API tools faq
paste
Guest User

obj-8

a guest
Jan 8th, 2019
69
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.06 KB | None | 0 0
raw download clone embed print report
  1. <!DOCTYPE html><head><link rel="stylesheet" href="style.css" type="text/css" media="all"/><style type="text/css">.code-black-background{color:#e0e0e0;background-color:#1f1f1f;}</style></head><body><div class="entry-title entry-title-no-feat-img">
  2. <a href="https://www.jollyfrogs.com/objective-8-network-traffic-forensics/" title="Permalink to Objective 8: Network Traffic Forensics" rel="bookmark">
  3. <h1>Objective 8: Network Traffic Forensics</h1>
  4. </a>
  5. </div><div class="entry-content">
  6. <figure class="wp-block-image">
  7. <img src="objective8.gif" alt="" class="wp-image-871">
  8. </figure>
  9. <p>Difficulty: 4/5
  10. <br>
  11. <br>Santa has introduced a web-based packet capture and analysis tool at https://packalyzer.kringlecastle.com
  12. to support the elves and their information security work. Using the system,
  13. access and decrypt HTTP/2 network activity.
  14. <br><strong>What is the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball? <br></strong>
  15. <br>For hints on achieving this objective, please visit SugarPlum Mary and
  16. help her with the Python Escape from LA Cranberry Pi terminal challenge.
  17. <br>Note: SugarPlum Mary can be found on Floor 1, on the Western side of the
  18. lobby area
  19. <br>
  20. <br>Hints given:
  21. <br>Did you see Chris&apos; (https://www.youtube.com/watch?v=PC6-mn9g9Cs)
  22. &amp; Chris&apos; (https://www.youtube.com/watch?v=YHOnxlQ6zec) talk on
  23. HTTP/2.0?
  24. <br>
  25. <br>SugarPlum Mary:
  26. <br>As a token of my gratitude, I would like to share a rumor I had heard
  27. about Santa&apos;s new web-based packet analyzer - Packalyzer. Another
  28. elf told me that Packalyzer was rushed and deployed with development code
  29. sitting in the web root. Apparently, he found this out by looking at HTML
  30. comments left behind and was able to grab the server-side source code.
  31. There was suspicious-looking development code using environment variables
  32. to store SSL keys and open up directories. This elf then told me that manipulating
  33. values in the URL gave back weird and descriptive errors. I&apos;m hoping
  34. these errors can&apos;t be used to compromise SSL on the website and steal
  35. logins. On a tooootally unrelated note, have you seen the HTTP2 talk at
  36. at KringleCon by the Chrises? I never knew HTTP2 was so different!</p>
  37. <p>
  38. <br>The objective can be accessed directly via this link:
  39. <br>https://packalyzer.kringlecastle.com/
  40. <br>
  41. </p>
  42. <hr class="wp-block-separator">
  43. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  44. <p>Navigate to https://packalyzer.kringlecastle.com/
  45. <br>Click Register
  46. <br>Username: jollyfrogs
  47. <br>Email : thefrog@thepond.invalid
  48. <br>password: jollyfrogs
  49. <br>confirm password: jollyfrogs
  50. <br>Note: The username and password both need to be lowercase.
  51. <br>
  52. <br>After the username is created, login to Packalyzer with the new credentials.
  53. <br>
  54. <br>Once logged in, right-click the website and select &quot;View Source&quot;</p>
  55. <div
  56. class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/source.zip">source.txt (zipped)</a>
  57. <a
  58. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/source.zip"
  59. class="wp-block-file__button" download="">Download</a>
  60. </div>
  61. <p>The key bits of info from the source code are below</p>
  62. <pre class="wp-block-code code-black-background"><code>https://packalyzer.kringlecastle.com:80/pub/css/materialize.css
  63. https://packalyzer.kringlecastle.com:80/pub/js/loader.js
  64. //File upload Function. All extensions and sizes are validated server-side in app.js</code></pre>
  65.  
  66. <div
  67. style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  68. <p>The directories above seem to indicate that most of the source code is
  69. contained within the https://packalyzer.kringlecastle.com:80/pub/ folder.
  70. <br>
  71. <br>Navigating to https://packalyzer.kringlecastle.com:80/pub/app.js reveals
  72. the server-side NodeJS source code:</p>
  73. <div class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/app.zip">app.js (zipped)</a>
  74. <a
  75. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/app.zip" class="wp-block-file__button"
  76. download="">Download</a>
  77. </div>
  78. <p>The app.js file contains the following key bits of info</p>
  79. <pre class="wp-block-code code-black-background"><code>const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )
  80.  
  81. function load_envs() {
  82. var dirs = []
  83. var env_keys = Object.keys(process.env)
  84. for (var i=0; i &lt; env_keys.length; i++) {
  85. if (typeof process.env[env_keys[i]] === &quot;string&quot; ) {
  86. dirs.push(( &quot;/&quot;+env_keys[i].toLowerCase()+&apos;/*&apos;) )
  87. }
  88. }
  89. return uniqueArray(dirs)
  90. }</code></pre>
  91.  
