Last week I was invited to join a team to participate in a CTF (Capture The Flag) contest organized by CSAW Team.
With my wife and kids around, I only had the opportunity to pick one challenge related to Web Exploitation named: "HorceForce" worth 300 points! Basically, you were provided with a low-privilege account and needed to find your way to get Administrator access.
So, there are multiple resources explaining how to exploit it, but definitely I want to share my experience.
After sending some single quotes it was easy to find a SQL Injection bug by getting the well known "MySQL SQL Error Message".
So, as you all know the first attempt was something like:
http://220.127.116.11/horse.php?id=7 or 1 IN (select current_user)
And I got I ERROR Message saying something like "PLEASE STOP trying to hack this blablablabla site".
Then after many techniques to bypass the filter I realized the WAF was configured to deny any string containing either "select" or "union", blindly I assumed the WAF's regular expression was something like:
/^.*select.*$/ or /^.*union.*$/
Which means, every string which even makes no sense from SQLi point of view like: blablaSELECTblabla or a bypass technique like: /*!union*/ , were triggering the Warning Message.
After some research I found the HTTP Pollution technique which basically allows the attacker (among other things) to play with the GET Parameters in order to confuse the WAF filter.
So, how it works?
Let's say you have the GET parameter "id", you can duplicate it (or even add it many times) and send something like:
And, depending on the Framework used (PHP, Java, ASP.NET, etc) the parameters are going to be parsed differently, in our case with Apache/PHP, if you inject the same parameter multiple times, only the last one will be parsed by the Framework (see table below) but guess what? Only the first parameter is going to be analyzed by the WAF!
This means, by injecting: ?id=7&id=[SQLi]
WAF Network Layer parses id=7 <- Good to go!
PHP Application Layer parses id=
So, this is a typical example where you can inject something that is going to be treated differently at Network Layer and Application Layer.
Below is a table where you can find how other Frameworks react when receiving the same parameter multiple times. Like ASP.NET, if it receives two parameters, it will concatenate them, and therefore you can split the attack into those fields to bypass the WAF, which is out of scope of this blog.
So, then my next try was to inject something like:
You can notice, all the injection is taking place in the second parameter, which is not being parsed by the WAF and voila!!! I got my first successful response:
After that, all is simple SQLi to enumerate tables:
Then get fields from table users:
18.104.22.168/horse.php?id=0&id=7 union select 1,2,3,column_name from information_schema.columns where table_name='users' limit 200
And then dump the username and password trying to identify the Administrator password:
But unfortunately, those passwords were encrypted, but if you remember, there was a table named "sessions", so let's dump its content:
Then, you just go to your browser, use an Add-on like "Cookies Manager" from Firefox and change your current session value with one of the ones found above and ..... we got the Admin session:
Which give us the precious key: