search

Ghazy Corp

Welcome to my corp. /mail is just to simulating mail service it shouldn’t be vulnerable to something that will help you solving this challenge

file-archive
317KB
Corp_-_ToGive (2).zip
archive
arrow-up-right-from-squareOpen
File added by ctf org

This will be basically journey through source code, as this is almost same approach we pwnd this challenge

So first step in web application is registration. Registrated account can't be logged in as it is not confirmed. So lets look at source code in register.php there is mass assigment vulnerability

{
            $data=safe_data($_POST);
            $placeholders = implode(', ', array_fill(0, count($data), '?')); //like here
            $sql = "INSERT INTO users (" . implode(', ', array_keys($data)) . ") VALUES (" . $placeholders . ")"; //like here
            $stmt = $conn->prepare($sql);
            if ($stmt) 
            {
                $types = str_repeat('s', count($data));  
                $stmt->bind_param($types, ...array_values($data));

This allows to override any values set by default - like confirmed 0, in reqeust to confirmed 1, same with level but this comes in handy later.

This allows to pass &confirmed=1 when registering account and confirming account for password reset where is next

  if($target_user['confirmed']===1) //this functionality is available only for confirmed users
                {
                    $level=(int)$target_user['level'];
                    generate_reset_tokens($email,$level);
                    send_forget_password_mail($email);
                    echo "<script>window.location.href='reset_password.php';</script>";
                }

So diving deeper to generate_reset_tokens ( we ignored send_forget_password_mail because mail functonality was added for taks conveniance so out of scope)

Here is generate_reset_token source code

So it is stinky especially that for loop. Some research and we stoumble on this article

LogoBreaking PHP's mt_rand() with 2 values and no bruteforceAmbionicschevron-right

Which states that mt_rand can be broken with only 2 values and no bruteforce.

Additionaly in the whole code there is no check if email checks out with stored in phpsession

and this can be exploited in wrong_reset_token.php

So for now we have some attack vector for admin account:

  • mass assigment to register user with confirmed=1 and level=226

  • use forget password functionality for created user

  • read reset password token

  • run mt_rand braking scripts

  • exploit wrong_reset_token.php and obtain admin account

hashtag
Exploit

hashtag
User register

hashtag
Forget password functionality

hashtag
Read token and break mt_rand

Generated tokens are:

Using scripts return seed

Generate all values:

Generated values are identical!

hashtag
Exploit wrong_reset_token.php and login as admin

And password is changed so now we can login as admin

hashtag
Read the flag

So now it is just "easy" for reading the flag.

So this code checks if file requested by user have PNG magic bytes but it does it by comparing ASCII and doing it from second byte so by using wrapwrap it is possible to use PHP iconv chain to prepend data to file and still extract it from disk!

Logowrapwrap/wrapwrap.py at main · ambionics/wrapwrapGitHubchevron-right

generating payload

The value 50 is just a guess to small may not work bigger return more trash.

hashtag
Sending payload and recovering flag

it is chonky boiiiii

but returns flag

PreviousWebNextWindows

Last updated