SANS Holiday Challenge 2012 Snow Miser Levels:
http://pen-testing.sans.org/holiday-challenge/2012
Snow Zone 0:
-- The flag for this level is 3b5a630fc67251aa5555f4979787c93f --
Snow Zone 1:
-- The flag for this level is 38bef0b61ba8edda377b626fe6708bfa --
Photo reflection in https://twitter.com/sn0w_m1s3r/status/276820932104957952/photo/1
http://snowmiser.counterhack.com/zone-1-D2E31380-50E6-4869-8A85-F9CDB3AF6226/
Snow Zone 2:
-- The flag for this level is b8231c2bac801b54f732cfbdcd7e47b7 --
The image off.jpg has metadata IceIceBaby! which can be used as a
passphrase for steghide extract against off.jpg
Data provided is "zone-2-6D46A633-25D7-42C8-AF94-8E786142A3E3"
ch@bluestem:~/snow$ exiftool off.jpg
[...]
User Comment : IceIceBaby!
[...]
ch@bluestem:~/snow$ steghide extract -sf off.jpg
Enter passphrase: IceIceBaby!
the file "tmpfile.txt" does already exist. overwrite ? (y/n) y
wrote extracted data to "tmpfile.txt".
ch@bluestem:~/snow$ cat tmpfile.txt
zone-2-6D46A633-25D7-42C8-AF94-8E786142A3E3
Snow Zone 3:
-- The flag for this level is 08ba610172aade5d1c8ea738013a2e99 --
Link /zone-3-EAB6B031-4EFA-49F1-B542-30EBE9EB3962 found in data from
android dump in file data/com.android.browser/cache/webviewCacheChromium/data_2 using grep.
ch@bluestem:~/snow/data$ find . -type f -exec grep -a zone-3 '{}' \; > zone3.out
ch@bluestem:~/snow/data$ grep -a zone-3 zone3.out
[...]
/zone-3-EAB6B031-4EFA-49F1-B542-30EBE9EB3962/' class="menu">Zone 3
[...]
Snow Zone 4:
-- The flag for this level is de32b158f102a60aba7de3ee8d5d265a --
Since the "zone-4-" part of the strings would be the same and the encrypted strings started the same way, it was just a matter of working backwards from the ciphertext back to the original.
z4.py:
#!/bin/python
#this is the known string "zone-4-F7677DA8-3D77-11E2-BB65-E4BF6188709B"
list1=[0x7a, 0x6f, 0x6e, 0x65, 0x2d, 0x34, 0x2d, 0x46, 0x37, 0x36,
0x37, 0x37, 0x44, 0x41, 0x38, 0x2d, 0x33, 0x44, 0x37, 0x37, 0x2d
, 0x31, 0x31, 0x45, 0x32, 0x2d,
0x42, 0x42, 0x36, 0x35, 0x2d, 0x45, 0x34, 0x42, 0x46, 0x36, 0x31,
0x38, 0x38, 0x37, 0x30, 0x39, 0x42]
#this is the known ciphertext for string above
list2=[0x20, 0xd9, 0x16, 0xc6, 0xc2, 0x9e, 0xe5, 0x3c, 0x30, 0xea,
0x1e, 0xff, 0xc6, 0x3b, 0x1c, 0x72, 0x14, 0x7e, 0xb8, 0x6b, 0x99
, 0x8a, 0x25, 0xc0, 0xcf, 0x1b,
0xf6, 0x69, 0x39, 0xe8, 0x62, 0x1b, 0x31, 0x32, 0xd8, 0x3a, 0xbb,
0x16, 0x83, 0xdf, 0x61, 0x92, 0x38]
#this is known ciphertext for unknown string
list3=[0x20, 0xd9, 0x16, 0xc6, 0xc2, 0x9e, 0xe5, 0x43, 0x43, 0xe8,
0x1f, 0xf1, 0xb1, 0x4c, 0x13, 0x72, 0x65, 0x0c, 0xbf, 0x19, 0x99
, 0x8f, 0x51, 0xb5, 0xc5, 0x1b,
0xf6, 0x6f, 0x49, 0xec, 0x62, 0x18, 0x40, 0x34, 0xa9, 0x4f, 0xc9,
0x19, 0x8f, 0xa9, 0x17, 0x98, 0x49]
#XOR first string by ciphertext to get the key, then use that key
against the second ciphertext to get the string
for z in range(0,len(list1)):
r = list1[z]
a = list2[z]
first = r ^ a
print first ^ list3[z]
:END z4.py
and then use bash to convert output to printable ascii
ch@bluestem:~$ python z4.py | awk '{printf "%c\n", $1}' | tr -d '\n'
zone-4-9D469367-B60E-4E08-BDF1-FED7CC74AF33
Snow Zone 5:
-- The flag for this level is 3ab1c5fa327343721bc798f116be8dc6 --
The hint at : https://twitter.com/h34t_m1s3r/status/276875683228176384
linked to the blog post at http://pen-testing.sans.org/blog/pen-testing/2012/12/06/all-your-svn-are-belong-to-us explains how to get the pristine copy of the page.
ch@bluestem:~$ wget http://snowmiser.counterhack.com/zone-5-89DE9B26-CF7D-4B07-88DE-7A2F0A7B16FE/.svn/wc.db
ch@bluestem:~$ sqlite3 wc.db 'select local_relpath, ".svn/pristine/" || substr(checksum,7,2) || "/" || substr(checksum,7) || ".svn-base" as alpha from NODES;'
svn-base" as alpha from NODES;'
|
noaccess.php|.svn/pristine/41/4134e0e954d144ed932fd639b5a897f9ad47fff9.svn-base
index.php|.svn/pristine/7d/7d63810b0da679648fc20b4f1c84680ac08ec872.svn-base
ch@bluestem:~$ wget snowmiser.counterhack.com/zone-5-89DE9B26-CF7D-4B07-88DE-7A2F0A7B16FE/.svn/pristine/7d/7d63810b0da679648fc20b4f1c84680ac08ec872.svn-base
Once you have this page, you learn that you need to pass the sha1 hash of "$time 7998f77a7dc74f182a76219d7ee58db38be3841c" or else you will be redirected to noaccess.php. In noaccess.php there is a line that provides the server time. So you need to get that time (within 3 minutes), hash it and send it back.
Here is what I used at the time I did it:
ch@bluestem:~$ echo -n "2012-12-20 22:36 7998f77a7dc74f182a76219d7ee58db38be3841c" | sha1sum
cdb74ef7530f56fe02fb50702611093305cf9f11
When you use this hash as the password on the Snow4 page, you will be granted access to Snow5.
