Hack This Site: Realistic Web Mission – Level 6 Walkthrough : Thanks for stopping by, today we’re looking at Hack This Site Realistic Web Mission Level 6. I’ve been putting this mission on hold to try and write a bash script to decrypt the encryption. However, after several attempts at writing it and not making much progress, I decided to use somebody else’s script. I understand how the algorithm works and how to reverse it. However, writing something to reverse was proving harder than anticipated
Also read : HackThisSite, Realistic 1 – real hacking simulations
Introduction
We have a message from ToxiCo_Watch. They explain that they have been sniffing their companies network due to a toxic waste scandal. They believe that the company has paid off the inspectors but want evidence to prove it. During their network sniffing, they were able to capture, what they believe to be an encrypted message. However, they are having trouble decoding the message and have asked us to help.
Encrypted Message
ToxiCo_Watch has provided us with a link to a web application that contains the encoded message. The application also contains a link to the web application tool used to encode it. You can see from the image below that the message appears to be a full stop followed by three numbers. This pattern repeats until the end of the message.
Web Encryption Tool
If we head over to the link provided, we have an input box for the text to be encrypted. We also have an input box for the encryption password. If we submit a value without a password, we get some numbers at the top of the screen (4, 44, 49). If we add these numbers together we get 97. 97 is the ASCII decimal number for the letter A, we can repeat this process for other letters and get their corresponding ASCII decimal values returned. However, when we add a value to the encryption password box, the value changes. The value supplied to the encryption password box is also being converted to an ASCII decimal which is being added to the value of the submitted text ASCII value. It is then being split into three numbers which when calculated equals the ASCII value of the text plus the encryption password.
Also read : Hack This Site: Realistic Web Mission – Level 5 Walkthrough
Web Decryption Tool
Provided I explained the encryption process well enough, I should be able to explain how to decrypt it. First, I was going to copy the encoded message into a text file. Second, I was going to use sed to remove the full stops or periods. Third, I was going to use a loop with “expr substr” to pull 3 characters from the file. I was also going to us a variable that incremented 3 digits to jump to the next three characters. Fourth, I was going to calculate the value of the three numbers. Fith, I was going to subtract an incrementing value (representing the encryption password) from the total value. The script would then echo the results to the terminal.
This should have allowed me to identify the correct conversion. However, the script hasn’t gone as planned. I haven’t had as much time to work on it as I would have liked due to other commitments. Fortunately, my programming incompetence can be bypassed by using somebody else’s programming genius.Graeme Robinson’s bloghas a great JavaScript solution which we can use to decode the message.
Emailing The Client
Once we have the decoded information, we can send it in a message to ToxiCo_Watch. This should complete the challenge. I hope you can forgive me for not writing my own script to solve this one. I had a basic proof of concept ready but just haven’t had the time to complete it. Perhaps I will in the future and then update this blog.
3 comments