Watermelon
All love for Watermelons 🍉🍉🍉 Note: The code provided is without jailing, please note that when writing exploits.
Lets fire up the docker container and start reviewing the code. Seemed like a very minimilistic app with a few features to login/signup and then we can basically upload a file. Reviewing the file upload functionality, we know that it can’t be a shell since its Python and it wouldn’t make sense to do so. Lets have a close look:
python
The function secure_filename is being called whenever we are saving a file. But wait a sec, the variable filepath is insecure since the function is not called on this.
Moreover the filepath variable is then stored into the database on the following line:
python
This is enough to do directly traversal. After register/login, upload a file with a filename to access the db.db file which contains the admin/password:
Accessing the uploaded file, we have the password of admin:
Login with the user/pass and get the hash at /admin endpoint.
Free Flag
Free Free
Download the source code and started a local container. Reviewing the source code, we have a very simple PHP to give filename that can be accessed on the local system:
php
But the catch here we can only get the file data when the file starts with either <?php or <html. Hence, we can’t simply request the /flag.txt file.
And the function file_get_contents only returns back the data inside file unlike include which executes the data. So, we need a way to bypass the line:
php
In PHP we have URI schemes like php://input or php://filter. My initial payload was to set the filename as php://input and read data from the raw POST request.
But that wouldn’t work because we can only read data from the POST and not a file:
php
Now, digging and looking at my notes. We have a way to inject PHP code from url using php://filter chain. We can generate a chain with this tool here:
https://github.com/synacktiv/php_filter_chain_generator
bash
My final payload looked like:
php
Using the payload on file parameter gives the flag:
bash
Notey
I created a note sharing website for everyone to talk to themselves secretly. Don’t try to access others notes, grass isn’t greener :’( )
Downloaded the source code and started reviewing the code. During the initial setup of the challenge, i faced one major issue and that was pwnjail. This was totally new to me.
If you look at the Dockerfile, you would find this part:
With pwnjail, the problem is the filesystem state is maintained only for a few seconds and then its discarded. Or in other words, i can’t simply just do the
exploitation steps manually by logging in and then using that token to do some other stuff. Because by the time, i would reach to second request, my token would have
long gone.
So, we need to write a script. But before jump into the script part. Lets explore the code to see where the vulnerability is. Coming from the point of Sources & Sinks, first thing i noticed was extended url parameters:
javascript
The functions signup, login and addNote doesn’t seem to be vulnerable at because of the middleware addNote and login. Inside these middlewares, there’s a check for
the incoming data. The parameters have to be strings:
javascript
The only potential function we are left with is viewNote function. This function doesn’t have any validation on incoming data. Lets have a close look:
javascript
The parameters note_id and note_secret are passed to the function getNoteById. Jumping onto this function:
javascript
The parameters are directly passed to the pool.query function. This doesn’t seem to be directly vulnerable unless there’s a vulnerability in the mysql library we are using.
Lets read the documentation of the library:
https://www.npmjs.com/package/mysql
From the documentation, this is what hit me:
Objects are turned into
key = 'val'pairs for each enumerable property on the object. If the property’s value is a function, it is skipped; if the property’s value is an object,toString()is called on it and the returned value is used.
Firing up a local terminal and testing the mysql.format function with a dictionary gives us the following query:
GPT tells me its a valid chained expression. I found this good stackoverflow question on this:
https://stackoverflow.com/questions/28952960/chained-comparisons-in-mysql-get-unexpected-result
Reading this i realized i can do a limited SQLi where i can return the result of the query to be true. I tested this for a while and my final payload looked like:
I got the note_id from the database directly on docker container which is the id of the note that contains the flag. My final script looked like this:
python
Ran the script and got the flag on terminal.
Fastest Delivery Service
No time for description, I had some orders to deliver : D Note: The code provided is without jailing, please note that when writing exploits.
Again, we are dealing with pwnjail here. So, we will need to write a script in order to fully exploit the instance URL. This challenge was basically inspired from
some of the challenges that have been already given in other CTFs. We are dealing with a RCE here in EJS that can be exploited through prototype pollution.
Reading the package.json file, we know that EJS is being used here:
Now, we need to find the entry point for prototype pollution here. Inspecing the source code, the /register endpoint writes the username to the users Object:
javascript
But the main question is how we are going to provide the payload to username __proto__. Looking further, we have the /address endpoint here:
javascript
This function can be exploited to provide the values to the __proto__ parameter on users object. But before we head to exploit, we need to understand the vulnerability in EJS.
I found a couple writeups on this here:
https://blog.huli.tw/2023/06/22/en/ejs-render-vulnerability-ctf/
Reading this, i got that we need to introduce 2 values on the prototype of object which are:
We can exploit this challenge in 3 steps:
- Register a user with
__proto__username. - Set the address with
addressIdasclientandFulladdressas1 - Set the address with
addressIdasescapeandFulladdressas the payload.
Here’s the final script i wrote and got the flag on my webhook after running it a few times:
python