Hi, within this lecture, we're going to continue where we left off from the previous one.
So remember, we have this data that we filed and each side of this data, that text file, we have
a hex dump of a file.
So first of all, we need to convert this into a file, leveraging that hex dump.
OK, so if we get the data that we can see the hex dump of that file.
So maybe you know how this works.
Maybe you don't know I'm going to show you anyway.
And in the tips, we have what we need, actually.
OK, so we have this tool called Xixi or XDA in order to leverage the hex and convert it into a file,
then we're going to focus on this one.
So this file apparently has been repeatedly compressed.
So this file has been compressed and it's it has been repeatedly compressed.
So multiple compression that we were dealing with and we're going to decompress that file.
It sounds easy, but I believe it's going to take some time.
And anyway, we have this temp file again.
So it suggests us to work with inside of the temp file, we temp folder.
I mean, and the general reason for this is that we get to write some files into the temp folder as
we move along over here.
So I'm going to show you what I mean.
If we write where my we get this Bendat 12.
So in the band of 12, I believe we don't have any permission to write files over here in the current
directory that we are into.
So we need to go into the TMB folder and we need to work it over there.
So if I come over here and write make dear to and I'm just going to write my name, which is until you
can do it with your own name as well.
OK.
And over here I'm going to go into that file or actually let me copy this.
OK, let me copy this data that takes me to that folder.
I'm going to come over here and say copy data that texte to Patil and I'm going to go into that folder
right now.
TMP Atheel.
And here we are.
We have the data that you see over there right now.
I can just do what I had to do and just write a new file.
Why would I need to write a file?
Because again, we have a hex dump and we're going to create a file using that hex dump.
OK, so we're going to use this Xixi.
I'm going to run the dash dash help in order to see the manual of this xixi now here go.
As you can see, we have a lot of parameters over here that we can give.
And what are we going to do with this tool is that we're going to give the text on file and we're going
to say convert this hex dump into an actual file.
OK, so as you can see, dush our stance for a reverse operation, we generally use Xixi to create a
hex dump also file, but if we have a hex we can create a file from it as well.
All you have to do is just write.
Does the dash are data that you in the temporary folder that you have created.
So once we do that, we're going to get some kind of a zip file, I believe, but we don't know the
extension yet.
So I'm going to output this.
And in order to do in order to do that, you have to just write greater design.
And I'm going to call mine until, OK, you can call it your own name.
So I have a file called Still, and it's basically a zip file, most probably.
OK, I'd say so in the description.
So we have to find out what kind of file is there.
So I'm going to write file a tilt.
And as you can see, until is a G zip compress data.
So this is Guiseppe.
So Jizzy, Jesus is a tool or kind of an extension, like a window zip like that zip doctora.
So maybe you're aware of that zip doctora files, but Giuseppe's something like that and we also have
B zip as well and we have also the tower as well.
But right now we are dealing with Guiseppe.
Maybe we will deal with the other ones later on.
So right now I have to use Gizab tool in order to decompress this one.
So I'm going to decompress the atheel file, OK, so that we can see the contents of the compressed
files or folders or whatever are facing, we don't know yet.
So we can use this file comment whenever we need to identify a file, as you can see.
Let's now try to use Guiseppe in order to decompress this.
And of course, you can see the manual of the GUISEPPE as well.
But it's very easy.
All you have to do is just say Dashty and write the file over here like Gizab Dashty until.
But as you can see, we got on air and most probably our file does not have an extension, that's why
we are getting this error right.
So this is all still, but it doesn't have the extension like until that.
So we have to make sure that it has the extension.
So I'm going to rename this in order to rename this.
We can use move comment and we comment.
OK, so we can use this comment in order to move a file to another folder.
But if we leave it inside of the same folder, we can also rename it in a way that we want.
OK, we can change the extension, we can rename it.
We can do whatever we want as long as we just leave it in the next in the same folder that we are currently
in.
So what are we what we want to do over here?
We can just write more until to Atheel that Jesus or get.
