0ctf2022

Jabasass

2 solves (haha)

docker pull ghcr.io/zsxsoft/my-ctf-challenges:0ctf2022-jabasass

This CTF challenge is based on Wildfly and GraalVM.

1. Bypass nginx limitation.
   • Wildfly is based on Undertow. Undertow supports HTTP/2 out of the box and supports h2c upgrades by default.
   • Just H2CSmuggling here: https://bishopfox.com/blog/h2c-smuggling-request .
2. Find how to bypass the GraalVM default restrictions: https://www.graalvm.org/22.2/reference-manual/embed-languages/#access-privilege-configuration
   • GraalVM's Context.builder is not suited to be used as a sandbox for running untrusted code: https://www.graalvm.org/22.2/security-guide/#security-manager-and-untrusted-code
   • However I found none API can be used in GraalJS.
   • In GraalPython I found that socket module is not restricted - try SSRF.
3. Wildfly will start admin console at :9990
   • Wildfly uses HTTP Digest as identity authentication so we should implement it in GraalPython manually without native access.
     • The password saved in mgmt-user.properties is an example provided by Wildfly and we don't know its plaintext.
     • But it's saved in Digest HA1 format so we can still construct the HTTP Digest.
     • Then we should implement our own digest(). digest() in hashlib in GraalPython requires _cpython_sturct which requires native support.
   • Deployment is banned by ctf user, we need to find a other RCE way.
     • Wildfly has h2-1.4.197.
     • We can test the datasource without saving to disk.
     • https://conference.hitb.org/hitbsecconf2021sin/materials/D1T2%20-%20Make%20JDBC%20Attacks%20Brilliant%20Again%20-%20Xu%20Yuanzhen%20&%20Chen%20Hongkun.pdf
   • Wildfly uses DMR as the default Content-Type in management API.
     • Copying the payload generated by the webbrowser to Python script is the easiest way.
     • But switching to JSON allows us to debug without mouse actions.
     • https://docs.jboss.org/author/display/WFLY9/The%20HTTP%20management%20API.html

Check h2csmuggler.py and pwn.py for exp.

List of web servers I checked about h2c

• Java
  • 🟨 Tomcat 10: Requires configure: https://tomcat.apache.org/tomcat-10.0-doc/config/http.html#HTTP/2_Support
  • 🟨 Jetty: Requires HTTP2CServerConnectionFactory extension: https://www.eclipse.org/jetty/javadoc/jetty-9/org/eclipse/jetty/http2/server/HTTP2CServerConnectionFactory.html
  • 🟩 Undertow: Out of the box: https://github.com/undertow-io/undertow/blob/47b96f21cb4c75a3b46fecfab369551acd7cc6e3/core/src/main/java/io/undertow/Undertow.java#L185
  • 🟩 Vert.x: Out of the box: https://groups.google.com/g/vertx/c/7QYoQFKTmX4
  • Spring Boot
    • 🟨 Http2 should be opened manually with server.http2.enabled=true: https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.configure-http2
    • If http2 is enabled:
      • 🟩 with Tomcat: yes: https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java#L339
      • with Jetty & Undertow: read the doc.
• .NET:
  • 🟥 Kestrel: No h2c.
  • 🟥 IIS 10: No h2c: https://learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-10/http2-on-iis
• Python:
  • 🟥 Gunicorn: No HTTP2: benoitc/gunicorn#1195
  • 🟥 Daphne: No h2c: django/daphne#342
  • 🟥 Uvicorn: No HTTP2: Kludex/uvicorn#47
  • 🟩 Hypercorn: Yes: https://pgjones.gitlab.io/hypercorn/discussion/http2.html
  • 🟥 Twisted: No h2c
• PHP:
  • 🟥 Swoole: No h2c: https://github.com/swoole/swoole-src/blob/461d7c7d58757e75580148c76d120e09260d8c0b/ext-src/swoole_http_request.cc#L341
• 🟨 Golang: Requires h2c package: https://pkg.go.dev/golang.org/x/net/http2/h2c
• 🟥 Nodejs: upgrade should be handled by developer: https://nodejs.org/api/http.html#event-upgrade