There is a puzzle embedded in this page...
weebly.com
weebly.com
There is still a bit of inline CSS left, but that's generated by code.
Update: Wow! Can't believe I actually spent 20 minutes with Wireshark trying to reply with the actual TCP packets that were next in the handshake sequence.
Update 2: Finally solved it :) Pro-tip: keep it simple.
#!/ova/fu -r
HEY="uggc://jjj.jrroyl.pbz/jrroyl/choyvpOnpxraq.cuc?"
QNGN="cbf=fbyirchmmyr"
# Gvzrfgnzc nhgu
GVZRFGNZC=$(phey -f -i -q $QNGN $HEY 2>&1 | terc "Qngr:" | phg -p 9- | ehol -egvzr -r "chgf Gvzr.cnefr($<.ernq).gb_v")
# FLA-NPX nhgu
QNGN+="&nhgu=$GVZRFGNZC&zft=FLA-NPX"
ZQ5=$(phey -f -q $QNGN $HEY | rterc ^[n-s0-9]+)
# ZQ5 penpx
# (uggc://jjj.bcrajnyy.pbz/wbua/)
ARKG=$(rpub $ZQ5 | ~/Qbjaybnqf/wbua-1.7.6-*/eha/wbua --sbezng=enj-ZQ5 /qri/fgqva --fubj | terc "?:" | phg -q ':' -s 2)
QNGN+="&arkg=$ARKG"
# Onfr64
phey -f -q $QNGN $HEY | rterc ==$ | onfr64 --qrpbqr
# ... bx, fb abj jr'er xvaqn purngvat.
ZNTVP_AHZORE=$(phey -f "uggc://pqa1.jrroyl.pbz/yvoenevrf/fvtahc.wf?ohvyqgvzr=1289442390" | terc "ine o =" | rterc -b "[0-9]+")
rpub gur_nafjre_vf_$(rpub "$ZNTVP_AHZORE * 2" | op)It's not meant to be incredibly difficult, just fun and challenging enough to take 30 minutes or so.
Almost all of the solution in Haskell (except for the bit about extracting the actual answer from the Javascript); it's probably not what they intended, since the job is for a web-dev, but most of us here are probably just doing it for fun. I found the bit about guessing what string was hashed to make the MD5 the hardest, because it was basically just pure brute force (I didn't know what timezone it was in or what date format was used - so the hint wasn't very helpful).
import Network.URI
import Network.HTTP
import Data.Maybe
import Data.Time.Clock.POSIX
import Data.Time.LocalTime.TimeZone.Olson
import Data.Time.LocalTime.TimeZone.Series
import Data.Time.Clock
import Data.Time.LocalTime
import Data.Time.Calendar
import Text.Printf
import Control.Monad
import Codec.Binary.Base64.String
main = do
-- Is there a more portable way to do this?
pdtTZS <- getTimeZoneSeriesFromOlsonFile "/usr/share/zoneinfo/America/Los_Angeles"
pdtTime <- liftM (utcToLocalTime' pdtTZS) getCurrentTime
let next = printf "w%02d%02d" ((\(_, _, d) -> d) . toGregorian . localDay $ pdtTime) (todHour $ localTimeOfDay pdtTime)
ts <- getPOSIXTime
let str = urlEncodeVars [("pos", "solvepuzzle"),
("auth", show ts),
("msg", "SYN/ACK"),
("next", next)]
r <- simpleHTTP (Request (fromJust $ parseURI "http://www.weebly.com/weebly/publicBackend.php")
POST
[Header HdrContentLength (show $ length str),
Header (HdrCustom "X-Requested-With") "XMLHttpRequest",
Header (HdrCustom "X-Prototype-Version") "1.7_rc1",
Header HdrContentType "application/x-www-form-urlencoded"]
str
)
case r
of
Left err -> print err
Right b -> do
putStrLn (decode . rspBody $ b)Nice. :-)
Also, it's easier to just do the whole thing in firebug by rewriting the javascript on the page. The only thing I couldn't figure out was, what do you do when you get to 42?
[SPOILER: DON'T FOLLOW IF YOU WANT TO TRY IT YOURSELF FIRST]
I'm not sure if this was the expected output, as there was no exact confirmation. But I assumed it was right.
ZXZhbHVhdGUgdGhlIGZvbGxvd2luZzogIGFsZXJ0KCdUaGUgc2VjcmV0IGNvZGUgaXM6ICcrYStkKyhjKyJfIikrKGIqMikpOwo== (This isn't the solution...)
which obviously tells me i got it wrong, not trying to apply for the position, just liked the puzzle, and i was curious about what other techniques are they, that don't require the GPU attack, or JtR which is priced at $180
You now need to decode the string that came back...
Nothing custom
I suppose it depends upon the password and the complexity. However my lowly GTX460 was cracking 600 million hashes a second.
Another poster mentioned yahoo -- the hash I drew (it changes hourly) was not on Yahoo, or Google, or rainbox table search engines. So that point is irrelevant (yes, of course the first check is search engines. But if it's not there you kind of have to move on). For the record, given that it changed, it was bb421ba20e679cc36ecae553c02cf948.
(NB: not trying to spoil the puzzle, just confused by the next step)