connect to it using Netcat or any other tool you prefer.
For better use of Netcat do use rlwrap
syntax : rlwrap nc