WARNING: this game is known to be EXTREMELY addictive and you should not start with it unless you have plenty of time, since you won't be able to let it go. :stickout

It's a "hacking game", meaning you click on "Click here to start with the challenges" to begin. You work yourself up through levels, and to pass on to the next one all you have to do is "hack" a password, by viewing the source code, and thinking REALLY hard. :D
It's fun in the beginning, but after a while you realize you've became addicted to this game. :eek:
It gets to you man... it really does. ;)

http://www.try2hack.nl/
(dutch url, made by dutch ppl I suppose, but it's in english! :) )

Level 1's rather easy, but then it begins... :bawling:

Enjoy! Don't blame me afterwards for your sleepless nights! :D

Erm...I'm stuck on level two...Guess I'm not as 1337 as I thought I was :bawling:

Arghhhhhhhh, you can't trick me into doing this again :mad: Have fun guys :)

I keep getting the Level 4 (NOT!) message after trying to get past level 3..

I tried it once before but my patience got the better of me :p

--Shaun

Nice, I just passed level 1!!

I'm too good...:D

I thought level 2 would stop me, but I got through :D :D

:confused: can any one give me a hint ...

:bawling: I know nothing about hacking :crying:

please with sugar on top ;)

Fadi T. :dgrin:

Originally posted by ubergeek22
Erm...I'm stuck on level two...Guess I'm not as 1337 as I thought I was :bawling:

Same here...

I suck at this. :bawling: :bawling:

Oh lol - I know of the people who started that - they have a channel on the quakenet IRC network.

im stuck on level 2.... :(

i can view the source code but wheres the username and password? :bawling:

Hints:

Download .swf file..... notepad.

:)

thanks!

Then once you've all done that... give me a hint how to pass level 3 to level 4 (unless level 4 is that "NOT" page)...

:D

--Shaun

Originally posted by shaunewing
Then once you've all done that... give me a hint how to pass level 3 to level 4 (unless level 4 is that "NOT" page)...

:D

--Shaun
Hint: The JavaScript is deceiving

Damit I hate Disneyland...:D

Yay! I passed onto level 4 :)

You are right, the JavaScript is deceiving, very deceiving.. :D

Heh, yep, have fun on level 4, that's where I'm stuck :(

Well... I'm stuck on Level 4 (Yes the real level 4)

Want a hint?... <script src=

Thats all I'm gonna give to that one...

I have to drive to another state.... If anyone can figure out whats goin on in 4 I'd like to here it.... I think you need to add a param value to the applet to get it to execute....

Good luck to all...

Originally posted by Studio64
Want a hint?... <script src

Thank You...:D

*does a dance*... I'm now up to level 5 :)

I shall call it a night at level 6 :)

--Shaun

Originally posted by Studio64
I have to drive to another state.... If anyone can figure out whats goin on in 4 I'd like to here it.... I think you need to add a param value to the applet to get it to execute....


Nope...

Hint:

Google -> "Online Java Decompiler"

:D

--Shaun

I just guessed the URL for level 7 and got there on the first try. :D

NEVERMIND :)

Originally posted by mindboggle
I just guessed the URL for level 7 and got there on the first try. :D

But that's cheating :)

--Shaun

Originally posted by shaunewing


But that's cheating :)

--Shaun


No its not, if you can out think the naming system and get it on the first try, thats thinking out of the box :D

I hate that site, it comes up on my forums ever few months, and we get 8 page threads asking for help on how to get to a differnt level :stickout

Well... Here's the code for the applet... I can't figure out the auth sequence (in bold)...


Return previous page Online Java Decompiler

--------------------------------------------------------------------------------
http://www.try2hack.nl/PasswdLevel4.class

import java.applet.Applet;
import java.applet.AppletContext;
import java.awt.*;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.io.*;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.EventObject;

public class PasswdLevel4 extends Applet
implements ActionListener
{

public PasswdLevel4()
{
inuser = new String[22];
totno = 0;
countConn = null;
countData = null;
inURL = null;
txtlogin = new TextField();
label1 = new Label();
label2 = new Label();
label3 = new Label();
txtpass = new TextField();
lblstatus = new Label();
ButOk = new Button();
ButReset = new Button();
lbltitle = new Label();
}

