Browse Month

July 2016

n00bz Level 12

Hacking for n00bz – Level 12

In level 12, we see the familiar Yoda from level 1 again. It says “Dig deeper!”

n00bz Level 12

Since they used back the same image from levelone, let us do a quick comparison between these 2 pages. The appearance are the same except for the words “May the source be with you!” vs “Dig deeper!”

What about the source code?

n00bz Level 12

Yes, I bet you have noticed it too – the newly inserted Cascading Style Sheets (CSS) file.

<link href="css/design.css" rel="stylesheet">

When you open it, it simply show you a class with a color element, of which the color hexadecimal is obviously not a color reference. So, what is it? A flag, perhaps?

 color: #696e666f7365635f666c616769735f686579696d6e6f7461636f6c6f72;

Once again, let’s use the same hexadecimal-to-string converter to perform the conversion, and now we have the flag – “infosec_flagis_heyimnotacolor

Back to write-up list for InfoSec Institute CTF #1: Hacking for n00bz

n00bz Level 11

Hacking for n00bz – Level 11

At first look, level 11 seems to be related to something specific to PHP scripting because it shows a very big PHP logo.

n00bz Level 11

After taking a careful look, the PHP logo looks different from the original logo. Moreover, if you read the page source, you will noticed that the PHP logo is named as “img/php-logo-virus.jpg”. Why name the file as virus?

Just to be sure, let’s run it using the file command to identify what kind of file is it. In my Linux system, I run the file command:

file php-logo-virus.jpg

And below is the output:

php-logo-virus.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 96×96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, name=infosec_flagis_aHR0cDovL3d3dy5yb2xsZXJza2kuY28udWsvaW1hZ2VzYi9w], baseline, precision 8, 450×237, frames 3

Did you see it? It says “infosec_flagis_aHR0cDovL3d3dy5yb2xsZXJza2kuY28udWsvaW1hZ2VzYi9w”

Running the encoded portion of the string through a base64 decoder tool will give you the following URL – “”, which essentially leads to an Error 404, page not found.

My logic – since the string turned out of be quite legit, yet the URL points to nothing. Probably the URL is incomplete. Therefore to verify this, we can run a strings command on the file to see what are the existing strings contained in the file.

strings php-logo-virus.jpg

Below is the output,

n00bz Level 11

True enough, the string we gotten earlier was incomplete. Now we have the complete string:


Let us put it through the base64 decoder tool again – there, it returns an image file –

n00bz Level 11

As strange as it seems to be, this is the flag for level 11, “infosec_flagis_powerslide

Back to write-up list for InfoSec Institute CTF #1: Hacking for n00bz

n00bz Level 10

Hacking for n00bz – Level 10

Level 10 has obviously hidden the flag in the sound, but how can we retrieve it?

What kind of sound is this? Sorcery perhaps??

n00bz Level 10

Just like what we have done for the previous levels which require us to analyze a file (e.g. exe, pcap), let’s download the “Flag.wav” file.

Since this is an audio file, you need to use an audio editor software to analyze it. One of the most popular audio editor tool in the market is Audacity. It is a free software that have been in the market for many years, I think I first came across this tool over 10 years ago! Back then, I used this tool to crop ring tones for my mobile phone.

Audacity is very simple to use. You just need to drag and drop the “Flag.wav” file into Audacity to open it. When asked to make a copy or read the files directly, you can choose to make a copy, it doesn’t really matter in our case.

n00bz Level 10

If you have played the audio, you will know that it is basically a very short high-pitch sound. As the program is able to identify/analyse the hertz of the audio file, you will see that it is currently 44,100 Hz. Let’s reduce it to 8000 Hz. Better now? I bet you could already hear something.

n00bz Level 10

To make it even better, you can select on the menu bar, “Effect > Amplify…” to increase the volume of the file. After doing so, you will hear the voice, letter-by-letter, spelling the flag – “infosec_flagis_sound

Back to write-up list for InfoSec Institute CTF #1: Hacking for n00bz

n00bz Level 9

Hacking for n00bz – Level 9

Level 9 shows a login page, the first thing I do is to view the page source… nothing fishy. What about the cookies? Using Firebug, I checked cookies and for a moment, I thought I see something interesting, a cookie named “lpv12882” which contains a base64 encoded string.

n00bz Level 9

However, upon decoding, I see that it is just the page URL of level 9, which is the challenge we are trying to solve now.

Back to square one, but don’t give up just yet. We can always try harder!

n00bz Level 9

Since the login form mentioned the system name, “Cisco IDS Web Login System”, let’s perform a Google search to see what is its default password.

You can easily find websites which shows you the default passwords for various products, in this case, the Cisco IDS. Based on the website, it seems like we can try following default login,

Username: root
Password: attack

We did it! There, we have the key now. But how do we crack it?

n00bz Level 9

You can try many different methods, trial and error. In this case, if you look carefully, the last 7 letters in the string looks familiar, very familiar… “infosec”, perhaps?

If you run the string “ssaptluafed_sigalf_cesofni” in a string-reverse tool, you will get the flag, “infosec_flagis_defaultpass

Back to write-up list for InfoSec Institute CTF #1: Hacking for n00bz

n00bz Level 8

Hacking for n00bz – Level 8

In level 8, we are being prompted to download a file called “app.exe” – seems like there is no other choice other than downloading it then.

n00bz Level 8

To be honest, I don’t know what to do with this executable (EXE) file at first also. However, after doing some reading, I learnt a little about reverse engineering and malware analysis. However, thankfully, in this exercise, we don’t have to do all that.

Before we get started, let’s take a look at the different tools which you can use to examine an EXE file,

  • Debugger: view and/or perform step-through on the running state of a program interactively
  • Disassembler: transform the machine code into a human readable mnemonic representation called assembly language
  • Decompiler: revert the process of compilation and turn a program into a structured higher-level language

In this exercise, we just need a debugger. There are several debuggers in the market, such as OllyDbg or WinDbg, both of them are free.

Personally, I prefer to use OllyDbg. This exercise is really simple. All you need to do is open up the “app.exe” file in your OllyDbg program and run it in debug mode (click on “play” button on the top).

n00bz Level 8

There, you see the flag written in ASCII right at the very first line of the program – the flag is “infosec_flagis_0x1a

Back to write-up list for InfoSec Institute CTF #1: Hacking for n00bz

  • 1
  • 2