I’m not sure I can exploit this... so let’s look at the webpage again:
Wappalizzer addon shows us this info:
The server is running on Nginx 1.14.0.
Maybe we can scan again the webpage taking advantage of this vulnerability:
after not finding nothing new I tried to scan with the common.txt wordlist:
And a .git folder did appear. Note that the vulnerability that I found earlier has nothing to do with this discover, as the .git folder appears to be non restricted to access:
Navigating through this index, I found some interesting:
At /logs/ subfolder, I found the HEAD file. This file is usually a log that contains the activity of the repository. There is a username there (hydragyrum) and what it seems to be the password in plain text. Let’s see if it is the password that the CTF is asking for. Nope.
Maybe we should find a way to download the repository files in any way...
Let’s see the current status of the repository.
Let’s see the commit log:
Interesting, the third commit says that they have obfuscated the code, let’s go back to the commit before that one!
In the index.html now we can see the script not obfuscated!
<script>
function login() {
let form = document.getElementById("login-form");
console.log(form.elements);
let username = form.elements["username"].value;
let password = form.elements["password"].value;
if (
username === "****username****" &&
password === "****password****"
) {
document.cookie = "login=1";
window.location.href = "/dashboard.html";
} else {
document.getElementById("error").innerHTML =
"INVALID USERNAME OR PASSWORD!";
}
}
</script>
The script simply checks that the username and the password have determined values, if them are correct it sets a cookie and redirects us to the dashboard page.
Let’s try to log in with those credentials:
Nothing happens. Let’s create the cookie manually and try to access to dashboard.html
Bingo! Now we can see the content of the dashboard page, saying us that the flag is the password previously discovered. I could have seen this message by reading the dashboard.html file directly:
And that’s it, flag discovered!
Note: A detailed nmap scan at the beginning of the attack would have saved me some time I spent enumerating the webpage, my bad:
Let’s try to de-obfuscate the script to try to make it more human readable... I’ll use the tool:
After some searching, I’ve found a vulnerability that affects this version of Nginx:
According to thus website it’s possible to access to the files included in the git repository by reading the config file and decoding SHA1 hashes.
Also, there are automated tools like that make this task much easier. I’ll use this one, although I would want to know how it works underneath, so I’ll revisit this later.
