CVE-2023–41425 but only RCE part

 DANTECTF and wellcome my new crypto teammate

-------------------------------------------------------------------------

Introduce my self

Im kon-chan, a ctf player UwU

Im insterested in all category UwU

------------------------------------------------------------------------

This is some solution of me, so lazy to writeup but hope guys love it

-Web

    -> Unknow Site 1

    ->Unknow Site 2

    ->Dante barber shop

    ->Dump Admin

-Misc

    -> HellJail

LET'S GO

Unknow Site 1

Look at it

the image made me think the flag can be located at robots.txt :D

And yeah, it was there.

Fisrt flag was easy hehe.

Unknow Site 2:

just now we saw in robots.txt there are some strange directories. Let's check them out. I found in /s3cretDirectory3/ there are many php files, one of them will hav flag

When i click on any file, it renders 'Hello There User!' and in the cookie there is a key flag set value of NOPE

Found 1 file with different size

Read it and got flag in cookie

Dante Barber Shop

I found the login page, I seem to have to login

going back to the index, and reading the source, i noticed that the img tags are all numbered from 2-7

so where is the number 1 :v change and got it

After login, I noticed that it looks like sqli, I love this vuln :D

Try ' to check. It bring back many infomation

Backend use sqlite so i read sqlite_master :D. But fisrt check number of columns

Got table user and some infomations hehe.

found admin

login as admin and received flag

Dumb Admin

Let's explore this site

i tried simple sqli payload: admin' or '1'='1'-- -

Logged in successfully

this was file upload, upload a shell to rce :V

btw, php extension didn't work. try .png.php and it worked

 

Nothing is here :(

read source code, u will see file located,  

i got it

just read flag :D

HellJail

the author gave me a source

sink is exec().

Let's debug :v

i cant use ascii_lettes. 

My idea was use eval() to execute arbitrary command

 :v

My payload contains forbidden characters however in python 3.x, allows you to use italized characters to write your expressions, which aren't ascii

. Look at this

Các bạn có thể dùng trang này để chuyển font sang Italic

Taking advantage of that we will bypass. However, importing os will cause an error.

No module named '𝘰𝘴'

We will take ord('o') and ord('s') then use chr() function and concatenate the characters via eval()

Similar to `_` and `.` 

here is my code and payload

sent and got flag

Thx you for reading