THM: Biohazard

IP=biohazard.thm
nmap -sV -sC -oN nmap.initial $IP

Which gives us the following:

• [ ] ftp server
• [ ] ssh server
• [ ] http server

I, then started the good ol’ full scan to see whether I missed anything and went on to the web server, hoping to find anything there.

Simply moving in the website we get to /mansionMain, where a hint also reveals /diningRoom

There, we get an emblem (flag), and a hint:

Furthermore, a strange input flag box appears, but it appears like nothing happens when we fill in the flag.

Simply reveals the lock pick flag and directs us to the /artRoom

Gives us the map of the house:

Location:
/diningRoom/
/teaRoom/
/artRoom/
/barRoom/
/diningRoom2F/
/tigerStatusRoom/
/galleryRoom/
/studyRoom/
/armorRoom/
/attic/

After seeing that, I started checking each of those rooms I had not checked before.

Using the lockpicking flag there, we reveal a hidden subroom

http://biohazard.thm/barRoom357162e3db904857963e6e0b64b96ba7/

We get a music note - but the string is not something that actually points me anywhere. I’m thinking of a simple encoding function:

Look like a music note
NV2XG2LDL5ZWQZLFOR5TGNRSMQ3TEZDFMFTDMNLGGVRGIYZWGNSGCZLDMU3GCMLGGY3TMZL5 

Maybe moonlight somata actually is a key! (Post-Completion: It was not.)

After trial and error it just happened that I discovered it was base32 (tested most of the available options manually :( )

At the gold emblem,using our older emblem flag:

rebecca

After that I went back to diningRoom to use the gold emblem flag there

klfvg ks r wimgnd biz mpuiui ulg fiemok tqod. Xii jvmc tbkg ks tempgf tyi_hvgct_jljinf_kvc

Which is obviously a substitution algorithm, since it resembles an actual sentence (Post-completion: Obviously…):

• crossed out ROTXX algorithms
• crossed out pretty much every encoding algorithm

Started experimenting with everything on Cyberchef, and when stuck, after seeing that rebecca was not a flag on thm, started using it as a key! Interestingly, it was encrypted with the Vigenere Cipher

there is a shield key inside the dining room. The html page is called the_great_shield_key

This time I was lucky enough with Rot13:

Lbh trg gur oyhr trz ol chfuvat gur fgnghf gb gur ybjre sybbe. Gur trz vf ba gur qvavatEbbz svefg sybbe. Ivfvg fnccuver.ugzy 
You get the blue gem by pushing the status to the lower floor. The gem is on the diningRoom first floor. Visit sth.html 

After going there, the blue gem flag is revealed.

I was expecting this to give us something with the blue_gem flag, however nothing happened… at least not the first time. I was so sure that this was the right place to use the blue_gem flag, so I checked closer what I had just pasted there, and sure enough, there was a space following, which ruined it for me. After removing it, everything was working as expected, giving me:

crest 1:
S0pXRkVVS0pKQkxIVVdTWUpFM0VTUlk9
Hint 1: Crest 1 has been encoded twice
Hint 2: Crest 1 contanis 14 letters
Note: You need to collect all 4 crests, combine and decode to reavel another path
The combination should be crest 1 + crest 2 + crest 3 + crest 4. Also, the combination is a type of encoded base and you need to decode it

Strangely named Gallerty:

crest 2:
GVFWK5KHK5WTGTCILE4DKY3DNN4GQQRTM5AVCTKE
Hint 1: Crest 2 has been encoded twice
Hint 2: Crest 2 contanis 18 letters
Note: You need to collect all 4 crests, combine and decode to reavel another path
The combination should be crest 1 + crest 2 + crest 3 + crest 4. Also, the combination is a type of encoded base and you need to decode it

The study room entrance seems to need a flag to unlock:

• Helmet symbol on the door (?)

I am not even sure I completed this.

The armor room entrance seems to need a flag to unlock:

• Shield symbol on the door, so we use the shield flag

crest 3:
MDAxMTAxMTAgMDAxMTAwMTEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMTEgMDAxMDAwMDAgMDAxMTAxMDAgMDExMDAxMDAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAxMDAgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMDAgMDAxMTEwMDAgMDAxMDAwMDAgMDAxMTAxMTAgMDExMDAwMTEgMDAxMDAwMDAgMDAxMTAxMTEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAxMTAgMDAxMTAxMDAgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMTAgMDExMDAwMDEgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTAxMTEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAxMDEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMDAgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTEwMDAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMTAgMDAxMDAwMDAgMDAxMTAxMTAgMDAxMTEwMDA=
Hint 1: Crest 3 has been encoded three times
Hint 2: Crest 3 contanis 19 letters
Note: You need to collect all 4 crests, combine and decode to reavel another path
The combination should be crest 1 + crest 2 + crest 3 + crest 4. Also, the combination is a type of encoded base and you need to decode it

The attic room entrance seems to need a flag to unlock:

• Shield symbol on the door makes us use the shield flag

crest 4:
gSUERauVpvKzRpyPpuYz66JDmRTbJubaoArM6CAQsnVwte6zF9J4GGYyun3k5qM9ma4s
Hint 1: Crest 2 has been encoded twice
Hint 2: Crest 2 contanis 17 characters
Note: You need to collect all 4 crests, combine and decode to reavel another path
The combination should be crest 1 + crest 2 + crest 3 + crest 4. Also, the combination is a type of encoded base and you need to decode it

I first tried base64, and the output seemed not-so-off, ending in =. For the second encoding, I thought it could be base64 again, but the output was off (17 chars in length). Then I tried, base32 and it produced a string of length 14:

RlRQIHVzZXI6IG

Base32 (having it on my mind since the first time I encountered it in this room), and then base58 (suggested by CyberChef… if one just uses the right tools :P)

h1bnRlciwgRlRQIHBh

Base64, binary and hex gives us:

c3M6IHlvdV9jYW50X2h

Base58 and hex (once again, the second being suggested by CyberChef instantly):

pZGVfZm9yZXZlcg==

RlRQIHVzZXI6IGh1bnRlciwgRlRQIHBhc3M6IHlvdV9jYW50X2hpZGVfZm9yZXZlcg==

Simply decoding with base64 (== giving a solid clue :P) gives us the username and password for the ftp server

FTP user: hunter, FTP pass: you_cant_hide_forever

Reveals to us:

• /hidden_closet page, but with a lock (helmet lock again)
• That the helmet flag will be inside of the gpg file (no sh** sherlock!)

Using strings, we can see that, at least for key-003, there is a .txt embedded in the picture.

After taking a closer look with steghide, all of these contain information, and all of them are password encrypted!

After using the helmet password, we get to another room:

• talk of a traitor
• wpbwbxr wpkzg pltwnhro, txrks_xfqsxrd_bvv_fy_rvmexa_ajk
• SSH password: sorry for obfuscating this

• SSH user: umbrella_guest

Not only a sudo member, but can run everything without a password. We got root. (It was almost unnecessary, but I ran sudo su, to avoid using sudo on every command)