search

grades_grades_grades

hashtag
Description

Sign up and see those grades :D! How well did you do this year's subject? Author: donfran

Application: https://web-grades-grades-grades-c4627b227382.2023.ductf.devarrow-up-right Downloads: grades_grades_grades.tar.gzarrow-up-right

hashtag
Analysis

Looking into source code to get the flag we need to be 1. Authorized and 2. Teacher.

@api.route('/grades_flag', methods=('GET',))
@requires_teacher
def flag():
    return render_template('flag.html', flag="FAKE{real_flag_is_on_the_server}", is_auth=True, is_teacher_role=True)

Signup:

@api.route('/signup', methods=('POST', 'GET'))
def signup():

    # make sure user isn't authenticated
    if is_teacher_role():
        return render_template('public.html', is_auth=True, is_teacher_role=True)
    elif is_authenticated():
        return render_template('public.html', is_auth=True)

    # get form data
    if request.method == 'POST':
        jwt_data = request.form.to_dict()
        jwt_cookie = current_app.auth.create_token(jwt_data)
        if is_teacher_role():
            response = make_response(redirect(url_for('api.index', is_auth=True, is_teacher_role=True)))
        else:
            response = make_response(redirect(url_for('api.index', is_auth=True)))
        
        response.set_cookie('auth_token', jwt_cookie, httponly=True)
        return response

    return render_template('signup.html')

Authentication is pretty simple. Get data from form, create token and authenticate. Source code shows that if is_teacher is set in JWT token we are considered teacher. Signup already is vulnerable, because of jwt_data = request.form.to_dict(). There's no sanitization or field validation.

grades_grades_grades-1

hashtag
Solution

Let's replicate the API call, but add extra field is_teacher.

  1. -D - to dump headers (Post and Head request can't be sent at the same time with cUrl).

  2. -X POST make a post request.

  3. -d "stu_num=test&stu_email=test%40test.test&password=test&is_teacher=NoDoubt"

    • Post data

    • Extra field: is_teacher=NoDoubt (Can be anything because code is checking that field exists)

  4. Server URL

Make a request to grades_flag with auth_token of "Teacher".

circle-check

Flag: DUCTF{Y0u_Kn0W_M4Ss_A5s1GnM3Nt_c890ne89c3}

hashtag
Note

If you don't prefer using cUrl and want more UI you can use BurpSuite. Go to singup -> intercept -> add is_teacher to request -> Login -> go to GRADING TOOL page -> Profit.

PreviousDownunderflowNextHelpless

Last updated