void ButOk_ActionPerformed(ActionEvent actionevent)
{
boolean flag = false;
for(int i = 1; i <= totno / 2; i++)
if(txtlogin.getText().trim().toUpperCase().intern() == inuser[2 * (i - 1) + 2].trim().toUpperCase().intern() && txtpass.getText().trim().toUpperCase().intern() == inuser[2 * (i - 1) + 3].trim().toUpperCase().intern())
{
lblstatus.setText("Login Success, Loading..");
flag = true;
String s = inuser[1].trim().intern();
String s1 = getParameter("targetframe");
if(s1 == null)
s1 = "_self";
try
{
finalurl = new URL(getCodeBase(), s);
}
catch(MalformedURLException _ex)
{
lblstatus.setText("Bad URL");
}
getAppletContext().showDocument(finalurl, s1);
}

if(!flag)
lblstatus.setText("Invaild Login or Password");
}

void ButReset_ActionPerformed(ActionEvent actionevent)
{
txtlogin.setText("");
txtpass.setText("");
}

public void actionPerformed(ActionEvent actionevent)
{
Object obj = actionevent.getSource();
if(obj == ButOk)
{
ButOk_ActionPerformed(actionevent);
return;
}
if(obj == ButReset)
ButReset_ActionPerformed(actionevent);
}

public void destroy()
{
ButOk.setEnabled(false);
ButReset.setEnabled(false);
txtlogin.setVisible(false);
txtpass.setVisible(false);
}

public void inFile()
{
new StringBuffer();
try
{
countConn = inURL.openStream();
countData = new BufferedReader(new InputStreamReader(countConn));
String s;
while((s = countData.readLine()) != null)
if(totno < 21)
{
totno = totno + 1;
inuser[totno] = s;
s = "";
} else
{
lblstatus.setText("Cannot Exceed 10 users, Applet fail start!");
destroy();
}
}
catch(IOException ioexception)
{
getAppletContext().showStatus("IO Error:" + ioexception.getMessage());
}
try
{
countConn.close();
countData.close();
return;
}
catch(IOException ioexception1)
{
getAppletContext().showStatus("IO Error:" + ioexception1.getMessage());
}
}

public void init()
{
setLayout(null);
setSize(361, 191);
add(txtlogin);
txtlogin.setBounds(156, 72, 132, 24);
label1.setText("Please Enter Login Name & Password");
label1.setAlignment(1);
add(label1);
label1.setFont(new Font("Dialog", 1, 12));
label1.setBounds(41, 36, 280, 24);
label2.setText("Login");
add(label2);
label2.setFont(new Font("Dialog", 1, 12));
label2.setBounds(75, 72, 36, 24);
label3.setText("Password");
add(label3);
add(txtpass);
txtpass.setEchoChar('*');
txtpass.setBounds(156, 108, 132, 24);
lblstatus.setAlignment(1);
label3.setFont(new Font("Dialog", 1, 12));
label3.setBounds(75, 108, 57, 21);
add(lblstatus);
lblstatus.setFont(new Font("Dialog", 1, 12));
lblstatus.setBounds(14, 132, 344, 24);
ButOk.setLabel("OK");
add(ButOk);
ButOk.setFont(new Font("Dialog", 1, 12));
ButOk.setBounds(105, 156, 59, 23);
ButReset.setLabel("Reset");
add(ButReset);
ButReset.setFont(new Font("Dialog", 1, 12));
ButReset.setBounds(204, 156, 59, 23);
lbltitle.setAlignment(1);
add(lbltitle);
lbltitle.setFont(new Font("Dialog", 1, 12));
lbltitle.setBounds(12, 14, 336, 24);
String s = getParameter("title");
lbltitle.setText(s);
ButOk.addActionListener(this);
ButReset.addActionListener(this);
infile = new String("level4");
try
{
inURL = new URL(getCodeBase(), infile);
}
catch(MalformedURLException _ex)
{
getAppletContext().showStatus("Bad Counter URL:" + inURL);
}
inFile();
}

private URL finalurl;
String infile;
String inuser[];
int totno;
InputStream countConn;
BufferedReader countData;
URL inURL;
TextField txtlogin;
Label label1;
Label label2;
Label label3;
TextField txtpass;
Label lblstatus;
Button ButOk;
Button ButReset;
Label lbltitle;
}



Boy... It would help the they DOCUMENTED THEIR CODE :D....

But, hey... Then it would be fun would it :D....

Ahh... GREAT Decoy :D...

