Laura just found a website used for monitoring security mechanisms on Rhiza's state and is planning to hack into it to forge the status of these security services. After that she will desactivate these security resources without alerting government agents. Your goal is to get into the server to change the monitoring service behavior.
There are two lines caught my eyes immediately: jsonpatch.applyPatch(services, patch) and ejs.renderFile(__dirname + "/templates/index.ejs", {services}).
Illusion
Description
Laura just found a website used for monitoring security mechanisms on Rhiza's state and is planning to hack into it to forge the status of these security services. After that she will desactivate these security resources without alerting government agents. Your goal is to get into the server to change the monitoring service behavior.
Source code:
Writeup
There are two lines caught my eyes immediately:
jsonpatch.applyPatch(services, patch)
andejs.renderFile(__dirname + "/templates/index.ejs", {services})
.From my experience,
jsonpatch
might have prototype pollution vulnerability. After googling a bit I found this open PR: https://github.com/Starcounter-Jack/JSON-Patch/pull/262 and confirm that prototype pollution exists.But what can we do with this? I googled:
prototype pollution ejs ctf
and found this useful article: From Prototype Pollution to RCEWe can use
outputFunctionName
to do RCE.So just post this to
/change_status
and that's all, solved the challenge by googling!: