GITOLITE.txt

[pub/jan/ctf-seminar.git] / writeups / ilm0 / hxp36c3.md

# <u>hxp 36C3 CTF</u>

## xmas_future

**category**: rev, (web)

**description**:

Most people just give you a present for christmas, hxp gives you a glorious future.

If you’re confused, simply extract the flag from this 山葵 and you shall understand. :)

___

### Recon

As previous experience shows, it is always best to read the description very carefully and look for clues! Of course, the Asian characters stand out: Google Translate quickly tells us that they mean "wasabi" (in Japanese), the Japanese hot sauce/paste. If we search for "wasabi web framework" on Google, the first site is a Kotlin based HTTP framework [https://github.com/wasabifx/wasabi], for now that does not seem particularly interesting or valuable. On the other hand, the second page takes us to [https://github.com/danleh/wasabi], an analysis framework for the inspection of WebAssembly files. This sounds more relevant as we are in fact given a .wasm file. More on this later. 

We are given the skeleton of a php web server. Among others we are presented with:

- a JavaScript

- a WebAssembly file

- and a html file.

With the provided shell script (run.sh) we are quickly up and running our PHP based web server. 

![page.png](hxp36c3/page.png)

We have a funky Matrix inspired flag checker tool. As the page advertises, it is supposed to be running Rust and WebAssembly. Let's check the underlying structure and how all this comes together!

The interesting part of the HTML source looks like this: 

```html
 <div id="container">
      <div id="inner-container">
        <h1>High-speed flag checking</h1>
        <h3>Powered by Rust <img src="./ferris.svg" /> and WASM <img src="./wasm.svg" /></h3>

        <form id="form">
          <input type="text" id="flag" placeholder="hxp{...}" size="50" /><br />
          <button type="submit">Check</button>
        </form>
      </div>
    </div>

    <script type="module">
      import init, { check } from './hxp2019.js';

      async function run() {
        await init();

        document.getElementById('form').addEventListener('submit', function(e) {
          e.preventDefault();
          const flag = document.getElementById('flag').value;
          if (check(flag)) {
            alert('Yes, you found the flag!');
          } else {
            alert('Nope.');
          }
        });
      }

      run();
    </script>
```

We see that there's a button submitting information that is checked by an other JavaScript function defined in the file `hxp2019.js` (reformatted for easier reading):

```javascript
let wasm;

let WASM_VECTOR_LEN = 0;

let cachegetUint8Memory0 = null;
function getUint8Memory0() 
{
    if (cachegetUint8Memory0 === null || cachegetUint8Memory0.buffer !== wasm.memory.buffer) 
    {
        cachegetUint8Memory0 = new Uint8Array(wasm.memory.buffer);
    }
    
    return cachegetUint8Memory0;
}

let cachedTextEncoder = new TextEncoder('utf-8');

const encodeString = (typeof cachedTextEncoder.encodeInto === 'function'
    ? function (arg, view) 
{
    return cachedTextEncoder.encodeInto(arg, view);
}
: function (arg, view) 
{
    const buf = cachedTextEncoder.encode(arg);
    view.set(buf);
    return {
        read: arg.length,
        written: buf.length
};
});

function passStringToWasm0(arg, malloc, realloc)
{

if (realloc === undefined) 
{
    const buf = cachedTextEncoder.encode(arg);
    const ptr = malloc(buf.length);
    getUint8Memory0().subarray(ptr, ptr + buf.length).set(buf);
    WASM_VECTOR_LEN = buf.length;
    return ptr;
}

let len = arg.length;
let ptr = malloc(len);

const mem = getUint8Memory0();

let offset = 0;

for (; offset < len; offset++)
{
    const code = arg.charCodeAt(offset);
    if (code > 0x7F) break;
    mem[ptr + offset] = code;
}

if (offset !== len) 
{
    if (offset !== 0)
    {
        arg = arg.slice(offset);
    }
    ptr = realloc(ptr, len, len = offset + arg.length * 3);
    const view = getUint8Memory0().subarray(ptr + offset, ptr + len);
    const ret = encodeString(arg, view);

    offset += ret.written;
}

WASM_VECTOR_LEN = offset;
return ptr;

}
/**

* @param {string} pwd
* @returns {bool}
  */
export function check(pwd)
{
    var ptr0 = passStringToWasm0(pwd, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
    var len0 = WASM_VECTOR_LEN;
    var ret = wasm.check(ptr0, len0);
    return ret !== 0;
}

function init(module)
{
    if (typeof module === 'undefined')
    {
        module = import.meta.url.replace(/\.js$/, '_bg.wasm');
    }
    let result;
    const imports = {};

if ((typeof URL === 'function' && module instanceof URL) || typeof module === 'string' || (typeof Request === 'function' && module instanceof Request))
{

    const response = fetch(module);
    if (typeof WebAssembly.instantiateStreaming === 'function') {
        result = WebAssembly.instantiateStreaming(response, imports)
        .catch(e => {
            return response
            .then(r => {
                if (r.headers.get('Content-Type') != 'application/wasm') {
                    console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
                    return r.arrayBuffer();
                } else {
                    throw e;
                }
            })
            .then(bytes => WebAssembly.instantiate(bytes, imports));
        });
    } else
    {
        result = response
        .then(r => r.arrayBuffer())
        .then(bytes => WebAssembly.instantiate(bytes, imports));
    }
} else 
{

    result = WebAssembly.instantiate(module, imports)
    .then(result => {
        if (result instanceof WebAssembly.Instance) {
            return { instance: result, module };
        } else {
            return result;
        }
    });
}
return result.then(({instance, module}) => {
    wasm = instance.exports;
    init.__wbindgen_wasm_module = module;

    return wasm;
});

}

export default init; 
```

