Challenge Description:#

1
Someone hacked my space image viewer, but it's 100% secure now! Note: Attacking nasa's API is out of scope for this challenge

The Rundown#

Ok, so before we actually look at the code, let me tell you about the website. So this site let’s us search for images from NASA using their API.

It’s hiding a secret though… there is an internal server, serving the flag.

But, how do we get to it? Well from the code you will be able to read below, it checks if the url we send it to resolves to one of NASA’s IP addresses and then it shows us the page content if it doesn’t error out.

Reading the Code#

Here is the code we are interacting with:

1
from flask import Flask, request, Response, abort, render_template
2
import time
3
import socket
4
import requests
5
from urllib.parse import urlparse
6

7
app = Flask(__name__)
8

9
# Resolve NASA's IP at startup
10
NASA_HOST = "images-api.nasa.gov"
11

12
@app.route("/")
13
def index():
14
    return render_template("index.html")
15

16
@app.route("/api")
17
def api():
18
    NASA_IPS = set(socket.gethostbyname_ex(NASA_HOST)[2]).union({'3.175.115.68', '3.175.115.60', '3.175.115.113', '3.175.115.52'})
19

20
    target_url = request.args.get("url")
21
    if not target_url:
22
        abort(400, "Missing url parameter")
23

24
    # Parse the target URL
25
    parsed = urlparse(target_url)
26
    if not parsed.scheme:
27
        target_url = "https://" + target_url  # assume https if missing
28
        parsed = urlparse(target_url)
29

30
    hostname = parsed.hostname
31
    if not hostname:
32
        abort(400, "Invalid URL")
33

34
    # Prevent users brute forcing our api
35
    time.sleep(1)
36
    try:
37
        resolved_ip = socket.gethostbyname(hostname)
38
    except socket.gaierror as e:
39
        abort(400, "Unable to resolve hostname")
40

41
    # Verify that the url provided resolve's to NASA's IP address
42
    if resolved_ip not in NASA_IPS:
43
        abort(403, "URL does not resolve to NASA")
44

45
    # Fetch and stream the content
46
    try:
47
        r = requests.get(target_url, stream=True, timeout=5)
48
        if r.status_code == 429:
49
            abort(429, f"Rate limited by NASA. (This challenge is still solvable)")
50

51
        r.raise_for_status()
52
    except requests.RequestException as e:
53
        print("failed to fetch", target_url, e)
54
        abort(502, "Failed to fetch data")
55

56
    return Response(
57
        r.iter_content(chunk_size=8192),
58
        content_type=r.headers.get("Content-Type", "application/octet-stream"),
59
    )

Here is the stuff they don’t want us to get to:

1
from flask import Flask, request, Response, abort
2

3
app = Flask(__name__)
4

5
@app.route("/")
6
def root():
7
    return "the flag will go here"

Here is the Dockerfile if you were wondering how I know what the ports are:

1
FROM python:3.13.7-slim-trixie
2

3
RUN pip install --no-cache-dir waitress flask requests
4

5
WORKDIR /app
6
COPY . .
7

8
USER nobody
9

10
CMD waitress-serve --listen "127.0.0.1:5001" internal_app:app & \
11
    waitress-serve --listen "0.0.0.0:1337" --trusted-proxy '*' --trusted-proxy-headers 'x-forwarded-for x-forwarded-proto x-forwarded-port' --log-untrusted-proxy-headers --clear-untrusted-proxy-headers --threads 4 main:app

Those forwarded for headers don’t affect the challenge by the way, it’s because the remote instance sits behind a proxy. You can ignore them.

Alrighty, so from the code above, we can control the url parameter and if we can send it to 127.0.0.1:5001, we will get the flag back as a response. How though?

DNS Rebinding#

So, DNS rebinding is going to be the key to solving the challenge here. What this helps us do is change what our url resolves to and if we time it right, we can exploit a Time Of Check Time Of Use (TOCTOU) vulnerability, (I pronounce it as /tɔk ˈtu.ə/).

What do I mean by time it right though? Well for this attack, if we aren’t lazy, we can set up a DNS server for our domain and return DNS packets with a very small Time To Live (TTL). During this short TTL window, we need to change the DNS A record to be 127.0.0.1. Since the TTL is small, the cached entry for the previous IP address (A record) expires quickly and becomes invalid. This forces the server to requery the DNS server and it will now resolve to 127.0.0.1.

So, during the check, the url will resolve to one of NASA’s IP addresses and pass, then it will resolve to 127.0.0.1 which will grant us access to the internal server with the flag on it.

How Do We Actually Do This?#

Well, I’m lazy so I just looked for some off-the-shelf solution and found this: https://lock.cmpxchg8b.com/rebinder.html (repo for the project)

From the site:

1
To use this page, enter two ip addresses you would like to switch between. The hostname generated will resolve randomly to one of the addresses specified with a very low ttl.

So, we just enter one of the NASA IPs such as 3.175.115.68 and 127.0.0.1.

Once we have the link, we can visit https://janus.secso.cc/api?url=03af7344.7f000001.rbndr.us:5001/.

When trying this locally it was pretty consistent, working about every other attempt, but for some reason remote didn’t want to cooperate.

I’m guessing this is because of the random DNS resolution and the remote instance erroring for some reason leading to a bunch of 403s and 502s.

This is where the gambling comes into play:

NOTICE:

It took a while and felt just like this:

Afterthoughts#

Honestly, I should’ve written a script to automate this but I was too lazy to and decided clicking resend request 784 times was better.

Also this was a pretty cool CTF challenge, I finally got to put into practice an attack I’ve only heard about before.

Thanks for reading! 😊