Guiding CTF solution

I need to help solve the CTF using the provided source code, "102854_web-ez-bottle.py," which is a Bottle web app. The instructions say to include a citation like (website), but I’m not given line numbers. I'll be cautious and reference lines best I can, even though the citation format might not require it. Just to be safe!

Planning exploit steps

The task requires providing a step-by-step exploit to access the flag. The file snippet includes line numbers in search results, but the tool’s output doesn’t annotate them. Since the instruction specifies including "(website)" instead of line ranges, I’ll follow that.

The flag is located in "/flag" and can be accessed via SSRF. The '/view/<md5>/<filename>' endpoint checks uploads for blacklisted keywords, but it doesn't describe accessing local files outside the upload directory. Let's focus on SSRF and the unique file access.

Handling template obstacles

The template engine is probably SimpleTemplate, which uses % for Python expressions and {{}} for outputs. But since { and } are blacklisted, I can't use those directly. Colons are blocked too, which complicates things because they’re needed for key Python constructs like slicing or loops. I'll explore alternatives like using % lines without a colon and examining ways to embed code without triggering the blacklist.

Exploring template functionality

Python imports don't require colons, which is helpful. However, underscores are blocked, so features like __import__ are off-limits. The Bottle framework’s template(content) function seems to handle template contents directly, not filenames, which allows us to evaluate Python code within templates. However, certain characters like {, }, and _ are blacklisted, so I need to be creative in how I inject the code while avoiding these restrictions.

Exploring template file inclusion

The Bottle template engine uses %include to load other templates, which might allow us to include the /flag file. This bypasses various blacklisted terms as it avoids curly braces, parentheses, and other restricted characters. By providing an absolute path like /flag, we could try to read it and extract its contents if the template system permits it.

Exploring template injection in Bottle

I’m thinking through the idea of using the % include directive to exploit a template vulnerability in Bottle's engine. Upload a file structured with % include('/flag') to trigger inclusion of the flag file. The blacklist won’t block this approach, since it specifically avoids braces and percent sign control lines. The server should render the flag when visiting the view path.

Thought for 1m 20s

Crafting upload request

The user needs to craft a POST request for file upload, not get updates. I'll focus on submitting that with multipart/form-data. The task involves forming the HTTP request with a field ‘file’ containing a .zip. I'll provide a step-by-step guide, including relevant curl examples and Python requests code for a smooth setup.

Identifying upload pitfalls

There are a few key obstacles when uploading. The file size is limited to 1MB, and the filename must end with '.zip'. After uploading, the server responds with a path, computed from a unique hash, that can be accessed. I'll also note restrictions on includes and address alternative methods if needed.

Examining include behavior

The { and } characters are blocked, but the % include('/flag') won't be affected because it doesn't contain them. Bottle's SimpleTemplate uses % include('filename.tpl') and can use /flag as the path, though I’m unsure if absolute paths will work given Bottle’s template lookup behavior.

Handling include in Bottle

The template() function likely looks in the default template paths for filenames, such as './' or './views/'. Using an absolute path like /flag could work if it reads from disk. Instead of relying on this, a fallback with % rebase('/flag') might be more robust, but we'll avoid blacklisted characters like :.

Creating and uploading payload

To upload a crafted zip file, follow these steps:

1. Create a read.tpl with % include('/flag').

2. Zip it with 'zip pwn.zip read.tpl'.

3. Use curl -X POST or Python requests to send the zip to /upload.

4. Check the response, extract the /view/<md5>/<file> path, and fetch it using curl.

Also, troubleshoot with alternative include tricks like % include(('/'+'flag')) for safety. Ensure

Thought for 57s

Examining template parsing behavior

It seems that the file contained a line like % include("/flag"), causing the template engine to try and include the absolute path '/flag' when visiting /view md5 read.tpl. It failed and returned an error. Maybe leading whitespace or a BOM prevented the template from parsing properly. I think whitespace before the % might be allowed if it's at column 0, but I'll need to be sure.

Confirming template syntax

The documentation says the line must start with the % character, with no preceding whitespace allowed. A BOM, newline, or spaces shouldn’t come before it. If there were quotes around the directive — like in their message: % include(...), that could have caused an issue. The line should not have quotes around it.

