47 VM Bob 1.0.1

Walkthru:

A. http://www.hackingarticles.in/hack-the-bob-1-0-1-vm-ctf-challenge/[webshell, robotos.txt, reverse shell, combining two o/s commands using && and ||, hidden content/information, spawing a python shell, ssh on non default port, search for txt file, password in text file, gpg file where keys is first alphabets of the line of a file,]

B. https://dangwasec.wordpress.com/2018/03/20/ctf-bob-1-0-1-walkthrough/ [burp]

C. https://hackso.me/bob-1.0.1-walkthrough/ [PGPCrack-NG is a program designed to brute-force symmetrically encrypted PGP files not useful here]


Notes:

file notes.sh

#!/bin/bash
clear
echo "-= Notes =-"
echo "Harry Potter is my faviorite"
echo "Are you the real me?"
echo "Right, I'm ordering pizza this is going nowhere"
echo "People just don't get me"
echo "Ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh <sea santy here>"
echo "Cucumber"
echo "Rest now your eyes are sleepy"
echo "Are you gonna stop reading this yet?"
echo "Time to fix the server"
echo "Everyone is annoying"
echo "Sticky notes gotta buy em"

Now it doesn’t make any sense at first, but if you look closely for every letter of the sentence and add each for the next consecutive line we are able to construct a word. ‘HARPOCRATES’ [from Walkthru B] and if you google the word it was the Greek god of silence, secrets, and confidentiality.

====

[from walkthru A]

following didnt work

gpg –batch –passphrase HARPOCRATES -d login.txt.gpg

so I tried following which prompts for pwd but worked

gpg --decrypt login.txt.gpg