4

I am solving a CTF challenge and it is multi-layered: https://net-force.nl/challenge/level314/

(Modern browsers don't support Java Applets anymore and I had to download Opera browser 9.x to run the Applet properly.)

I realize that I need to brute force the Java Applet to find the right combination of settings.

What I tried:

  • I noticed the Applet on the page and used wget to download it and jd-gui to reverse it. Noticed some other classes that it pulls from and downloaded them too. But I don't see how I can re-create the app in my local system such that I can brute force it.

  • Used Wireshark to capture the packets going to the web page in order to manipulate the request and re-send queries that brute force settings. However, the webpage is HTTPS (end-to-end encryption) and so I can't really read the communication after I "follow the TCP stream" on the browser.

  • Downloaded the Java class files and tried to recreate the machine on my local system but it is complicated and I couldn't get it working.
  • Used Burp Suite proxy to capture the requests going to the webpage. No luck there. Once the Java applet is loaded, playing around with the settings does not generate new requests in my Burp proxy. So nothing to capture and manipulate. I am guessing this is because the Applet is loaded on my client and no HTTP requests are being sent to the server when I am playing with the Java Applet.

My question:

How can I brute force the rotor machine in the Java Applet? In other words, how do I send different data to the machine and observe output in an automated fashion?

Improve this question

1 Answer 1

Reset to default
4

You are on the right path by downloading the applet manually and decompiling it, that's how I would approach it as well. You might just need more understanding of the code in order to reverse how it's downloading extra classes on the fly. Note that you don't need to run the app to understand how it works - the challenge is to retrieve so-called "rotor settings" which should be fairly easy to figure out from the decompiled classes.

You can also use a tool such as Charles Proxy to get around the HTTPS issue - Charles will give you a root certificate you need to install in the browser's trust store (and possibly in Java's trust store - on my Mac for example the Java preference pane has its own trust store), the tool will then intercept HTTPS and present valid server certificates signed by that root cert to the Java application. However I would be really surprised if this particular app is actually calling out any external service beyond its initial loading.

Worst case scenario, you could always just use the applet normally and use some automation tools like AutoIt to interact with it.

Good luck!

Improve this answer
1
  • Thanks. Would just like to point out that the challenge requires a brute force because it is not possible to figure out the rotor settings used at the time of encryption from the decompiled classes. Yes, I can know the reflector settings but the rotors are just reset to 0,0,0 every time the app loads. But those are just details of how enigma works. I appreciate your advice.
    – whoami
    Dec 17, 2017 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .