Find the flag (pwned{...}) [Macro] Note: Microsoft Defender likely flags this as malware...

Can you de-obfuscate the string in the files? [com.supercell.titan.C2943z1] [com.supercell.titan.GameApp] [These are from Maddie Stone's Android App Reversing Course]

Can you decompile my script for me, I accidently deleted the source code! [Compiled version]

Get the flag from this horrendous script.

[This program] seems to tell you if you've guessed the flag correctly, try figuring out how to make it tell you the flag!

They're getting better now, ltrace won't work on [this one], we'll have to use strace instead.

Another [program that manages passwords], try to expose it using ltrace.

We've found [this program], we have no idea what it does but we do know that if the correct password is typed in you'll know the flag. For reference the example angr code is:

Connect to the luhack-bof lab and visit [http://100.67.194.235/] Solve the back_to_the_libc challenge

Connect to the luhack-bof lab and visit [http://100.67.194.235/] Solve the shellcode_me challenge

Connect to the luhack-bof lab and visit [http://100.67.194.235/] Solve the ez challenge

Connect to the luhack-bof lab and visit [http://100.67.194.235/] Solve the login_server challenge

[File]

[File]

Lorem ipsum dolor sit amet occaecat laborum culpa minim, qUis occaecat esse nulla. irure velit aliquip cillum deserunt enim nostrud lorem officia esse aliqua cupidatat laborum voluptate eu amet ea eu incididunt. ullamco repreHenderit ex lorem consequat quis cillum enim officia enim est Aliquip ad nostrud laborum dolor ex anim amet enim mollit nisi. et Commodo tempor dolor et ad proident elit aute elit temporK. exercitation culpa ut esse et aliqua ea qui magna. id do eu reprehenderit tempor...

[File]

Compare the meerkats [Meerkat 1] [Meerkat 2]

[File]

[Files]

??? [File]

This one also needs some reversing, can you figure out what it's doing to the password? [get it here] Also, a note about stack strings: compilers like to load strings into memory by splitting the string into chunks of 8 bytes, and loading each chunk as a 64 bit integer. Radare2/Cutter will attempt to show you the content of these strings as an annotation, but sometimes you need to use your intuition. ...

No cracking this time, take a look and see what this program is doing: [get it here]

A bit more difficult this time (I think), might be a bit more complicated than flipping a jump: [get the program here]

Crack this program and the flag will be yours: [get it here]

This one needs a lot of brainpower: [get the program]

Sometimes you can just dump the firmware

Take a deeper look into neopixels :)

Check for usb serial devices :)

Try tracing the logs (You'll have to find the serial port pin :))

Dot Dot Dash

Join kingdom-construction-0 in the LUHack discord and navigate to [http://100.116.180.215/] This challenge was created by: Modded_Technic#0616

What is the ASK signal saying? This signal starts with a sequence of 16 high/low bits before the first character, make sure you align things.

What is the FSK signal saying? This signal starts with a sequence of 16 high/low bits before the first character, make sure you align things.

What is our pirate radio station broadcasting? (all lowercase)

Look very closely

Read the flag of the root6 account

Break into the root3 account

Escalate to the root2 account

Escalate to the root5 account

Escalate to the root4 account

Escalate to the root1 account

Escalate to the root0 account

We've received the following transmissions and their encrypted couterparts: plain text According to all known laws of aviation: there is no way a bee should be able to fly. cipher plain text Once upon a time there was a lovely princess. But she had an enchantment upon her of a fearful sort which could only be broken by love's first kiss. cipher

TFVIYWNre2Jhc2U2NF9pc19lbmNyeXB0aW9uP30=

4c554861636b7b636f6d706c6574656c795f68696464656e5f66726f6d5f73696768747d

Decrypt the file to find the flag [locked.zip] A dictionary might come in handy...

