What is it? @.@

Here is the place where I record some tactics about wargame, systems, and other security issues.

2012-11-15

Bright Shadows - JavaScript 3: "Hash the future!"

Description:
Try it!
Solution:
  1. When we enter the challenge page, it pop up an alert message like below, and if we click the button, it will redirect us back to the main page.
  2. So, the first thing we need to do to help us move on is to disable the JavaScript functionality of our browser.
  3. Now, view page source code and find the JavaScript part like below.

    <script type="text/javascript">
      date = new Date();
      year = date.getYear();
      add  = year;
      for (i = 1; i<= year;i++)
      {
        add +=year+i;
      }
      if (add == 395425559298) 
      {
        alert("Good job! You got it!");
        window.location.href=year+".php";
      }
      else
      {
        alert("No, no, no. Try it again!");
        window.location.href="/hackchallenge.php";
      }
    </script>
    

  4. After we read the code above, we realize that we seem to need to change the time setting of our system to conquer this challenge. However, you must know that the value of year has to equal to '513436'. It's beyond the setting.
  5. In a nutshell, the only way you can pass this challenge is visiting the URL below.
    hxxp://www.bright-shadows.net/challenges/levelj3/513436.php
  6. It's done!

No comments:

Post a Comment