Fixing the template include issue

To fix the template issue: make sure the line starts with % and has no leading spaces or quotes around the directive. The problem with absolute paths remains, as they’re not allowed. The lookup path defaults to bottle.TEMPLATE_PATH, which includes . and ./views/. While absolute paths aren’t allowed, we can still traverse directories using relative paths (e.g., ../../../../../../flag).

Addressing path traversal in templates

The path is resolved relative to each lookup directory, typically starting at the current working directory, not the root directory. Using ../ multiple times could either normalize to /flag (not allowed), or could break due to path restrictions. Some frameworks block path traversal, but it's unclear whether this one does. It's also worth considering that the include directive may allow some alternative paths beyond the default lookup route.

Clarifying template path instructions

To fix the issue, make sure the line starts with % include('../../../../../../flag') at the beginning of the file, with no quotes or spaces around it. Check that there is no UTF-8 BOM or extra content in the file, as this can interfere. Instruct to use relative paths and ensure there are no colons in the directive.

Thought for 1m 42s

Investigating Bottle's template behavior

Okay, so the exception from Bottle seems due to absolute path inclusion failures. Bottle's SimpleTemplate supports inline Python with % and include, but colons are blacklisted. A syntax like % if 1: would trigger errors. For % include(), it's fine, but why does % include('../../../../flag') return as text? Could be due to Windows CRLF or the file having a .txt extension.

Investigating why include() returns as text

Bottle might treat "% include(...)" as plain text if the percent sign isn't at the line's start due to extra whitespace or BOM. The user claims they used it exactly, but the double slashes in '../../../../../../..//flag' shouldn't matter. Maybe the issue is in how quotes or HTML escape handles the line, but there's no templating here. I'll check if they are still using Bottle's SimpleTemplate, though the imported template suggests they are.

Considering exploitation paths

I wonder if the 'contains_blacklist' could flag a colon due to it also appearing in "http://", though that's not directly relevant. I then think about using % include with a symlink to '/flag', but symlinks are blocked by an is_symlink check. The best route might be to use a relative path like % include('/proc/self/cwd/../../flag').

Exploring file path and template workarounds

I wonder if I can use relative paths like '../../../../../flag' to refer to the root when trying to bypass absolute path restrictions. But the "Deprecated absolute path" error suggests it's still trying to use absolute paths. The built-in 'open' method is blacklisted, and splitting the open string doesn't seem to bypass it because of how the blacklist checks. Plus, 'get' and '_' are also blocked.

Navigating template and path challenges

I’m thinking about ways to read a file without using banned functions like 'open'. I considered pathlib.Path, but it involves underscores, which are blocked. I also explored Bottle's include, but absolute paths are deprecated, and relative paths might be sanitized. I might need to find another path that avoids both banned words and underscores.

Exploring file-reading workarounds

I’m considering alternatives to open files while avoiding blocked functions like open or subprocess. I realized that using fileinput.input() might bypass the block by calling open internally. The challenge now is outputting content without using banned braces or syntax like colons. It seems like include might still be the most viable option.

Exploring file exfiltration techniques

I'm thinking of manipulating template() by raising an exception to output the flag in the error message. Using fileinput.input() to read the /flag file would work without triggering blocklists, and I can capture the result in a variable like m. The goal is to raise the exception with m containing the flag content.

Thought for 2m 40s

Exploring template engines

Template engines like Bottle, Jinja2, and Django enforce different levels of restrictions on Python code execution. Bottle allows % for code execution, Jinja2 uses {{}} and {%%}, but Django is more restrictive by default. STPL, similar to Bottle, executes Python blocks, though it enforces keyword blacklisting to limit potential risks.

Explaining file upload vulnerability

This vulnerability involves file uploads where a ZIP file is decompressed into a unique directory, and its content is passed to a template engine. The lack of proper restrictions leads to a Server-Side Template Injection (SSTI). We'll discuss the exploitation steps, including payload usage and why certain paths were blocked due to blacklist constraints.

Explaining inclusion behavior and STPL

The main issue was that inclusion using absolute paths triggered a deprecation warning and wasn't executed. We can hook into the error path for this. In STPL, unlike Flask/Jinja, attributes can be accessed without braces, using % to import code. This makes STPL closer to code injection since it uses eval/exec.

Mitigations for template injection

To mitigate this, avoid rendering user-supplied content as a template. Instead, use safe strings, escape input, or configure the engine to disable code execution. In Bottle STPL, ensure templates are loaded from safe paths and never directly from user input. Additionally, sanitize content or use a safer template engine.

Thought for 38s