So here you go.
Right now we have this until that get over here, which is the Guiseppe extension.
So I'm going to try this one more time.
And here you go.
Now we have another file.
We have Uncompress this decompressed this I believe.
So the term is decompressing and if we write file until one more time, as you can see now we get another
thing, which is B, zip.
So again, this has been repeatedly compressed, as it says over here.
And B, zip is just another extension, another tool that we need to use to decompress this file one
more time.
So I'm going to move still to that because this I'm busy to so busy, too.
The is the extension of busy to like Guiseppe.
OK, so I'm going to use two and say Dashty and until that Beezy to one more time.
So the command is the same D for decompressing.
So I'm going to write file still and here you go.
We have another GCIB compressed data.
So again this is getting ridiculous.
As you can see, it's being repeatedly compressed.
However, we need to do what we gotta to do.
So I'm going to move this to chilidogs and I'm going to use one more time to decompress this.
Let's see.
Yeah, we have until one more time.
I'm going to call file still.
And here we go.
We have another format over here, which is the archive.
So again, this is kind of a zip format and we can use TR in order to decompress this.
The usage is a little bit different when it comes to TR.
If you have worked with Linux before, I believe you came across with TR, even though you haven't seen
the B, zip or zip is very common.
So I'm going to move this to till later and I'm going to say tr until Docteur.
OK, so here you go.
Once we do that, as you can see in the TAA, we still have the attitude that it didn't go away or something
like that.
But we have this data five that been filed.
So we have a binary file over here, which is a good thing.
I believe we're making progress.
So but if you run file data files that by being we can get another TR file, which is something that
we really don't want, but it's the case.
OK, so this is a type of file as well.
So I'm going to decompress this as we have done before, OK?
And we're going to see what it gives us back.
So again, we are still decompressing, even though we managed to decompress it multiple times.
We're going to do this one more time.
So I'm going to move this data five dubbin to another file.
We I believe we have until later, but it will overwrite it.
So I'm going to run TR except for Tailgater.
And here we go.
We have data six that bin which is a B zip to file.
Yeah, very good.
So I'm going to use the same technique that we have been doing so far.
OK, I'm going to turn this into a B zip file and then we're going to just decompress it until we get
the password.
So I'm going to move this data six that been to Atheel that Beezy to.
OK, so this is the extension that we need to work with.
So we have this busy too busy to Dashty till that busy too.
And here we go.
Once we do that, yeah.
We have this until file over here, which is weird if we're on file until this is a Takaya of.
I'm sick of this, so we need to work with Atheel, so I'm going to remove this until Docteur, I'm
going to remove data that we only have this atheel over here, which is what we're going to work with.
And I'm going to convert it to tar and I'm going to say tar filled that tar.
And once we do that, we have data état, that bean and Data eight up in is, again a zip file.
And I believe we need to decompress this to get data nine that been.
But let's see, I'm going to move this into the format.
So can we call this out or we can call this anything else as well, whatever you want over here.
But I'm going to call this my name till that Guiseppe, OK?
And I'm going to use Gizab to decompress until the Guiseppe if we run, unless we're going to see the
article, which is an ASCII text.
Finally, I believe we have finally the password over here.
So right now we only have the Sutil.
What I'm going to do, I'm going to run file one more time to make sure.
Yep, this is just a text file, so I'm going to cut it.
And here you go.
Finally, we have the password for the level 213 again.
Guys, this is a little bit overboard, I believe, repeatedly compressing.
I haven't seen something like this in another CTF, but this is what they want.
And I believe after this, you all know how to use Giuseppe's Panta.
So in a way, maybe it makes sense.
So let me start off this one and let me go into 2013 to see if this works or not.
And if it doesn't work, then we just I don't know.
We have been working for ten minutes I believe.
Yeah.
Here you go.
It works.
So we are inside of Bendit 13 and now we want to go to the Bendit fourteen.
So let me clear this up.
So let's see what it says.
