add example ctf challenge

Author: djosix

example/README.md

@@ -0,0 +1,9 @@
+## Example
+
+Launch the challenge web server on port 8887:
+
+```
+docker-compose up -d
+```
+
+[![asciicast](https://asciinema.org/a/aHAYBJpVnStiyYowAHV1W37he.svg)](https://asciinema.org/a/aHAYBJpVnStiyYowAHV1W37he)

example/challenge/config.php

@@ -0,0 +1,4 @@
+<?php
+
+$key = 'aGAdbFD7ABmse367Gk5wVrImvunhIkAlL0Qz1X4Yi17Lcpc9IT4tiG8jfiqJWyc4';
+$flag = 'FLAG{78c75409bab501f3973ac6dc7e309b59}';

example/challenge/index.php

@@ -0,0 +1,63 @@
+<?php
+
+require 'config.php'; // $flag $key
+
+
+function encrypt($data, $key) {
+    $length = openssl_cipher_iv_length('aes-256-cbc');
+    $iv = openssl_random_pseudo_bytes($length);
+    $cipher = openssl_encrypt($data, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+    return base64_encode($iv . $cipher);
+}
+
+function decrypt($data, $key) {
+    $length = openssl_cipher_iv_length('aes-256-cbc');
+    $data = base64_decode($data);
+    $iv = substr($data, 0, $length);
+    $cipher = substr($data, $length);
+    return openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+}
+
+
+if ($name = @$_POST['name']) {
+    $data = serialize([
+        'name' => $name,
+        'can_see_the_flag' => FALSE,
+    ]);
+    $session = encrypt($data, $key);
+    $_COOKIE['session'] = $session;
+    setcookie('session', $session);
+    header('Location: .');
+    exit;
+}
+
+$showFlag = FALSE;
+$name = NULL;
+
+if ($session = @$_COOKIE['session']) {
+    $data = decrypt($session, $key);
+    if ($data === FALSE) {
+        die('session error');
+    }
+    $data = unserialize($data);
+    $name = $data['name'];
+    $showFlag = $data['can_see_the_flag'];
+}
+
+
+echo '<title>Find the FLAG</title>';
+if ($name) {
+    echo "<h1>Hi, $name.</h1>";
+    if ($showFlag) {
+        echo "This is your flag: <b>$flag</b>";
+    } else {
+        echo "You cannot see the flag!";
+    }
+} else {
+    echo '<h1>Tell me your name!</h1>';
+    echo '<form method="post">';
+    echo   '<input type="text" name="name" placeholder="name">';
+    echo   '&nbsp;';
+    echo   '<input type="submit" value="Go">';
+    echo '</form>';
+}

example/docker-compose.yml

@@ -0,0 +1,13 @@
+version: '3'
+
+services:
+  challenge:
+    image: php:7-apache
+    volumes:
+      - ./challenge:/var/www/html:ro
+    ports:
+      - 8887:80
+
+networks:
+  internal:
+    driver: bridge

example/exploit.py

@@ -0,0 +1,27 @@
+from padding_oracle import encrypt, decrypt, base64_encode, base64_decode, urlencode, urldecode
+import requests
+
+session = 'ZhGw1aD3RzOX%2FliA7Qu1%2FMOqr%2Fa6jB2fN1Cj09yRwfPJkgUEZnhkpmpq5FenYBQLeyED%2BnY1DH0qPkvjcyhIqMjrYVagGRl6OaXs5cwCH2s%3D' # target this
+
+# define the oracle
+sess = requests.Session()  # connection pooling
+def oracle(ciphertext: bytes) -> bool:
+    resp = sess.get('http://localhost:8887', cookies={'session': base64_encode(ciphertext)})
+    #print(resp.status_code, resp.text)  # let's see what can be a condition
+    return 'session error' not in resp.text
+
+ciphertext = base64_decode(urldecode(session))
+print(ciphertext, len(ciphertext))
+
+block_size = 16
+
+decrypted = decrypt(ciphertext, block_size, oracle, num_threads=64)
+print(decrypted)
+
+decrypted = b'a:2:{s:4:"name";s:6:"djosix";s:16:"can_see_the_flag";b:0;}\x06\x06\x06\x06\x06\x06'
+modified = b'a:2:{s:4:"name";s:6:"djosix";s:16:"can_see_the_flag";b:1;}'  # set can_see_the_flag to 1
+
+encrypted = encrypt(modified, block_size, oracle, 64)
+print(encrypted)
+print(base64_encode(encrypted))
+print(urlencode(base64_encode(encrypted)))