Please ask questions ONLY in this topic.

A little girl made a website to post poetry related to peace and understanding. American fascists have hacked this website replacing it with Hitler-esque propaganda. Can you repair the website?

Re: stumped

Post by chez on Sat Jun 07, 2008 3:22 pm
([msg=4192]see Re: stumped[/msg])

I'm stuck on the old page. I have read up on directory traversals but don't understand how to apply them to this. Any time I play with the url I get the "That isn't allowed weirdo" error. I tried submitting poems with some ssi and sql injectios but it doesn't matter because the poems aren't saved so I can't open them up to run the ssi commands. I'm really stuck, can someone give me a push in the right direction. Something that hasn't been said yet?
chez
New User
New User
 
Posts: 1
Joined: Fri Jun 06, 2008 11:37 pm
Blog: View Blog (0)


Re: Transversing help

Post by coltlacrosse on Sat Jun 07, 2008 7:22 pm
([msg=4209]see Re: Transversing help[/msg])

Thanks that's just what I needed. When I was reading about DT I thought the two dots meant you would put something there, I didn't think .. was an actual instruction.
coltlacrosse
New User
New User
 
Posts: 3
Joined: Thu Jun 05, 2008 6:15 pm
Blog: View Blog (0)


Re: Need help again :D

Post by spinnakr on Sat Jun 07, 2008 10:43 pm
([msg=4228]see Re: Need help again :D[/msg])

Crystal_Bearer wrote:index.html

If you're still having problems, as I did, then this is very important.
spinnakr
New User
New User
 
Posts: 1
Joined: Sat Jun 07, 2008 5:12 pm
Blog: View Blog (0)


Re: stumped

Post by ndgani on Thu Jun 12, 2008 4:16 am
([msg=4581]see Re: stumped[/msg])

help!!!

i've managed to get this far without posting anything,so this will be my first post in hts.

there may be spoilers in this post so if your not interested,stop here.

i've found the previous index page and the pages linked to it.
i've found two functions i can use (submit/read).
i've read a few articales about directory transversal and got a pretty decent understanding of what it is, and how it can be used as an exploit.

but how am i supposed two to use it (or anything else for that matter) to switch between the index and oldindex.

i've tried to submit a poem containing the old index source code but i cant find it after submitted.i dont even know if this is the right track.

i just keep on getting a "you must enter a file" or "this isnt allowed wierdo" page.

what am i missing about DT?
ndgani
New User
New User
 
Posts: 1
Joined: Mon May 12, 2008 10:14 am
Blog: View Blog (0)


Re: Need help again :D

Post by XROM on Sat Jun 14, 2008 7:33 pm
([msg=4839]see Re: Need help again :D[/msg])

Just want to thank everyone for their assistance with this. It is so easy after you figure it out.
My hint - *nix commands not necessary!
XROM
New User
New User
 
Posts: 1
Joined: Sat May 31, 2008 10:58 am
Blog: View Blog (0)


Re: Need help again :D

Post by liuyuan on Sat Jun 14, 2008 9:02 pm
([msg=4849]see Re: Need help again :D[/msg])

Just want to clarify:

Despite bearing similarities between the two missions. (Basic 9 and Realist 4) they have NOTHING to do with each other besides directory traversal(it's called traversal, not transversal... It's not even a word...).

It's good if you can actually learn something...
Basic 9 takes advantage of server side includes vulnerabilities. Allowing server commands to be excused.
Realistic 4, however, takes advantage of a php file() function. The poetries were saved as... well... plain files with no extensions (such as .php, .txt) it's just loaded with include() or require() from the .php display script.

Here is a diagram I've made to help you understand this.
http://img294.imageshack.us/img294/2749/real4uy9.jpg

As a bonus, which is irrelevant to the mission, check out these.
http://www.hackthissite.org/missions/re ... he%20Idiot
http://www.hackthissite.org/missions/re ... ding%20War

Every time you get a "page not found" e.g. http://www.hackthissite.org/missions/realistic/3/poems/
it means the page is forbidden, but the file/directory actually exists!
Every time you get a witty comment and a page not found, it means it doesn't exists at all.

I know this because I've redirected all 403 forbidden to the "page not found" page, because I was tired of getting a anti-DDOS 403 Forbidden page XD
ImageImageImage
liuyuan
Experienced User
Experienced User
 
Posts: 64
Joined: Mon Apr 14, 2008 10:17 pm
Blog: View Blog (0)


Re: stumped

Post by Napster R on Sun Jun 15, 2008 7:39 am
([msg=4872]see Re: stumped[/msg])

i'm already at "add poem", but i don't know what to do now...

i already put -REMOVED- and it says: Sorry, you have the right idea how to beat the level, but the text you entered did not match the contents of the old website. You have to put the old website up, meaning putting up the old index.html

plz help me, i don't know what to do... just give me a clue

[Mod Edit]: Still too spoilerish.

EDIT: ok i did it, a clue: source is useful

i hope this is not too spoilerish, if it is please delete it
Napster R
New User
New User
 
Posts: 5
Joined: Sat Jun 14, 2008 6:46 am
Blog: View Blog (0)


Help plz

Post by podolop on Sun Jun 15, 2008 6:20 pm
([msg=4921]see Help plz[/msg])

Hey,
I can't even find the original page. There aren't any links in the source.
Any1 give me any tips/pointers?
No spoilers plz
thanks
podolop
New User
New User
 
Posts: 2
Joined: Fri Jun 13, 2008 2:21 pm
Blog: View Blog (0)


Re: stumped

Post by eoae on Mon Jun 16, 2008 9:13 am
([msg=4950]see Re: stumped[/msg])

I'm still stuck at the hacked page! :( I still cant find anything in the source despite reading it sooo many times. Is the source code supposed to be only 1 long line? and there is no link whatsoever to the original page. :?

[edit] nvm... found it. silly me... :mrgreen: tricky one.
"The hardest thing in the world to understand is the income tax." - Albert Einstein
"Government is an association of men who do violence to the rest of us." - Leo Tolstoy
User avatar
eoae
New User
New User
 
Posts: 26
Joined: Fri Jun 13, 2008 6:02 am
Blog: View Blog (0)


Re: stumped

Post by applebee on Mon Jun 16, 2008 8:03 pm
([msg=5006]see Re: stumped[/msg])

i got it.

thanks all.

hint: again dot dot slash are useful
applebee
New User
New User
 
Posts: 9
Joined: Wed Jun 11, 2008 2:27 am
Blog: View Blog (0)


PreviousNext

Return to (Real 3) Peace Poetry: HACKED

Who is online

Users browsing this forum: No registered users and 0 guests