The password for the next level is stored in Etsi Bend Pass, banded fourteen and can only be read by
user Bendit fourteen.
Very good.
So this makes sense for this level.
You don't get the next password, but you get a private H key that can be used to log in to the next
level.
So here you go.
We don't need to find the password over here.
All we need to do is just find and SSA key.
So I'm going to show you what this is does.
Let's see if it's just standing over there or sitting over there.
And we have a note over here.
Localhost is a hostname that refers to the machine you're working on.
OK, we know that already.
So SSL key, that private is just actually starting over here.
So we already have that one.
We can just do MSH from Bendit, thirteen to Bendit, fourteen assists.
Each key is a key that we use.
Rather than giving a password, we can just use this key in order to log in to some server.
So if you have this key you can just use it to log in basically.
OK, and I believe we already have that one, so I'm not going to exit out of this one.
Or we can just find a way to copy this as a key private to our local localhost.
But I believe there is no need to do that.
We can just run this as a help.
As you can see, as this H works embedded service as well.
And we can use this identified parameter over here.
We can just say SSA, Dashi, SSA, keep that private.
OK, so we are giving this SSA key.
That private file is a parameter to a parameter over here and we're going to use the port and the hosting
that we have been using.
We can use the localhost over here.
We're just going to say Bendit fourteen at localhost rather than writing the whole thing over here,
OK, because we are already inside of that server.
We were just switching to another user using and this is a key.
So I'm going to say Bendit fourteen that's localhost and I believe we don't even need to specify a port
over here.
We can just say enter and say yes.
And here you go.
We are inside of the Bendit for TI so but be aware that it says the password for this level at these
four, the level fourteen is saved under the ETSI Bendit pass.
So I'm going to make note of that.
I'm.
I'm just going to take the password from here in order to write into my notes and again, maybe this
will be some kind of help when it's when the time comes later, OK?
OK, so I'm going to get this file.
I'm going to say that Seabourne the password.
So not password.
Been the past bandit 14.
And here you go.
This is the Bendit 14 password.
And this we are currently inside of the Bendit 14.
But anyway, again, it's a good thing to have the passwords for the old levels.
We skipped the first four, but maybe you have just taken the note somehow in your own notes as well.
Right.
So here you go.
Now we are inside of the blended 14.
Now, what we want to do, we want to go to the Bendat 15.
So here you go.
It says that the password for the next level can be retrieved by submitting the password of the current
level to Port 300000.
Over here are thirty thousand.
Yep, thirty thousand on localhost.
So it's a good thing that we got that password.
We already knew how to get it.
So it's just sitting on their dachsie.
OK, but as you can see, we need it.
So what we want to do, we want to take that password.
We already have it and we want to submit that password to deport 30000 all localhost.
So how do we submit data to support?
Of course, if you say that's CAT, then you're right because it's a very convenient tool.
It's very easy to use.
You can just write nootkatone over here and see.
And if you have taken my previous courses, I believe you know how to use this.
I'm just going to say that's CAT localhost 30000.
And right after that I'm just going to write tests and we get nothing back.
But rather than test, maybe we can just take the password that we have saved over here like this.
So I'm going to copied this one and come back here and just paste it over there and hit enter and see
if this works or not.
So we are rating, we're rating and we're not getting any response from the server, I believe.
Let me try it like this.
So I'm just going to say Netscape Local 30000 and just hit enter and here you go.
Now it works.
It says correct.
And it gives us some kind of a password back.
And I believe this is the password for the level fifteen.
So I'm going to just come over here and paste the password for the level fifteen over there so that
we can move on to level fifteen.
Here you go.
I'm going to exit out of this one.
OK, and let's see.
Yeah, we can exit and it exited to the thirteen so I'm going to give it one more time and let me just
come over here and rather than thirteen or fourteen I'm just going to go for fifteen and it will ask
me for a password and I'm going to give the password and see if this works or not.
OK, paste this selection and here you go.
We are inside.
Let's continue within the next picture with the level fifteen.