Decode the message to find the flag

Decode the message to find the flag You will need to put your answer in the LUHACK{...} format Made by pink#3872

Decode the message to find the flag Made by pink#3872

Decode the message to find the flag Made by pink#3872

Kerry is naive and clicks on every link you send her, try using a csrf vulnerability to steal her money. Box: luhack-web-0 Port: 8083 Url: [http://100.127.159.170:8083]

Try exploiting the ssti to run arbitrary code and get the flag. Box: luhack-web-0 Port: 8084 Url: [http://100.127.159.170:8084]

Try exploiting the sqli to dump the users table. (sqlmap may be useful) Box: luhack-web-0 Port: 8085 Url: [http://100.127.159.170:8085]

Any way to get me access to this new album from my favourite band? (This one is a little tougher!) Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

My steam wallet is running low. I've tried all the logins we found previously. This might require something new? Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

I want free access to movies. Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

More passwords to find! Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

You've found the login page for the site. Can you get access? Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

This is a basic pin brute force. You've been given access to this page with a 4 digit pin. Can you build a script to crack it? Box: luhack-web-0 Port: 8082 Url: [http://100.127.159.170:8082]

You're not admin, are you? Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

Can you login to an account? (Try doing #4 first) Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

(broken, sorry. Try web-sqli instead) Can you inject the login page? Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

Hack the Network Test page. Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

Another easy one, just look and pretend you're a robot 👀 Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

This is an easy one, just look around... Box: luhack-web-0 Port: 8081 Url: [http://100.127.159.170:8081]

Pwn windows box with EternalBlue (Flag is on the desktop of the LUHack user) Boxes: win-infra-<0..n> If this doesn't work, try one of the other win-blue machines. EternalBlue likes to trigger BSODs.

Pwn vsftpd Box: luhack-infra-0

Pwn Unrealircd Box: luhack-infra-0 (If you use a bind shell, use port 10001)

Pwn redis (Make sure you use a bind shell on port 10000) Box: luhack-infra-0 (cmd/unix/bind_netcat is a good payload btw)

Find the subdomain of luhack.me Answer format: <subdomain>.luhack.me

Find a weird user on the SMTP server. They're not one of these: (hint: /usr/share/wordlists/metasploit/unix_users.txt is a good wordlist) Box: luhack-enum-0

Throw dirb at it. Box: luhack-enum-0

I hope you're not a robot? Box: luhack-enum-0

Somewhere in a SMB share... Box: win-enum-0

The second flag from the FTP server. (you might want to come back to this later) Box: luhack-enum-0

Our ftp server isn't as secure as we hoped. Box: luhack-enum-0

Find the hidden flag on the DNS server! Box: luhack-recon-0 Hint: How can we read all records of a DNS server?

What is the content of the txt.luhack.local record? Box: luhack-recon-0

What is the IP address of test.luhack.local ? Hint: use dig or nslookup Box: luhack-recon-0

What protocol normally runs over port 53?

How many TCP ports can possibly exist on a system?

Is port 993 open? (yes/ no) Box: luhack-recon-0

Is port 999 open? (yes/ no) Box: luhack-recon-0

What is the SSH fingerprint of the server? Box: luhack-recon-0 Format: SHA256:...

What IMAP software is running? Box: luhack-recon-0

What is the SMTP banner? Box: luhack-recon-0

What is the banner of port 42069? Box: luhack-recon-0

What is the Organizational Unit (OU) of the certificate server on port 443? Box: luhack-recon-0

What is the hostname (Common Name) of the certificate served on port 443? Box: luhack-recon-0

What version of FTP software is running? Box: luhack-recon-0 Format: SoftwareName x.y.z

What web server software is running? Box: luhack-recon-0 Format: SoftwareName httpd x.y.z

What version of BIND is running? Format: x.y.x Box: luhack-recon-0

I think Van Gogh stopped by 🎨. Let's look at his masterpiece in the [art gallery] The word LUHACK in the flag is uppercase when you submit

Find the flag that has been hidden in a DNS exchange in one of the pcaps!

What is the SSH version of the server? [PCAP]

Get the flag [🧐]

[Can you hear the flag (uppercase)???]

What is the passwords? 🤔 [here]?

What is the URL that is in the DNS TXT response in [here]?

Decrypt [this traffic] using [ssl.log], what is the path the user is GETing?

Using the [JA3 plugin for Wireshark], what is the User-Agent of the host making the connection in [here]? (JA3 of TLS Client Hello)

Solve this: [https://cdn.discordapp.com/attachments/763411669648408606/809114712717262928/bad]

Here's a linux program compiled by another program I wrote, it should be fairly unintuitive to reverse engineer so good luck! [https://cdn.discordapp.com/attachments/631618075254325257/759334352886169640/a.out] Since I'm nice, here's the source code: [https://gist.github.com/simmsb/28c165087b301fcce234c1533861421e] And here's the source code of the compiler: [https://github.com/simmsb/some-scheme-compiler]