Mossad 2018 challenge | Hacker News Reader

Mossad 2018 challenge

r-u-ready.xyz

25 pointsharel63 comments

Spoiler:

... as it was said, the first brainfuck program prints xor-with-key. The second program doesn't output anything but it sets the memory "array" with 12 non-zero values. By XORing these values with the phrase present in the image (12 characters too) you get "35.205.32.11" which can be an IP (something in Google's ranges), geographical coordinates (interpreted as x,y they point somewhere in Israel, in fact) or I don't know whatever else.

The IP is only accessible from inside Isreal, use a proxy from there and the IP works.

This link leads to page with the first challenge: "Your help is needed once again to solve an urgent matter. Our digital forensics division is trying to track the source of a phishing attack on one of our government officials..."

HaHaha! (cit.)

Yeah that's HEX decoded but I don't think it has anything to do with the solution. I'm not sure though.

I think it's more a joke from the fake 'anonymous' hacker in context to the tech-news. After some testing I think the solution could be within this so called 'pass-through' attack which is described in the tech-news.

There is an 'admin' account, with whom I think you can access the /administration site. For now I think the solution could be with modifying cookies, maybe the session cookie (after you create an account and log in) to get access to the admin account

I think the exploit would have something to do with the PNG profile picture upload feature, I've figured out how to upload my own files but not sure what I can do with this.

  >+-++<>-+--><[+-[
  ]+-]<+--+>[+--+]<
  [+>+<-]><----[-->
  +++<]>--.--------
  -.+++.[++>---<]>+
  +.-[----->++<]>-.
  +[->+++<]>+.+++++
  ++++++.----------
  --.----[->+++<]>+
  .-[-->+++++<]>---
  .------.[--->+<]>
  ++.[-]>+-++<>-+--
  ><[+-[]+-]<+--+>[
  +--+]<[+>+<-]><>+
  -++<>-+--><[+-[]+
  -]<+--+>[+--+]<[]

  +++++++++++[>++++
  +++++++<-]>+[<+>-
  ]-[>+<-------]>--
  -[<+>-][<+>-]>++>
  +[>++[-<++++++>]<
  <]>[<+>-]>+>++[++
  >++[-<+++++>]<<]>
  [<+>-]>+>+[>++++[
  -<++++>]<<]>[<+>-
  ]++++++++[>++++++
  +++++<-]>+[<+>-]+
  ++>>+>+[->+++[-<+
  ++++>]<<]>[<+>-]+
  +++++++[>++++++++
  <-]>+[<+>-]+++>++
  ++++>+>+-++<>-+--

Isn't that brainf*ck?

I'm thinking the same thing...

So the first task tests your endurance and patience...

Here's the beginning of the Left blue block, if anyone wants to continue:

>+-++<>-+--><[+-[

]+-]<+--+>[+--+]<

[+>+<-]><----[-->

Exactly what I thought, too. I guess you find an interpreter and see what happens.

Yes. The highlighted areas are:

>+-++<>-+--><[+-[ ]+-]<+--+>[+--+]< [+>+<-]><----[--> +++<]>--.-------- -.+++.[++>---<]>+ +.-[----->++<]>-. +[->+++<]>+.+++++ ++++++.---------- --.----[->+++<]>+ .-[-->+++++<]>--- .------.[--->+<]> ++.[-]>+-++<>-+-- ><[+-[]+-]<+--+>[ +--+]<[+>+<-]><>+ -++<>-+--><[+-[]+ -]<+--+>[+--+]<[]

=> xor-with-key

+++++++++++[>++++ +++++++<-]>+[<+>- ]-[>+<-------]>-- -[<+>-][<+>-]>++> +[>++[-<++++++>]< <]>[<+>-]>+>++[++ >++[-<+++++>]<<]> [<+>-]>+>+[>++++[ -<++++>]<<]>[<+>- ]++++++++[>++++++ +++++<-]>+[<+>-]+ ++>>+>+[->+++[-<+ ++++>]<<]>[<+>-]+ +++++++[>++++++++ <-]>+[<+>-]+++>++ ++++>+>+-++<>-+--

=> z.\SUY.ZA...

(hex values of the key: 7A B3 5C 53 55 59 03 5A 41 03 06 01)

xor-ing the .png with the key gives a data blob, so it's either an executable (which I'm not going to run) or I did something wrong.

Good effort!

z.\SUY.ZA... and Israel-is-70 (text from the picture) have the same length.

Coincidence?

No coincidences with games like this. :) (I went over it again, and of course a simple blob isn't just a binary, it has no magic bytes or anything, stupid.) Using "Israel-is-70" gives me ... 3?.205.32.11 Which of course looks like an IP-address, but incomplete (the ? is C0). Probably made a mistake with the decoding of the key-part of the brainfuck. Still, only 10 numbers to pick from: 3[0-9].205.32.11

Edit: thanks to Seagull for pointing it out already, the key was off by one byte. So that gives 35.205.32.11

Are you sure? By doing the XOR I get 35.205.32.11...

Ok, so actually the puzzle has been cracked. Nothing else we can do. This end was definitely not happy.

You're wrong... Go through an Israeli proxy to that IP (or via TOR by configuring exit nodes), it's only the beginning. ;-)

Perhaps, but the fact IP hidden behind the wall means that this challenge is not for everyone. Disappointing. Good luck in your adventure though!

The file won't run on linux as is, unless I've done it wrong.

    line 6: syntax error near unexpected token `)'

edit: it's not to do with executables, but with the "Israel is 70" text.

I think this is actually one byte off, I get 7A 46 5C 53 55 59 03 5A 41 03 06 01 (not output, but ends up in memory).

If someone wants to take a stab at it with OCR, these are the two highlighted portions of brainfuck

https://imgur.com/a/6r48NEN

Fellas, please, keep the politics out of it. You got Facebook for that... :)

You are incorrect, we are allowed to discuss politics on hacker news and have opinions on politics, especially when it intersects technology. It is done all the time here on hacker news.

From the guidelines:

    Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon.

This story was posted as one of technical interest. The political side effects are not of technical interest.

> Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon.

You are quoting a guideline about what stories should be posted to Hacker News, and using that in your argument that we can not discuss political aspects of a story. That is not the case.

> The political side effects are not of technical interest.

This is your opinion, which you are trying to pretend is a rule here on hacker news.

Not trying to pretend any rules. Just convention I've seen here over the years with some reference in the guidelines. If you feel you need to discuss politics, by all means - go crazy.

Has anyone gotten farther than registration? I'm stuck in the 35.205.32.11 page and I don't know how to advance from there. Any help anyone?

Is this supposed to be some penetration/decryption challenge? If I get in, I get a job?

The page description is 'Mossad 2018 challenge countdown'...

What to after I enter to the blog I don't get it from yesterday

Why would anyone who is aware of what's going on in the world today want to work for military/intelligence murderers? Deception is the main weapon for these scumbags and that very weapon is regularly used to fleece the rest of the population.

Unless you're going to work from the inside to expose their massive amounts of bullshit, I find it deplorable. Honestly, I think you'd have to be either brain-washed by the cult-like repetition of nationalism and military-hero worship or just a real evil asshole to dedicate your life to helping these people.

Recall when the Mossad assassinated someone in a Dubai hotel: https://www.youtube.com/watch?v=7d9KDysPbZ0

https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Ma...

The only reason I point this out is because many (most?) techies have a natural aversion to helping out this sort of thing.

It's totally fine if you don't. But it's easy to forget the end result.

He is a murderer and a terrorist. If you murder people because they are Israeli and you think you can get away with it, think again.

I didn't say it was an unjust assassination. Only that this is the business they're in.

This is the attitude that makes it hard for me to take Israel seriously. Like they have an inherent right to go after whoever wherever.

It feels like a CIA / KGB learned trait.

I think I'm most frustrated by the notion of other nations going to work in my country. You do you. But not in my yard, eh.

Ironically, that’s what makes it hard for me to take Hamas seriously — they feel like they can blow up a bus and yet if Israel responds, the “international” community has a conniption fit.

https://en.m.wikipedia.org/wiki/Jaffa_Road_bus_bombings

I'm just one opinion but mine is that neither behaviour is better than the other.

I'm curious, how do you interpret the above as the "right to go after whoever wherever?"

The parent comment disappeared so I cannot answer you without recalling from memory what was said. That's unfair because I don't have confidence in my memory.

I'm not saying you don't have a point, morally speaking.

But legally speaking do you agree that's probably not legal? And if so, then would you say it's OK to bypass the law with it's convenient for you?

They killed the cofounder of the military wing of Hamas. Hardly an innocent. Making a statement like “assasinated a person in a hotel” makes it sound like they killed some tourist rather than a man responsible for countless violence. If they assasinated Osama Bin Laden, would that be ok? As a “techie,” I would be proud to have helped take out someone like Bin Laden but I would of course, not be happy if that tech were used to intentionally kill innocent people. Ironically, the man killed had no problem himself directing the deaths of innocent civilians. It’s the difference between killing a wolf attacking kids on a playground versus shooting a family dog in someone’s living room. The two situations aren’t morally equivalent at all.

The end result of the Hamas assassination was that a violent and dangerous person who led the killing of countless civilians is dead. So yes, let’s not forget the end result — a wolf was shot before he could attack again.

I am not going to comment on intelligence services in general, but the example you provide is ironically, a counter argument for the point you seem to be attempting. You seem to be suggesting that techies generally would want to work to preserve life rather than take it and, with the Dubai operation, that’s exactly what happened: lives were saved by taking down a dangerous man with a history of leading the killing of innocent people.

Reply on news.ycombinator.com