  92. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  93. <p>From the information above, both process.env.DEV and process.env.SSLKEYLOGFILE
  94. are pushed (used) as website directories.</p>
  95. <p>Browsing to https://packalyzer.kringlecastle.com/DEV/ reveals it is a
  96. directory, although we do not yet know what file to access in it.</p>
  97. <pre
  98. class="wp-block-code code-black-background"><code>Error: EISDIR: illegal operation on a directory, read</code>
  99. </pre>
  100. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  101. <p>Browsing to https://packalyzer.kringlecastle.com/SSLKEYLOGFILE/ reveals
  102. the SSL key log file name &quot;packalyzer_clientrandom_ssl.log&quot;</p>
  103. <pre
  104. class="wp-block-code code-black-background"><code>Error: ENOENT: no such file or directory, open &apos;/opt/http2packalyzer_clientrandom_ssl.log/&apos;</code>
  105. </pre>
  106. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  107. <p>Together, the directory and the file name reveal the SSL key log file
  108. contents</p>
  109. <div class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/packalyzer_clientrandom_ssl.zip">packalyzer_clientrandom_ssl.log (zipped)</a>
  110. <a
  111. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/packalyzer_clientrandom_ssl.zip"
  112. class="wp-block-file__button" download="">Download</a>
  113. </div>
  114. <p>Using the Packalyzer &quot;Sniff Traffic&quot; feature, a capture is taken</p>
  115. <div
  116. class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/69805829_1-1-2019_2-0-52.zip">69805829_1-1-2019_2-0-52.pcap (zipped)</a>
  117. <a
  118. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/69805829_1-1-2019_2-0-52.zip"
  119. class="wp-block-file__button" download="">Download</a>
  120. </div>
  121. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  122. <p>In Wireshark, the contents of the pcap file are decoded using the &apos;packalyzer_clientrandom_ssl.log&apos;
  123. file. The decoded contents reveal the credentials of a few elves, including
  124. &apos;alabaster&apos; who has admin privileges.</p>
  125. <pre class="wp-block-code"><code>Open 69805829_1-1-2019_2-0-52.pcap in WireShark
  126. In Wireshark, click &quot;Edit&quot; menu
  127. &quot;Preferences...&quot;
  128. &quot;Protocols&quot;
  129. &quot;SSL&quot;
  130. (Pre)-Master-Secret log filename: packalyzer_clientrandom_ssl.log
  131. Click &quot;OK&quot; - the encrypted SSL streams are decrypted
  132.  
  133. In the top bar, type: http2.data.data
  134. Highlight one of the &quot;DATA[1] (application/json)&quot; packets
  135. Expand &quot;HyperText Transfer Protocol 2&quot;
  136. Expand Stream: DATA, Stream ID: 1, Length 98
  137. Highlight &quot;JavaScript Object Notation: application/json&quot;
  138. {&quot;username&quot;: &quot;alabaster&quot;, &quot;password&quot;: &quot;Packer-p@re-turntable192&quot;}</code></pre>
  139.  
  140. <div
  141. style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  142. <p>Login to the Packalyzer website using Alabaster&apos;s credentials:
  143. <br>username: alabaster
  144. <br>password: Packer-p@re-turntable192
  145. <br>
  146. <br>And download the capture file &quot;super_secret_packet_capture.pcap&quot;,
  147. (the file is renamed to &quot;upload_2a4a5ae98007cb261119b208bf9369ef.pcap&quot;
  148. when downloaded)</p>
  149. <div class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/upload_2a4a5ae98007cb261119b208bf9369ef.zip">upload_2a4a5ae98007cb261119b208bf9369ef.pcap (zipped)</a>
  150. <a
  151. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/upload_2a4a5ae98007cb261119b208bf9369ef.zip"
  152. class="wp-block-file__button" download="">Download</a>
  153. </div>
  154. <p>Using Wireshark, open the file &apos;upload_2a4a5ae98007cb261119b208bf9369ef.pcap&apos;
  155. and right-click any packet -&gt; Follow -&gt; TCP Stream. This will show
  156. the raw SMTP email from &quot;Holly.evergreen@mail.kringlecastle.com&quot;
  157. to &quot;alabaster.snowball@mail.kringlecastle.com&quot;.
  158. <br>
  159. <br>Copy the Base64 encoded attachment, and decode it in using Kali</p>
  160. <pre
  161. class="wp-block-code"><code>root@kali ~# leafpad attachment.b64
  162. root@kali ~# cat attachment.b64 | base64 -d &gt; objective8
  163. root@kali ~# file objective8
  164. objective8: PDF document, version 1.5
  165. root@kali ~# mv objective8 objective8.pdf
  166. root@kali ~# evince objective8.pdf</code>
  167. </pre>
  168. <div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
  169. <div class="wp-block-file"><a href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/objective8.pdf">objective8</a>
  170. <a
  171. href="https://www.jollyfrogs.com/wp-content/uploads/2019/01/objective8.pdf"
  172. class="wp-block-file__button" download="">Download</a>
  173. </div>
  174. <p>The song name referenced in the PDF is:
  175. <br><strong>Mary Had a Little Lamb</strong>
  176. </p>
  177. <div class="link-pages"></div>
  178. </div></body></html>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!