blade-runner

Type: #WEB #whitebox Difficulty: #easy SOLVED by: #myself TOOL USED: docker redis burpsuite TOPIC: prototype pollution

Writeup Date:2023-10-01 URL = https://ctf.maplebacon.org/instances

the challenge description we have source code so we can see what happening in the backend + we can run our docker container instead of trying to solve with 10 min time window before the instance shutdown

uznip blade-runner.zip to extract the src

index.js

import some js stuff and import ./util from local folder so this is custom code and maybe there is vulnerability some where caused by human

in index.js we see that the flag is stored in the environment so if we can have RCE / LFI we can read /proc/self/environ and get the flag –1 i also see the flag present in /joi endpoint.

so how can we access the joi endpoint ? we will have to see what is util.auth doing. first we can see docker files but there is something interesting in those let’s see our challenge live and up sudo docker-compose up make sure u are in the same path as docker-compose.yml file. and will let it build the challenge

when i saw redis i used searchspolit and found but while building the image i saw that he uses the latest build which doesn’t have any know CVE (YET) and we can confirm that with notes redis 4.6.10 is not reflection that the app use redis version 4.x and prone to RCE but to what the app pull from npm no rce for us :'(

our challenge is up let’s give it a visit u should be able to visit it at http://localhost:6969

if we try access joi endpoint login required message is shown

let’s register account then once we hit submit we are redirect to http://localhost:6969/user/login?username=a&password=a and we get noting so inspect the request and i see that they are using get method so this ring alarm to me

i did some changes so i dig in the source code for “invalid body” error. if the username and password are not objects will return invalid body so let’s change or request to json format i used content-type-converter extension from burpsuite u could do it manually too i just love not to rebuild any wheels (thank you foss community ) and it redirect me to the login endpoint how to know we registered account successfully ? if this is blackbox challenge we can try and login (we will sent the data in json as well) and see what is the response OR we can monitor redis (redies is datebase in abstract form)

first we have to know our redis ip to connect from our machine sudo docker ps sudo docker exec <redis container id> ip a s on our machine redis-cli -h 172.20.0.2default port at 6379 if not in that case u can use -p <non-stander-port>
use command Monitor in redis to monitor everything happening in the database set foo a = registered successfully now what ? 2.) we are blocked from registering as username “admin” as hackers do they don’t go by the rules

util

user_route.js if we logged with vaild username and password our req.session.user is set to our username
and redirect to /joi where is the flag is in the responses util.auth.js we see that if our req.session.user is not “admin” we will get ADMIN REQUIRED message when accessing /joi so we have register username as “admin”

so how we would bypass

if (k.toLowerCase() == "username" && req.body[k].toLowerCase() == "admin") {
            return res.status(400).send("You can't use that username."); 

.toLowerCase() so our input is case-insensitive i tried to use unicode in the json so admin be something like ‘\u0061\u0064\u006D\u0069\u006E’ the filter caught me still.

why? becasue json will force utf-8 in the content-type header and if u changed to unicode will cause an error.

if u just passed it in “username”:"\u0061\u0064\u006D\u0069\u006E" json will return it to utf-8 and will be blocked by the filter

we are left to pototype pollution we registered username “admin” successfully and we will try to login follow redirecting we get the flag locally if it doesn’t show flag first time just keep sending the request in the repeater or keep hitting F5 in the broswer(use the connect.sid cookie) due to which will not render the full content length.