Hack the SpyderSec VM (CTF Challenge)

You are looking for two flags. Using discovered pointers in various elements of the running web application you can deduce the first flag (a downloadable file) which is required to find the second flag (a text file). Look, read and maybe even listen. You will need to use basic web application recon skills as well as some forensics to find both flags.

Level: Intermediate

You can download it from à https://www.vulnhub.com/entry/spydersec-challenge,128/#

Walkthrough

Let’s locate our target first.

netdiscover

Our target is 192.168.0.103. Now let’s fire up the nmap to know their services.
Nmap –A –p- 192.168.0.103

There are only two ports open i.e. 22 and 80 for SSH and HTTPS respectively. Next, I opened this page in browser.

There was nothing major on the page except for two images. There is a possibility about metadata behind these images. Therefore, I read these images with exif tool. One of the images which were saved by the name of “challenge” had a comment behind it. To read it type:

exiftool Challenge.png

If you observe closely the comment is in hexadecimal form. We need to convert it into readable form. No third party tool is required just go online to string-functions.com copy the string and paste it in the text box and then click the convert button.

After converting we again have hexadecimal string. No problem. Let’s convert it again as we did earlier.

This time we have base64 string. We convert it into non-cipher text by using HackBar. Paste the string and select Bsae64 decode option from the Encoding drop down menu.

Now finally we have a readable string. This can be a password or a directory. Note it down for future use. Moving on if you go through the source code of the page you will that evil function is quite unusual

I searched about eval function on google and found that it is a java script. There can be code hidden behind it. So let’s unpack it with the javascript unpacker.

After unpacking you will again come face to face with a hexadecimal string. Convert this string just like before.

After conversion the string became “alert(‘mulder.fbi);” .  I explored a lot and found a lot found nothing about it so decided to capture its cookies through BurpSuite. Now we are going to use Burpsuite that means we have to turn on manual proxy. And then turn on the interception on Burpsuite and then simply refresh the page and then with not much hard work cookies will be captured

In cookies I found a URI that means it’s a part of a link. Go to the params tab to see the proper link.

From here copy the link and open it in the browser.

Now when I opened it there was an error.  Then I explored a d bit and remembered that there was a mulder.fbi so I added that to the link.

After adding mulder.fbi to the link it asked me to download a file. Save it.

When you open the file that you just saved then it will play a video with different quotes. Now I was clueless about this so I started searching about it on google. And I found out that it was a truecrypt file. So to see what is hidden type:

python tcsteg2.py mulder.fbi

There was a whole drive hidden behind it. And using veracrypt you can see and open the drive.

When you open it will ask for a password and we have found the password beforehand. So give the password there.

Hence the drive will be unlcocked. Now open the drive. And you will find flag there.

Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast