Add Web Exploitation challenge: logged-in

Web Exploitation/logged-in/README.md

@@ -0,0 +1 @@
+wu

Web Exploitation/logged-in/challenge.yml

@@ -0,0 +1,32 @@
+name: "Logged-In"
+category: Web Exploitation
+description: |-
+  The tax portal’s document viewer seems straightforward, but sometimes what gets logged can come back to bite. Can you find a way to leverage the site’s logging mechanism to access sensitive information on the server?
+
+  author: ivy
+
+  <a href="http:/31.97.187.222/:44442/">http:/31.97.187.222/:44442/</a>
+
+# connection_info: nc 31.97.187.222 44442
+
+##### DON'T CHANGE
+value: 500
+type: dynamic
+extra:
+    initial: 500
+    decay: 30
+    minimum: 100
+##### DON'T CHANGE
+
+flags:
+  - BEECTF{LF1_t0_RC3_V14_L09_P01S0N1N9}
+
+tags:
+  - medium
+
+files:
+  - dist/chall.zip
+
+state: hidden
+
+version: "0.1"

Web Exploitation/logged-in/src/Dockerfile

@@ -0,0 +1,32 @@
+FROM php:8.2-apache
+
+RUN a2enmod rewrite
+WORKDIR /var/www
+
+COPY webapp/public/ public/
+COPY webapp/documents/ documents/
+COPY webapp/src/ src/
+COPY webapp/storage/ storage/
+COPY webapp/config/php.ini /usr/local/etc/php/conf.d/z-challenge.ini
+COPY webapp/config/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY webapp/flag.txt flag.txt
+
+RUN set -eux; \
+    chown -R root:root /var/www; \
+    chmod -R u=rwX,go=rX /var/www; \
+    \
+    mkdir -p /var/www/storage/logs /var/log/apache2; \
+    : > /var/www/storage/logs/app.log; \
+    chown -R www-data:www-data /var/www/storage /var/log/apache2; \
+    chmod -R u+rwX,go-rwX /var/www/storage; \
+    \
+    chown root:root /var/www/flag.txt; \
+    chmod 444 /var/www/flag.txt
+
+
+COPY webapp/clear_log.sh /clear_log.sh
+COPY webapp/entrypoint.sh /entrypoint.sh
+RUN sed -i 's/\r$//' /entrypoint.sh /clear_log.sh && chmod +x /entrypoint.sh /clear_log.sh
+
+EXPOSE 80
+CMD ["/entrypoint.sh"]

Web Exploitation/logged-in/src/start.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+PORT="${1:-${PORT:-44442}}"
+IMAGE="${IMAGE:-logged-in}"
+CONTAINER="${CONTAINER:-logged-in}"
+
+docker build -t "$IMAGE" .
+docker rm -f "$CONTAINER" 2>/dev/null || true
+docker run -d --restart unless-stopped --name "$CONTAINER" -p "$PORT":80 "$IMAGE"

Web Exploitation/logged-in/src/webapp/clear_log.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+while true; do
+  > /var/www/storage/logs/app.log
+  sleep 20
+done

Web Exploitation/logged-in/src/webapp/config/php.ini

@@ -0,0 +1,5 @@
+display_errors = Off
+log_errors = On
+allow_url_include = Off
+allow_url_fopen = Off
+disable_functions = system, shell_exec, passthru, proc_open, popen

Web Exploitation/logged-in/src/webapp/config/vhost.conf

@@ -0,0 +1,12 @@
+# config/vhost.conf
+<VirtualHost *:80>
+    DocumentRoot /var/www/public
+    <Directory /var/www/public>
+        AllowOverride All
+        Require all granted
+    </Directory>
+
+
+    ErrorLog  /var/log/apache2/error.log
+    CustomLog /var/log/apache2/access.log combined
+</VirtualHost>

