Web Exploitation
Last updated
Last updated
book-print (100 pts)
-
Given URL and source code. Lets check the source code
We can see that endpoint /book and /print are vulnerable to SQL Injection. Endpoint /print also utilize to convert the html to pdf using PDFkit which load local wkhtmltopdf as the binary. Lets check the version of wkhtmltopdf.
wkhtmltopdf 0.12.4 is vulnerable to local file read. From the Dockerfile we know that the flag is stored at /secret/flag_for_youuuu. So the idea is we can chaining the SQL Injection and the local file read
SQL Injection to replace the value returned by the query
The returned value should be the wkhtmltopdf exploit to read local file
From app.rb we know that one of the value printed out in /print is the second value (index 1). From this information we can put the wkhtmltopdf payload in second value. To leak the flag we cannot directly load the file but we can use redirect method.
Exploit wkhtmltopdf
Put the wkhtmltopdf exploit to SQL injection payload and send to server
Flag: CBC{hex_value}
