Israeli Mossad launches cyber challenge
First Challenge Solution:
Mossad 2019 Challenge Start: <a href="https:&#x2F;&#x2F;r-u-ready-4.it&#x2F;" rel="nofollow">https:&#x2F;&#x2F;r-u-ready-4.it&#x2F;</a> Every line in the image is binary 8-bit number that will give you an ip address : 35.246.158.51<p>Challenge-1 :Link <a href="http:&#x2F;&#x2F;3d375032374147a7865753e4bbc92682.xyz" rel="nofollow">http:&#x2F;&#x2F;3d375032374147a7865753e4bbc92682.xyz</a> &#x2F; <a href="http:&#x2F;&#x2F;35.246.158.51" rel="nofollow">http:&#x2F;&#x2F;35.246.158.51</a><p>Download app.apk from <a href="http:&#x2F;&#x2F;3d375032374147a7865753e4bbc92682.xyz&#x2F;static&#x2F;app.apk" rel="nofollow">http:&#x2F;&#x2F;3d375032374147a7865753e4bbc92682.xyz&#x2F;static&#x2F;app.apk</a> Remember your Client ID - mine is 854279b4c89e4b5c9722352c3f9f1d6c You will user it as &quot;Seeder&quot; property in the app &#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F; using WireShark (or any other packet snipper) we can see that the login button does this:<p>POST &#x2F;auth&#x2F;v2 HTTP&#x2F;1.1si user-agent: iWalk-v2 content-type: application&#x2F;json; charset=utf-8 accept-encoding: gzip content-length: 29 host: 35.246.158.51:8070 {&quot;Seed&quot;:&quot;admin&quot;,&quot;Password&quot;:&quot;admin &quot;}HTTP&#x2F;1.1 200 OK Content-Type: application&#x2F;json Date: Wed, 08 May 2019 21:49:05 GMT Content-Length: 47<p>{&quot;IsValid&quot;:false,&quot;LockURL&quot;:&quot;&quot;,&quot;Time&quot;:149646302} &#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;&#x2F;<p>Using <a href="http:&#x2F;&#x2F;www.javadecompilers.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.javadecompilers.com&#x2F;</a>, i Decompiled the apk, and got a lock at the Manifest &lt; &lt;xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot; ....... &lt;activity android:configChanges=&quot;density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|orientation|screenLayout|screenSize&quot; android:hardwareAccelerated=&quot;true&quot; android:launchMode=&quot;singleTop&quot; android:name=&quot;com.iwalk.locksmither.MainActivity&quot; .... .....<p>The line &quot;look for us on github.com&quot; got my attention, so i looked for iwalk.locksmither in github and found &quot;iwalk-locksmithers&quot; linke: <a href="https:&#x2F;&#x2F;github.com&#x2F;iwalk-locksmithers-app" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;iwalk-locksmithers-app</a> the server source code was there. In the code, there are a few comments that can help<p><a href="https:&#x2F;&#x2F;github.com&#x2F;iwalk-locksmithers-app&#x2F;server&#x2F;blob&#x2F;master&#x2F;main.go" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;iwalk-locksmithers-app&#x2F;server&#x2F;blob&#x2F;master...</a> link 70 points us to the auth-1 weeknes.<p>the part of &quot;for currentIndex &lt; len(lock.Password) &amp;&amp; currentIndex &lt; len(loginData.Password) { if lock.Password[currentIndex] != loginData.Password[currentIndex] { break } &#x2F;&#x2F;OG: securing against bruteforce attempts... ;-) time.Sleep(30 * time.Millisecond) currentIndex++ }&quot;<p>the securing aginst bruteforce (tyring all combinations) is the weeknes. The idea behind for hacking the password is to try only one char at first. if we get a 30ms dealy, it means we got the 1st char right, so then we can check the next one, so we will try 2 chars (the 1st we know, the second we will guess) if we will get 60 ms +- dealy then we got th 2nd char and we will try the third one, and again and again, until we will get the password.<p>To solve it, it wrote a simple c# code that does in a loop http push to the server every time we try to add a new char to the password, and if we got a dealy that is +- 30ms more then the last try, we add that char our final password the uri is <a href="http:&#x2F;&#x2F;35.246.158.51:8070&#x2F;auth&#x2F;v1_1" rel="nofollow">http:&#x2F;&#x2F;35.246.158.51:8070&#x2F;auth&#x2F;v1_1</a> and user agent is ed9ae2c0-9b15-4556-a393-23d500675d4b (as writen in the server) I did some avg calcs of the dealys The password length is 32 with hexa char (didnt know that until i guessed the password) we can know that the password is correct when we get back &quot;IsValid&quot;:true&quot; *Time we get is in nano Seconds and not ms<p>After I enterd the pasword and cliend id, i got a link for a token and a linke for challenge 2<p><a href="http:&#x2F;&#x2F;759d8eba52184f538c8a4525680cfb33.xyz&#x2F;" rel="nofollow">http:&#x2F;&#x2F;759d8eba52184f538c8a4525680cfb33.xyz&#x2F;</a><p>Challenge-2 <a href="http:&#x2F;&#x2F;759d8eba52184f538c8a4525680cfb33.xyz&#x2F;" rel="nofollow">http:&#x2F;&#x2F;759d8eba52184f538c8a4525680cfb33.xyz&#x2F;</a>