Correct Solution
infile = new String("level4");
URL inURL;
finalurl = new URL(getCodeBase(), s);


Open up http://www.try2hack.nl/level4

Ahh... Those tricky bastards :D

It'd be really nice if someone was able to extract the text files from level 5. My visual studio debugger is missing :(

-Matt

http://www.try2hack.nl/5_level_5.html :: someone try that.

Originally posted by iamdave
http://www.try2hack.nl/5_level_5.html :: someone try that.

Try a memory dump after typing in the a try...

Originally posted by Studio64


Try a memory dump after typing in the a try...
OK, so it is now official: a Macintosh or a Linux box is not a hacker's computer :eek:

I'm stuck...stoopid crosoft.

Yeppie... just made it to lvl 6. :D

Originally posted by cyansmoker

OK, so it is now official: a Macintosh or a Linux box is not a hacker's computer :eek:

I'm stuck...stoopid crosoft.

I did it using 2000 server....

It's not too hard.... Simply run the progam...

Enter a password... View the memory location the program is running in and the password must be there to compare w/ the one typed in....

Studio,
can you tell where your plan is flawed on Mac OS X and Linux? :D

http://www.try2hack.nl/l-e-v-e-l-6.html

Originally posted by cyansmoker

OK, so it is now official: a Macintosh or a Linux box is not a hacker's computer :eek:

I'm stuck...stoopid crosoft.

A true hacker isn't limited by software. ;)

Dude, I agree.
I have a lame-o configuration :D

sweet... I made it to lvl 7 now. Damn lvl 6 took 2 hours out of my life. Doh! :bawling: :D

I did it using 2000 server....

It's not too hard.... Simply run the progam...

Enter a password... View the memory location the program is running in and the password must be there to compare w/ the one typed in....
I am trying to read the memory space in XP. Can some one point me in the right direction on how I would go about doing this? I have installed the windows debugging tools and the symbols. If that is all I need, then I will do more research on how to use it. But if not can someone point me in the direction of a program that read the memory space of programs that are running?

I have been Googling for about an hour now and have not found anything relevant. So any help would be appreciated.

Thanks.

What's the deal with bringing up a 4 year old thread??

hackerslab was much better than this!

I did a Google search and it popped up as one of the results. Trying to learn some new things.

Erm...I'm stuck on level two...Guess I'm not as 1337 as I thought I was
You have to decompile the flash file and it's in there, but that takes too long and I need to download the software again, don't have time for this.

Level 5 isnt a flash file. It is a vb file. I don't know if you were talking to me or not. but my question was how to read the memory space an application is running in. I am using windows xp. I am installing .net student edition right now to see if it has a memory space reader.

Any help that points in the right direction would be appreciated.

You have to decompile the flash file and it's in there, but that takes too long and I need to download the software again, don't have time for this.

Or you could use notepad, either works fine :).

Level 8 has me stumped :( - It's just a form going to a CGI script - I've tried an SQL injection attack and thats all I can think of. This thing is way too addictive.

Level 8 has me stumped :( - It's just a form going to a CGI script - I've tried an SQL injection attack and thats all I can think of. This thing is way too addictive.



It uses an exploitable phf on a linux system (note what happens in your address bar when you type the wrong information).
So to get the password file you will need to type ?Qalias=3Dx%0a which is the expoit so you can execute your code. In order to have contents displayed on your screen, you need to run the comman /bin/cat (remember the 'cat' command on SSH?)
/etc/passwd is the file containing the password.

So basically you need to type:
http://www.try2hack.nl/cgi-bin/phf?Qalias=3Dx%0a/bin/cat%20/etc/passwd

But that's not all. The password is encrypted using DES encryption. A basic password cracking application would suffice to crack the encryption..

Good Luck Everyone!

I wonder what disney thinks when they see the refer log in there stats..

I am stuck on this one

Good job! You can find Level 10 at our IRC channels. Go to #try2hack.level10 on irc.mediamonks.net or irc.deviantart.com and use '?????????bomb' as key to continue. See the <a href="../chat/">chat</a> page for more information.

now I am really stuck.


bind ctcr - PING ctcr:pingreply
proc ctcr:pingreply {nick uhost hand dest key arg} {
set dur [expr [unixtime] - arg]
putserv "NOTICE nick :Your ping reply took dur seconds"}

Sasha where are you stuck? Can you give me any tips for level 5? I would like to learn how to read the memory space allocation the program is taking. The windows debugger asks for a process id, but the program doesnt seem to run under a process id. I have also tried debugging the application directly but with no success.