Web Exploitation/logged-in/src/webapp/documents/2023/invoice_2023_445.php

@@ -0,0 +1,5 @@
+<?php ?>
+<h2>Invoice 2023 #445</h2>
+<p>Client: <strong>PT. PETIR777</strong></p>
+<p>Amount Due: Rp 7.500.000</p>
+<p>Due Date: 2023-11-25</p>

Web Exploitation/logged-in/src/webapp/documents/2023/receipt_2023_001.php

@@ -0,0 +1,5 @@
+<?php ?>
+<h2>Receipt 2023 #001</h2>
+<p>Payer: <strong>PT. Demo Jaya</strong></p>
+<p>Amount: Rp 1.200.000</p>
+<p>Date: 2023-03-12</p>

Web Exploitation/logged-in/src/webapp/documents/2024/annual_tax_2024_summary.php

@@ -0,0 +1,5 @@
+<?php ?>
+<h2>Annual Tax Summary (2024)</h2>
+<p>NPWP: 12.345.678.9-012.345</p>
+<p>Total Income: Rp 180.000.000</p>
+<p>Tax Paid: Rp 13.500.000</p>

Web Exploitation/logged-in/src/webapp/documents/2024/npwp_2024_abc123.php

@@ -0,0 +1,5 @@
+<?php ?>
+<h2>NPWP Registry (2024)</h2>
+<p>Name: <strong>Asep Nusantara</strong></p>
+<p>NPWP: 12.345.678.9-012.345</p>
+<p>Status: Active</p>

Web Exploitation/logged-in/src/webapp/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+if [ -f /var/www/flag.txt ]; then
+  HEX="$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')"
+  mv /var/www/flag.txt "/var/www/${HEX}.txt"
+  chown root:root "/var/www/${HEX}.txt"
+  chmod 444 "/var/www/${HEX}.txt"
+fi
+
+[ -x /clear_log.sh ] && /clear_log.sh &
+
+exec apache2-foreground

Web Exploitation/logged-in/src/webapp/flag.txt

@@ -0,0 +1 @@
+BEECTF{LF1_t0_RC3_V14_L09_P01S0N1N9}

Web Exploitation/logged-in/src/webapp/public/.htaccess

@@ -0,0 +1 @@
+Options -Indexes

Web Exploitation/logged-in/src/webapp/public/auth/login.php

@@ -0,0 +1,16 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/../../src/Bootstrap.php';
+
+
+use App\Logger;
+$ua = $_SERVER['HTTP_USER_AGENT'] ?? '-';
+Logger::write($ua);
+
+
+
+
+http_response_code(401);
+?><!doctype html><meta charset="utf-8">
+<title>Login Failed</title>
+<p>Invalid credentials. <br><a href="/">Back</a></p>

Web Exploitation/logged-in/src/webapp/public/index.php

@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/../src/Bootstrap.php';
+
+
+
+?><!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Tax Portal</title>
+  <style>
+    body{font-family:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Arial,sans-serif;margin:40px;line-height:1.5}
+    header{margin-bottom:24px}
+    a{color:#0b57d0;text-decoration:none} a:hover{text-decoration:underline}
+    .card{border:1px solid #ddd;border-radius:10px;padding:16px;margin:10px 0;box-shadow:0 1px 2px rgba(0,0,0,.05)}
+    .grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:16px}
+  </style>
+</head>
+<body>
+  <header>
+    <h1>Tax Portal</h1>
+    <p>Welcome to the tax portal. View past documents or attempt to sign in.</p>
+  </header>
+
+  <section class="grid">
+    <div class="card">
+      <h3>Tax Documents</h3>
+      <ul>
+        <li><a href="/tax/view.php?doc=2024/annual_tax_2024_summary.php">2024 Annual Tax Summary</a></li>
+        <li><a href="/tax/view.php?doc=2024/npwp_2024_abc123.php">2024 NPWP Record</a></li>
+        <li><a href="/tax/view.php?doc=2023/receipt_2023_001.php">2023 Receipt #001</a></li>
+        <li><a href="/tax/view.php?doc=2023/invoice_2023_445.php">2023 Invoice #445</a></li>
+      </ul>
+    </div>
+    <div class="card">
+      <h3>Log In</h3>
+      <form action="/auth/login.php" method="post">
+        <label>Username</label><br>
+        <input name="username" placeholder="user@example.com"><br><br>
+        <label>Password</label><br>
+        <input name="password" type="password" placeholder="********"><br><br>
+        <button type="submit">Sign in</button>
+      </form>
+      <p><small>This demo intentionally always fails sign-in (for logging).</small></p>
+    </div>
+  </section>
+</body>
+</html>