If we take a closer look at the definition of the function "check", we see that it passes a string to the function "passStringToWasm0", then it passes this processed string to the .wasm binary. The string-processing function takes a string and copies it to a prepared area of memory. Probably this area is used for communication between the binary and the JavaScript function.

Let's take a look at the binary with our new tool! I set up wasabi and completed all the steps on their website, but as to how to actually use their software, I found no description. After trying around for a few hours and finally giving up, I moved on to wabt[https://github.com/WebAssembly/wabt].

I managed to disassemble the .wasm file with the wabt module wasm2c. It returned me a very strange looking 6000 lines long C-file and a short but unusual header file. After some searching around I have found the definition of the check function called by the JavaScript file:

```c
static u32 check(u32 p0, u32 p1) {
  u32 l2 = 0, l3 = 0;
  FUNC_PROLOGUE;
  u32 i0, i1, i2, i3;
  i0 = g0;
  i1 = 32u;
  i0 -= i1;
  l2 = i0;
  g0 = i0;
  i0 = l2;
  i1 = 16u;
  i0 += i1;
  i1 = p0;
  i2 = p1;
  i3 = p1;
  alloc__vec__Vec_T___from_raw_parts__h6aeafb6342a4f3ed(i0, i1, i2, i3);
  i0 = l2;
  i1 = 8u;
  i0 += i1;
  i1 = l2;
  i2 = 16u;
  i1 += i2;
  alloc__vec__Vec_T___into_boxed_slice__h0afc7190c9c73a6d(i0, i1);
  i0 = l2;
  i0 = i32_load((&memory), (u64)(i0 + 8));
  l3 = i0;
  i1 = l2;
  i1 = i32_load((&memory), (u64)(i1 + 12));
  p1 = i1;
  i0 = hxp2019__check__h578f31d490e10a31(i0, i1);
  p0 = i0;
  i0 = p1;
  i0 = !(i0);
  if (i0) {goto B0;}
  i0 = l3;
  i1 = p1;
  i2 = 1u;
  __rust_dealloc(i0, i1, i2);
  B0:;
  i0 = l2;
  i1 = 32u;
  i0 += i1;
  g0 = i0;
  i0 = p0;
  FUNC_EPILOGUE;
  return i0;
}
```

I was not able to guess what the code does exactly, but there is a suspicious looking function being called: `hxp2019__check__h578f31d490e10a31`. It's definition is similarly fuzzy, I did not include it due to its size 300+ lines. It can be found in the folder hxp36c3 under the filename: `hxp2019__check__h578f31d490e10a31.c`.

### Technical details

WebAssembly was a new technology for me:

> WebAssembly is a new type of code that can be run in modern web browsers and provides new features and major gains in performance. It is not primarily intended to be written by hand, rather it is designed to be an effective compilation target for low-level source languages like C,  C++, Rust, etc.

[https://developer.mozilla.org/en-US/docs/WebAssembly/Concepts]

So it is a binary, that either resides server- or client-side, and provides "near native speed" functionality to JavaScript applications. After some research on the security implications of WebAssembly, I have found the following potential issues:

The sandboxed environment it runs in has complete control over what the binary can access.

> There currently is no way to do integrity checking on Wasm applications. This means that there is no process for verifying that a Wasm application has not been tampered with. 

[https://www.forcepoint.com/blog/x-labs/webassembly-potentials-and-pitfalls]

The lack of integrity checking could open up a lot of ways for various MITM attacks.

### Lessons (to be) learned

- Tools for unconventional SQL injection

## bacon

**category**: crypto

**description**:

Please hack.

___

### Recon

We get a netcat service, we connect to it, we are presented with a 12 character hex value. After it, we have approximately 2 minutes to provide the correct "answer".

We are also presented with python file that :

**vuln.py**:

```python
import os, signal

def Speck(key, blk):
    assert tuple(map(len, (key, blk))) == (9,6)
    S = lambda j,v: (v << j | (v&0xffffff) >> 24-j)
    ws = blk[:3],blk[3:], key[:3],key[3:6],key[6:]
    x,y, l1,l0,k0 = (int.from_bytes(w,'big') for w in ws)
    l, k = [l0,l1], [k0]
    for i in range(21):
        l.append(S(16,l[i]) + k[i] ^ i)
        k.append(S( 3,k[i])        ^ l[-1])
    for i in range(22):
        x = S(16,x) + y ^ k[i]
        y = S( 3,y)     ^ x
    x,y = (z&0xffffff for z in (x,y))
    return b''.join(z.to_bytes(3,'big') for z in (x,y))

# did I implement this correctly?
assert Speck(*map(bytes.fromhex, ('1211100a0908020100', '20796c6c6172'))) == b'\xc0\x49\xa5\x38\x5a\xdc'

def H(m):
    s = bytes(6)
    v = m + bytes(-len(m) % 9) + len(m).to_bytes(9,'big')
    for i in range(0,len(v),9):
        s = Speck(v[i:i+9], s)
    return s


signal.alarm(100)

h = os.urandom(6)
print(h.hex())

s = bytes.fromhex(input())
if H(s) == h:
    print('The flag is: {}'.format(open('flag.txt').read().strip()))
else:
    print('Nope.')
```

We recognize some kind of unusual encryption scheme, which is unidirectional, only the way of encryption is provided to us. The main function used for encryption is called "Speck", which is equivalent of bacon in German. This seems interesting! After some googling around we find the Speck cipher (see TD).

```python
def Speck(key, blk):
    assert tuple(map(len, (key, blk))) == (9,6)
    S = lambda j,v: (v << j | (v&0xffffff) >> 24-j)
    ws = blk[:3],blk[3:], key[:3],key[3:6],key[6:]
    x,y, l1,l0,k0 = (int.from_bytes(w,'big') for w in ws)
    l, k = [l0,l1], [k0]
    for i in range(21):
        l.append(S(16,l[i]) + k[i] ^ i)
        k.append(S( 3,k[i])        ^ l[-1])
    for i in range(22):
        x = S(16,x) + y ^ k[i]
        y = S( 3,y)     ^ x
    x,y = (z&0xffffff for z in (x,y))
    return b''.join(z.to_bytes(3,'big') for z in (x,y))
```

Here is a variant that's a bit easier to read, let's compare!
[https://en.wikipedia.org/wiki/Speck_(cipher)]:

```c++
#define ROR(x, r) ((x >> r) | (x << (64 - r)))
#define ROL(x, r) ((x << r) | (x >> (64 - r)))
#define R(x, y, k) (x = ROR(x, 8), x += y, x ^= k, y = ROL(y, 3), y ^= x)
#define ROUNDS 32

void encrypt(uint64_t ct[2],
             uint64_t const pt[2],            
             uint64_t const K[2])
{
   uint64_t y = pt[0], x = pt[1], b = K[0], a = K[1];

   R(x, y, b);
   for (int i = 0; i < ROUNDS - 1; i++) {
      R(a, b, i);
      R(x, y, b);
   }

   ct[0] = y;
   ct[1] = x;
}
```

The first thing that stands out, is the fixed number of rounds in our variant. 22 rounds mean that our key size is 64 or 72 bits. This in turn means that our block size is 32 or 48 bits.

The assignment `s = bytes(6)` from the function "H" reveals us that we have to do with the variant where the block size is 48 bits.

`assert tuple(map(len, (key, blk))) == (9,6)` This assertion makes sure that we are using the correct key and block sizes.

The main loop seems to behave according to the cipher specification and the cor of the example C code:

```python
for i in range(22):
        x = S(16,x) + y ^ k[i]
        y = S( 3,y)     ^ x
```

The key is XORed into the left word (y) then the left word is XORed into the right word (x).

I have felt here, that my cryptanalysis skills are not yet sufficient enough, so I looked at the other function, maybe I can find some way to brute force Speck.

```python
def H(m):
    s = bytes(6)
    v = m + bytes(-len(m) % 9) + len(m).to_bytes(9,'big')
    for i in range(0,len(v),9):
        s = Speck(v[i:i+9], s)
    return s
```

Here I made the revelation that our Speck function is actually only one "step" of the calculation! Speck is a block cipher:

```python
for i in range(0,len(v),9):
        s = Speck(v[i:i+9], s)
```

this loop goes through the message block-by-block. So actually `H` is an implementation of the complete 72/48 Speck encryption scheme. Now we know what precisely the code does, we can try to brute force it!

