CTF on blog.tyage.net

CSP Embedded EnforcementでXSS mitigationをbypassする話

Tue, 26 Jun 2018 15:11:37 +0000

なに

CSP Embedded Enforcementを使って、JavaScriptで書かれたXSS mitigationをbypassできるパターンがあるという話。
以下のような条件が必要なので現実に使える場面は普通はなさそう。
CTFでは便利かもしれない。

Webページで同一オリジンのページをiframeで読み込める
WebページのヘッダにCSPが設定されていない
Webページに指定したHTMLを埋め込める(XSSができる)
ただし、WebページにJavaScriptによるXSS防御機構がある

このとき、CSP Embedded Enforcementを使うことで、防御機構を回避して攻撃コードだけを実行することができる。

SECCON 2017 Final International competition – 参 writeup

Thu, 22 Mar 2018 15:20:40 +0000

SECCON 2017国際決勝に参加した。

5種類のKoH形式の問題と、いくつかのJeopardy形式の問題が出題された。

問題参(KoH)の問題文:

The Raspberry Pi distributed to each team contains the Bingo-Service program
Please log-in your Raspberry Pi ( ssh: 192.168.4.254, user/pass = pi/kenjiinwonderland )
Please set up Bingo-Service on 192.168.4.254 : 80
If you click “Measure” button above, the system will accesses your Bingo-Service in a few minutes later
“Measure” button can be clicked once every 7 minutes (Once you click it, you have to wait for 7 minutes)
Even if you do not click “Measure” button, the system may occasionally access your Bingo-Service
Response time of your service is measured
The hash of the team with the shortest response time is automatically written to flag.cgi
In this challenge, players do not need to write “Team Hash” on a regular basis
You will get a keyword for an attack point, if “Response Time” of your service is less than 20.0
checker.py in Raspberry Pi, is different from we used for accessing your service

Tokyo Westerns CTF 2017 – Clock Style Sheet writeup

Tue, 05 Sep 2017 01:34:28 +0000

Overview

Problem page:
http://css.chal.ctf.westerns.tokyo/

Provided source code:
proxy.py
sanitizer.py

There are 4 pages: /, /refresh, /chrowler, /flag.

When we access /flag, it responses only local IP is allowed. (your IP: 110.3.193.114).
So, we should use /chrowler (crawler using Chrome) to get the content in /flag.

Find XSS

Next, we search XSS and found /refresh has it. (We found the vulnerability when browsing with w3m)
In this page, user will be redirected to the page where he or she is (which represented by Referer header).

Google CTF 2017 – Geokitties v2 writeup

Sun, 25 Jun 2017 17:04:34 +0000

Overview

Problem page:
https://geokittiesv2.web.ctfcompetition.com/

Copy of source code:
https://gist.github.com/tyage/cac08c8e17b90b840fb22cb434cff127

It receives comment, then admin checks it and clicks a link.

The comment is validated by using htmlparser2.

Allowed tags are: p, a, b, img, br, i
Invalid attributes: on(.*)= and href=javascript:...

Solution

What we should do is find the differences in parsing between Google Chrome and htmlparser2.

After some time, I realize that when input is utf-16 string, Chrome parses it as utf-16 string but htmlparser2 does not.

Google CTF 2017 – The X Sanitizer writeup

Sun, 25 Jun 2017 15:57:35 +0000

Overview

Problem page:
https://sanitizer.web.ctfcompetition.com

Copy of source code:
https://gist.github.com/tyage/6eabacf6001bd068287842b1052132e4

The application sanitize input and render it.

Sanitizing method

The method of sanitizing is follow:

1. Remove the words that match with /meta|srcdoc|utf-16be/i from input.
2. Register a ServiceWorker then, render input in iframe
3. In iframe, it load <script src=sanitize> which executes the following code:

onload = _=> setTimeout(_=> parent.postMessage(document.body.innerHTML, location.origin), 1000);
remove = node => (node == document) ? document.body.innerHTML = '' : node.parentNode.removeChild(node);
document.addEventListener("securitypolicyviolation", e => remove(e.target));
document.write('<meta http-equiv="Content-Security-Policy" content="default-src \\'none\\'; script-src *"><body>');

4. The code removes the node which violates CSP.
5. To prevent loading the attacker’s script, ServiceWorker overrides the response of contents as following code:

31C3 CTF – Page Builder writeup

Fri, 02 Jan 2015 00:32:50 +0000

This challenge needs only XSS but it is interesting to me 🙂

These guys have ripped off our designs and using them in their web pages builder! We’d Haxx them, don’t worry we’ll give you decent points for it. http://188.40.18.76/

DEF CON CTF 2014

Tue, 12 Aug 2014 15:29:24 +0000

チームbinjaのパーカー運搬係として参加していました

DEF CON CTF Qualifier 2013

Sat, 05 Oct 2013 16:02:42 +0000

問題解いてた時のログが残ってないし、探せば他が出てくると思うのでwriteupは書きません。
一応、webを何問かとprogramming2問ほどを解きました。

UFO CTF 2013 writeup – Web200

Sat, 05 Oct 2013 14:55:08 +0000

Those aliens consider themselves as the most smart creatures in
the world. Pff. They shouldn't even have tried to defeat mankind
having such stupid stuff in their heads! As for you, why wouldn't
you hack them? They'll most likely surrender then. By the way, it
is known that they update some data every 10-20 seconds, but
unfortunately our equipment can't intercept the data itself.
 
http://superhosting.tasks.ufoctf.ru:8000/

自分のウェブページが作れ、バックアップと復元ができるシステムになっている。

DIMVA CTF 2013 writeup

Fri, 19 Jul 2013 16:29:48 +0000

DIMVA CTFに参加していた。

私のチーム（Epsilon Delta）は850ポイントで17位だった。

Web 100

画像アップローダーが用意されており、どうにかこうにかする問題。

SIGINT CTF 2013 writeup – bloat (cloud 200)

Tue, 16 Jul 2013 20:23:45 +0000

CTF

えと、ブログを更新停止している間に、Epsilon DeltaとしていくつかCTFに参加していました。

Codegate YUT Preliminary 2013
Nuit du Hack CTF Quals 2013
BaltCTF Quals 2013
SECUINSIDE CTF Quals 2013
Boston Key Party CTF 2013
DEF CON CTF Qualifier 2013
SIGINT CTF 2013

はじめは海外のCTFの感覚がつかめず、ちゃんと解いたような記憶もなかったのですが、BKPあたりからは少し慣れてきたような気がします。

今まで解いてた問題のwrite upを書こうとも思ったのですが、すっかり忘れてしまっているため、一番最近やったSIGINT CTFのwrite upを書くことにします。