web hacking on Stephen Swanson

This One Math Trick Makes Banking Easy; Wallet Operators Hate It! - Genesis Wallet: HTB Cyber Apocalypse 2022

stephen@stephenswanson.xyz (Stephen Swanson) — Mon, 23 May 2022 00:00:00 -0700

To weaken the Golden Fang army, we must cut off their funding of the Genesis coins. Ulysses managed to perform a phishing attack against one of the financial operators of the mercenary and retrieved the login credentials “icarus:FlyHighToTheSky” for the Genesis wallet. However, the account is protected with 2FA. Can you hack into this renowned intergalactic wallet and move their funds to your account?

Sometimes, you know there’s a vulnerability in a piece of software that’s been patched, and you want to find the vulnerability so you can use it on an unpatched system. This CTF gave me a good opportunity to practice that. There was an unitended solution to the original genesis challenge. The operators patched the problem, but in a brand new challenge, leaving a vulnerable version up. I decided to see if I could reverse engineer the change and find the problem.

The Challenge

When we first browse to the page, we’re presented with a login/sign in prompt:

After logging in with our new credentials, we’re required to keep track of a totp code:

After saving it, and logging in with our new credentials and one time passcode, we’re presented with the main page.

We’re able to change our two factor code on the settings page, log out, view incoming and outgoing transactions, but the most important part, at least for us, is being able to send transactions:

Based on this information, my guess at the solution was to send something malicious to the ‘icarus’ user. In order to do that, we need two things: the icarus' address, and some kind of payload.

The solution

This is the unintended solution, which I got during the competition. A different post will show the intended solution to the patched challenge: Genesis Wallet Redemption.

After grabbing the zip files of the two challenges and putting them into a folder, as shown above, we can extract both of them:

$ unzip web_genesis_wallet
Archive:  web_genesis_wallet.zip
   creating: web_genesis_wallet
   ...
   
$ unzip web_genesis_wallet_redemption.zip 
Archive:  web_genesis_wallet_redemption.zip
   creating: web_genesis_wallet_redemption/
   ...

Now, we can use the command diff -r to compare these two websites, and see what was changed in the patched version:

That’s a little suspicious. It looks like in the patched version, they added a check to prevent someone transfering negative amounts. So theoretically, if we knew icarus' address, we could send them negative money, and drain their account that way.

Probably the best place to look for the user’s address is in the registration flow. First, we look at routes/index.js, at the /api/register endpoint:

router.post('/api/register', async (req, res) => {
	const { username, password } = req.body;

	if (username && password) {
		return db.getUser(username)
			.then(user => {
				if (user) return res.status(401).send(response('Account already exists!'));
				return db.registerUser(username, password)
					.then(()  => res.send(response('Account registered successfully')))
			})
			.catch(() => res.status(500).send(response('Internal server error!')));
	}
	return res.status(401).send();
});

We see that it calls the db.registerUser function, and so we follow the trail there:

async registerUser(user, pass) {
	return new Promise(async (resolve, reject) => {
		try {
			let address = crypto.createHash('md5').update(user).digest("hex");
			let stmt = await this.db.prepare('INSERT INTO users (username, password, address) VALUES ( ?, ?, ?)');
			resolve(await stmt.run(user, pass, address));
		} catch(e) {
			reject(e);
		}
	});
}

From this, we see that the user’s address is nothing more than the md5 hash of their username! We can generate icarus' address using this command:

$ echo -n "icarus" | md5sum
1ea8b3ac0640e44c27b3cb8a258a87f8  -

The -n is necessary to prevent echo from adding a \n character to the end and spoiling the hash.

With that wallet address and the vulnerability, we’re ready to execute the attack. We go to the Genesis Wallet dashboard, and use the send button to send the address 1ea8b3ac0640e44c27b3cb8a258a87f8 -1337GTC.

The last step is to go to the transactions page and verify the transaction:

After the transaction is processed, we just have to go back to the dashboard, and enjoy our newfound wealth, as well as a shiny new flag:

If this was interesting at all, helped you with one of your challenges, or if you have any questions or corrections, please drop me a line!

Python PIL is Sus - Amidst Us: HTB Cyber Apocalypse 2022

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 18 May 2022 00:00:00 -0700

The AmidstUs tribe is a notorious group of sleeper agents for hire. We have plausible reasons to believe they are working with Draeger, so we have to take action to uncover their identities. Ulysses and bonnie have infiltrated their HQ and came across this mysterious portal on one of the unlocked computers. Can you hack into it despite the low visibility and get them access?

This was a fun challenge, mainly because the correct path was fairly obvious, although exploitation required a little googling. It was great practice for python exploitation.

The Challenge

We’re given a web page with amonglings (?) on them, as well as a place to upload a file

We can upload an image, and the page returns the image with the alpha changed to a value that we can specify here:

We’re also given the complete source code, which shows that this is a python flask app.

The Solution

From examining the page, we can see that we have one pathway through the code; via the /api/alphafy endpoint. In a flask app, you can typically find all the routes in a file named routes.py or something like that.

@api.route('/alphafy', methods=['POST'])
def alphafy():
	if not request.is_json or 'image' not in request.json:
		return abort(400)

	return make_alpha(request.json)

This route just calls calls a function called make_alpha , which we can trace back to the utils.py file.

The make_alpha function is too long to include in it’s entirety, but here are a few snippets that are relevant:

def make_alpha(data):
    color = data.get("background", [255, 255, 255])

    try:
        dec_img = base64.b64decode(data.get("image").encode())

        image = Image.open(BytesIO(dec_img)).convert("RGBA")
        img_bands = [band.convert("F") for band in image.split()]

        alpha = ImageMath.eval(
            f"""float(
				max(
				max(
					max(
					difference1(red_band, {color[0]}),
					""" # just for syntax highlighting
					# ...
					# ...
					# ...
			        new_image.save(buffer, format="PNG")

        return {
            "image": f"data:image/png;base64,{base64.b64encode(buffer.getvalue()).decode()}"
        }, 200

Examining this function, it looks like the call of ImageMath.eval might be interesting. When looking for vulnerabilites, just the word eval in any context is a huge red flag.

After some Googling, we figure out that something like CVE-2022-22817 might be interesting. Since we have a preliminary thumbs up, we can reach into our standard python bag of tricks and pull out a payload like:

__import__('os').system('cp /flag.txt /app/application/static')

Since it seems like the color parameters are evaluated, we can try exploiting the parameters using Burp.

First, we’ll send the api request to the Burp repeater:

Then, we’ll scroll to the bottom of the request, add our payload, and send it off:

We’ll see that we get a 400 response, indicating some kind of server error, but let’s check and see if we actually copied the flag to the /static directory:

Boom! We have a working PoC. Time to use it on the actual challenge server!

This time, I’m not using the repeater, just the interceptor.

After adding the exploit, we’ll pass it to the challenge server, and check if our exploit worked.

And we get the flag, solving the challenge and giving us access to the internal networks of the mysterious amonglings!

If this was interesting at all, helped you with one of your challenges, or if you have any questions or corrections, please drop me a line!

How To Cheat At Wordle

stephen@stephenswanson.xyz (Stephen Swanson) — Thu, 24 Mar 2022 00:00:00 -0700

Introduction

I know a fair few people who are playing the New York Time’s Wordle. I’m not very good at word games, so I started poking around to see if I could find the answer in my own way, and write a browser extension to do it for me.

Following the guide contained herein is guaranteed to put strain on your friendships with real Wordle players. Only continue if you’re willing to brave the consequences.

The Manual Way

It turns out that unlike some other Wordle-inspired games, the NYT Wordle just keeps the solution in the browser’s local storage, so the process for cheating looks something like this:

I’m using Firefox here. You may have to modify the steps here if you’re using a different browser.

First, go into the Firefox tool bar and select “More Tools”:

Next, open the Firefox web developer tools:

Then, click “Storage”, then click “Local Storage”, then click “https://nytimes.com”.

The solution will be in the long string on the right:

The Fun Way

After figuring out the above, I decided to write a little browser extension to automatically pull the solution from local storage for me. The extension is called Robotle, and it’s on my Gitlab.

Here’s Robotle in action:

Robotle currently only works on the NYT wordle, and only supports Firefox. Maybe someday if the mood strikes me, I’ll extend him and make a more universal Wordle cheating tool.