After some trying around, I realised that there is no chance, that consumer-grade hardware is able to brute-force this encryption under 2 minutes, not even 2 hours.

### Technical details

> Speck is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. [...] a cipher that would operate well on a diverse collection of Internet of Things devices while maintaining an acceptable level of security.

[https://en.wikipedia.org/wiki/Speck_(cipher)]

I think the effectiveness of the cipher comes from the fact that is uses lower key and block sizes when compared to other ciphers, such as AES.

> As of 2018, no successful attack on full-round Speck of any variant is known.  [...] they [the NSA] found differential attacks to be the limiting attacks, i.e. the type of attack that makes it through the most rounds; they then set the number of rounds to leave a security margin similar to AES-128's at approximately 30%.

[https://en.wikipedia.org/wiki/Speck_(cipher)]

So, according to the NSA, the Speck cipher is as resilient against differential attacks as AES-128.

### Lessons (to be) learned

- Applied cryptanalysis?
- Brute forcing through the use of clusters?

# file_magician

**category**: web

**description**:

Finally (again), a minimalistic, open-source file hosting solution.

___

### Recon

We get a dockerfile, with which we try to set up as a webserver. No matter how we try, the build command returns an error because the file `flag.txt` is (understandably) not found. After some trying around and understanding the problem, I was able to start the container just by creating the mentioned file in the directory.

The service provided is a barebones website where we can upload small files, I have noticed (initially) that files over 500kB get rejected. The accepted files are then assigned links with their serial number. The file type is also displayed.

![page2.png](hxp36c3/page2.png)

We grab the webserver banner with `nmap`:

```
8000/tcp open  http            nginx 1.14.2
|_http-server-header: nginx/1.14.2
```

We have an nginx server running!

In the provided files, apart from the Dockerfile we have a .php index file too,
**index.php**:

```php
<?php
error_reporting(0);
ini_set('display_errors', 0);
ini_set('display_startup_errors', 0);
session_start();

if( ! isset($_SESSION['id'])) {
    $_SESSION['id'] = bin2hex(random_bytes(32));
}

$d = '/var/www/html/files/'.$_SESSION['id'] . '/';
@mkdir($d, 0700, TRUE);
chdir($d) || die('chdir');

$db = new PDO('sqlite:' . $d . 'db.sqlite3');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec('CREATE TABLE IF NOT EXISTS upload(id INTEGER PRIMARY KEY, info TEXT);');

if (isset($_FILES['file']) && $_FILES['file']['size'] < 10*1024 ){
    $s = "INSERT INTO upload(info) VALUES ('" .(new finfo)->file($_FILES['file']['tmp_name']). " ');";
    $db->exec($s);
    move_uploaded_file( $_FILES['file']['tmp_name'], $d . $db->lastInsertId()) || die('move_upload_file');
}

$uploads = [];
$sql = 'SELECT * FROM upload';
foreach ($db->query($sql) as $row) {
    $uploads[] = [$row['id'], $row['info']];
}
?>
```

The server is assigning a unique PHP session variable to each user, files are identified by being placed in a folder with the respective session id. The server uses a sqlite3 database and the connection is handled by the PHP engine. We also discover, that the file size limit is not 500kB but only 10kB! `$_FILES['file']['size'] < 10*1024`

The queries used seem pretty basic, for now, I do not see any countermeasures against sql-injection. This command seems especially vulnerable:

```php
"INSERT INTO upload(info) VALUES ('" .(new finfo)->file($_FILES['file']['tmp_name']). " ');"
```

After some reading around online, it turns out, file upload vulnerabilities are not performed through the filename(what I would have expected), but through image metadata. The sanitization of said metadata makes this possible.

Apparently, traditional tools, like `sqlmap` are not capable of such attacks.

Unfortunately, I could not find any tools online, which are able to perform an sql injection attack from such an unusual attack vector.

### Technical details

I have found an explanation for the vulnerability, it is an RCE:

> I discovered a technique to hide php code in the EXIF data of the image file. When the image is loaded by the page, the php tags located in the headers are interpreted as php code and run by the server. 

[https://spencerdodd.github.io/2017/03/05/dvwa_file_upload/]

When PHP handles images, it is possible to escape processing from inside EXIF headers and run instructions. The vulnerability lies in the fact, that PHP tags are recognized in areas where it should not be possible, such as image metadata.

### Lessons (to be) learned

- SQL injection is not only possible through GET and POST parameters
- The use of more advanced SQL injection tools