Hack NI

For those of you stuck on the cyber security challenge:https://cybersecuritychallenge.org.uk/docs/cybersecuritychallenge.txt here’s how I did it:

First, the stream of characters is a base64 encoding. When you decode it you get a jpeg image:

If you follow the url you get the original image, but the new one contains something extra… a border. If you look closely a the border you’ll see it’s a stream of blocks…. perhaps binary? The best way to see this is to convert the image to monochrome bitmap, erase the original image, leaving just the border and then cut and paste the borders into one image. The order of the borders is important – read clockwise from top left (i.e. top is as is, right rotates 90 counter-clockwise, bottom rotates 180 and left rotates 90 clockwise). This leaves us with this:

If you view this file in a hex editor you’ll see it contains:

Cyrnfr sbyybj guvf yvax:      uggcf://plorefrphevglpunyyratr.bet.hx/834wgc.ugzy uggcf://pdorefrphevglpunyyratr.bet.hx/834wgc.qgzy

which if you ROT13 (http://www.rot13.com/index.php)you get:

Please follow this link:      https://cybersecuritychallenge.org.uk/834jtp.html https://cqbersecuritychallenge.org.uk/834jtp.dtml

Visit this url and you get more cipher to look at:

68edcdec4e2c8eae8d2c8e2dedcd6e04d2042fedae52ceac04ccedaecd8c042ccd8c046cedad0e8dac8eac8c048e0dac044aa82889046c0d2c8d8daccdecacc5042bedae4e04ee2dcd046ced8cac042d6e04046c2f4c664ea76e666cae4e268e2f456c0d088d8d66cdecac6546c6a506e6a546062606c504a141a1410a8dac2c6eac04acad2c2d8d048e0d2d6e046ced8cac048eed04edae4e048eac2cad042c8e04adac8c2d2c086c2f4cac4e6eac6cae4e2d8e2f6c0d2c8d8daccdecacc5ed4eecc5ae6dc50429cc042fedae524eac048e0dac04cc2d4e6e8e040eac4e6eedcd048eed048ced046eed85042ccd8c046c2ccd040e4eedceac042fedae04adacac8e048e0dac04ac8d2dec2d4c2d8d2d8e2f046c4e2d8eac4e2d2c0405484e2d8e2d6e0d046c2d8e2d4faccd046cae4e4eaccd8e8d2f044eac6e2d8caccd8e042dcd048e0dac04aa692504eeac04ee2d8d8d044cac042dcd048eedae6c0d048eed042c8cce2d6eac040dedee048eed046c8d2c2dad042fedae4e040e4e2d4facc504eaac8d8d048cedcdac042ccd8c04eceded8c048dae6c6d042dcd048e0dac04682f4cac4e046aac6cae4e2d8e2f04680d2c8d8daccdecac046cedad0eac8e2d8e2dedcd6e048e2c6d2dcdec040e8d2c6cac048e0d4eedaeec0dedae8e048e0dac044eac6e8e04edcc048e0dac042fac2c4ec5

If you look closely there’s a lot of “04″… perhaps this is a common letter? In fact this sequence “6e04d2042f” makes me think the 04 is a space, and D2 is a letter, perhaps “a”? If we go off the presumption that 04 is space, and lookup the ascii code for space, it’s 32 (0×20 in hex). So how to we convert 0×04 to 0×20? Shift left three times! (Thanks to otaku for the suggestion to use rotate). Use the following hacky perl script to convert the text:

sub conv{
  my $hex = shift;
  my $bin = sprintf "%08b", hex($hex);
  my $bin_rev = substr($bin,3,5) . substr($bin,0,3);
  $new = oct("0b".$bin_rev);
  return chr($new);
}
my $s = ...encoded_string...
for ($i=0; $i<length($s); $i+=2){
  $x = substr($s, $i, 2);
  my $hex='0x'.$x;
  print conv($hex);
}