# Mega-Mailer
Category: Web

Points: 591

Description: We recently launched a mass email sender that can work with any SMTP server, but recently we have reports of information leaks and and trolling through our service. Can you find whats wrong with it ?

Url: http://very.uniquename.xyz:8080/

This `Mega Mailer` challenge is one of the hardest web challenges in this CTF. Me and my teammates need to spend a lot of times on this challenges. However This was a nice challenge. Thanks to CTF organizarers and challenge authors for making Amazing Challenges.


When We go to website, we can see that we can put `SMTP Ip and Port` and We can see `Example CSV file` named `recipitents(1).csv`.


# Thinking The Vulnerability

First i am spending time with injecting `SQL injection` and `XSS`. We got `500` error everytime. And After a while one of my teammates found that we need to put real `SMTP server and port.` So i tested `smtp.google.com` in `Host` field and put `25 in Port` field. and we submit it but get `500` error. What??.

After a while, i understand that we need to put `recipitents(1).csv` to submit our input to ping to `smtp.google.com`. So tried to ping with the file and got success. we can ping but not get anything. But THis is our first success.

After while, i got a idea to run our `smtp` server locally and do `port forward` to make our local `smtp server` to be global. So we can get response from server in our machine.

For that i used free `vps container` service called [goorm](https://ide.goorm.io/) that can do port forward.


And i host my `smtp` server in vps locally by python3 `python3 -m smtpd -c DebuggingServer -n 0.0.0.0:45` and do port forward.

And i put the `vps machine port forwarded ip and port` in Host and port field and Test the `SSTI` in `Main Body` field.

And got response back with `4`. So that mean our `SSTI` injection is success. Bingo! ?

After tesing many `SSTI` payloads. One payload from [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) worked.

The Payload is `{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}` and it worked and return with flag. Bingo! again ?.

# Flag
dsc{819_8r41n_m41L3R}

# Thanks For Reading!

Original writeup (https://github.com/ComdeyOverFlow/DeconstruCTF-2021/blob/main/Mega-Mailer/README.md).