<?php
include "../../config.php";
if($_GET['view_source']) view_source();
// 만약 사용자 쿠키가 설정되지 않았다면, id와 pw가 default 값으로 설정된다.
if(!$_COOKIE['user']){
$val_id="guest";
$val_pw="123qwe";
// id와 pw를 20번씩 base64로 인코딩한다.
for($i=0;$i<20;$i++){
$val_id=base64_encode($val_id);
$val_pw=base64_encode($val_pw);
}
// 숫자를 특정 문자로 대체한다.
$val_id=str_replace("1","!",$val_id);
$val_id=str_replace("2","@",$val_id);
$val_id=str_replace("3","$",$val_id);
$val_id=str_replace("4","^",$val_id);
$val_id=str_replace("5","&",$val_id);
$val_id=str_replace("6","*",$val_id);
$val_id=str_replace("7","(",$val_id);
$val_id=str_replace("8",")",$val_id);
$val_pw=str_replace("1","!",$val_pw);
$val_pw=str_replace("2","@",$val_pw);
$val_pw=str_replace("3","$",$val_pw);
$val_pw=str_replace("4","^",$val_pw);
$val_pw=str_replace("5","&",$val_pw);
$val_pw=str_replace("6","*",$val_pw);
$val_pw=str_replace("7","(",$val_pw);
$val_pw=str_replace("8",")",$val_pw);
// 사용자의 쿠키를 설정한다.
Setcookie("user",$val_id,time()+86400,"/challenge/web-06/");
Setcookie("password",$val_pw,time()+86400,"/challenge/web-06/");
echo("<meta http-equiv=refresh content=0>");
exit;
}
?>
<html>
<head>
<title>Challenge 6</title>
<style type="text/css">
body { background:black; color:white; font-size:10pt; }
</style>
</head>
<body>
<?php
// 쿠키로부터 id와 pw를 디코딩한다.
$decode_id=$_COOKIE['user'];
$decode_pw=$_COOKIE['password'];
// 특정 문자를 다시 원래 문자로 변환한다.
$decode_id=str_replace("!","1",$decode_id);
$decode_id=str_replace("@","2",$decode_id);
$decode_id=str_replace("$","3",$decode_id);
$decode_id=str_replace("^","4",$decode_id);
$decode_id=str_replace("&","5",$decode_id);
$decode_id=str_replace("*","6",$decode_id);
$decode_id=str_replace("(","7",$decode_id);
$decode_id=str_replace(")","8",$decode_id);
$decode_pw=str_replace("!","1",$decode_pw);
$decode_pw=str_replace("@","2",$decode_pw);
$decode_pw=str_replace("$","3",$decode_pw);
$decode_pw=str_replace("^","4",$decode_pw);
$decode_pw=str_replace("&","5",$decode_pw);
$decode_pw=str_replace("*","6",$decode_pw);
$decode_pw=str_replace("(","7",$decode_pw);
$decode_pw=str_replace(")","8",$decode_pw);
// id와 pw를 base64로 20번 디코딩한다.
for($i=0;$i<20;$i++){
$decode_id=base64_decode($decode_id);
$decode_pw=base64_decode($decode_pw);
}
// 사용자의 id와 pw를 화면에 출력한다.
echo("<hr><a href=./?view_source=1 style=color:yellow;>view-source</a><br><br>");
echo("ID : $decode_id<br>PW : $decode_pw<hr>");
// 디코딩된 id와 pw가 "admin", "nimda"와 일치한다면 solve(6) 함수를 호출한다.
if($decode_id=="admin" && $decode_pw=="nimda"){
solve(6);
}
?>
</body>
</html>
view-source 하이퍼링크를 클릭해서 code를 확인했다.
코드를 해석해 보면
사용자 쿠키가 설정되지 않았기에
id와 pw가 "guest", "123qwe"으로 설정되고
20번 base64 인코딩 및 특정 문자로 치환하는 과정을 거쳐서
쿠키값으로 들어오게 된다.
그리고 다시 반대로 쿠키값을 숫자로 치환하고
20번 디코딩하는 과정을 거쳐
문제 페이지에 이를("guest", "123qwe") 출력하고 있음을 알 수 있다.
마지막에는 id와 pw의 값이 "admin", "nimda"와 일치하는지 확인하여
일치한다면 solve(6) 함수를 호출해 문제가 해결되는 것처럼 보인다.
즉 문제를 해결하기 위해서는 id와 pw의 값에 "admin", "nimda"가 들어가면 될 것 같다.
이를 20번 인코딩, 치환 과정을 거쳐서 쿠키에 집어넣어 보자
// admin 인코딩 및 치환
var a = 'admin';
for (var i = 0; i < 20; i++) {
a = btoa(a);
}
a = a.replaceAll('1', '!');
a = a.replaceAll('2', '@');
a = a.replaceAll('3', '$');
a = a.replaceAll('4', '^');
a = a.replaceAll('5', '&');
a = a.replaceAll('6', '*');
a = a.replaceAll('7', '(');
a = a.replaceAll('8', ')');
// nimda 인코딩 및 치환
var a = 'nimda';
for (var i = 0; i < 20; i++) {
a = btoa(a);
}
a = a.replaceAll('1', '!');
a = a.replaceAll('2', '@');
a = a.replaceAll('3', '$');
a = a.replaceAll('4', '^');
a = a.replaceAll('5', '&');
a = a.replaceAll('6', '*');
a = a.replaceAll('7', '(');
a = a.replaceAll('8', ')');
CSRF is an attack that allows an attacker to insert a script into a browser and exploit a user's authenticated session to request the server side for intended actions(remittance, product purchase, etc.). This is a problem that arises because certain web applications trust users.
Lab: CSRF vulnerability with no defenses
[Information]
[Problemsolving]
1. I accessed the lab and logged in with the following account. "wiener:peter". Then I changed my email and grabbed it as a proxy.
2. I checked the POST request related to email change on the Logger tab of Burp Suite and right-clicked to access the CSRF PoC generation tool
The HTML code was copied from the CSRF PoC generator, pasted into the body part of the server attack-related page, and the attack was delivered after changing the viewer's email address.
XSS is an attack that can allow an attacker to insert a script into the target browser to execute arbitrary commands on the client side or steal user information such as cookies or sessions. This is a problem that occurs because users trust certain web applications.
Lab: Reflected XSS into HTML context with nothing encoded
[Information]
[Problemsolving]
1. I found a search form in lab.
I have entered "alert()" function javascript code, and serched.
The lab was resolved with a warning window reading "You've been hacked".
Using javascript's alert function, I created a code as follows.
And if you click the OK button, you'll see my nickname.
You can also use the alert() function script in the console window of the developer tool.
Lab: Stored XSS into HTML context with nothing encoded
[Information]
[Problemsolving]
1. I checked that there was a section to write comments by accessing the lab and entering the post view. In the comments section I put the alert() script and uploaded it.
1. When I connected to the problem server, my public IP address was displayed.
2. In the problem file, I checked the code in which the flag function was written in the root path part. Analyzing the code, you can see that the IP address is forwarded to the server to execute the desired shell command(for example: using '; ls' command to check the directory list) and capture and show the results fo the commands executed by the server.
3. I sent the request to the web server via curl as follows. The '-H' option is to add a request header, and "X-Forwarded-For" is one of the headers that carries the client's IP address to the server. And execute the "; cat /flag" shell command. That is, it functions to execute a shell command "; cat /flag" using the user's IP address and show the result to the user. It can be seen that the flag is derived as a result of the shell command as follows.