Web Exploitation/logged-in/src/webapp/public/tax/view.php

@@ -0,0 +1,84 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/../../src/Bootstrap.php';
+
+
+$base = realpath(__DIR__ . '/../../documents');
+$doc  = $_GET['doc'] ?? '2024/annual_tax_2024_summary.php';
+
+
+$doc  = preg_replace('#\./#', './', $doc);
+$doc  = preg_replace('#\.\./#', '', $doc, 1);
+
+$path = $base . '/' . $doc;
+
+if (!is_file($path)) {
+    http_response_code(404);
+    ?><!doctype html><meta charset="utf-8">
+    <h2>Document not found</h2>
+    <p>The requested tax document could not be located.</p>
+    <p><a href="/">Back to home</a></p><?php
+    exit;
+}
+
+
+
+
+?><!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Tax Document Viewer</title>
+  <style>
+    body{font-family:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Arial,sans-serif;margin:32px;line-height:1.6}
+    header{display:flex;justify-content:space-between;align-items:center;margin-bottom:20px}
+    a{color:#0b57d0;text-decoration:none} a:hover{text-decoration:underline}
+    .doc{border:1px solid #ddd;border-radius:10px;padding:16px;box-shadow:0 1px 2px rgba(0,0,0,.05)}
+    .hint{background:#f7fafc;border:1px dashed #cbd5e1;padding:12px;border-radius:10px;margin:16px 0}
+    .blob{
+      white-space: pre-wrap;
+      overflow-x: auto;
+      background: #0f172a;
+      color: #e5e7eb;
+      padding: 12px;
+      border-radius: 12px;
+      font-family: ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;
+      font-size: 14px;
+      line-height: 1.5;
+      border: 1px solid #1f2937;
+    }
+  </style>
+</head>
+<body>
+  <header>
+    <h1>Tax Document Viewer</h1>
+    <nav><a href="/">Home</a></nav>
+  </header>
+
+  <div class="hint">
+    <strong>Info:</strong> You are viewing: <code><?php echo htmlspecialchars($doc, ENT_QUOTES, 'UTF-8'); ?></code>
+  </div>
+
+  <div class="doc">
+    <?php
+      $asText = (isset($_GET['raw']) && $_GET['raw'] === '1') || preg_match('#/logs/|\.log$#i', $doc);
+      if ($asText) {
+          echo '<pre class="blob">';
+          include $path;
+          echo '</pre>';
+      } else {
+          include $path;
+      }
+    ?>
+  </div>
+
+  <p class="hint">
+    Quick links:
+    <a href="/tax/view.php?doc=2024/annual_tax_2024_summary.php">2024 Summary</a> ·
+    <a href="/tax/view.php?doc=2024/npwp_2024_abc123.php">2024 NPWP</a> ·
+    <a href="/tax/view.php?doc=2023/receipt_2023_001.php">2023 Receipt</a> ·
+    <a href="/tax/view.php?doc=2023/invoice_2023_445.php">2023 Invoice</a>
+  </p>
+</body>
+</html>

Web Exploitation/logged-in/src/webapp/src/Bootstrap.php

@@ -0,0 +1,13 @@
+<?php
+
+spl_autoload_register(function ($class) {
+    if (str_starts_with($class, 'App\\')) {
+        $path = __DIR__ . '/' . str_replace(['App\\', '\\'], ['', '/'], $class) . '.php';
+        if (is_file($path)) require $path;
+    }
+});
+
+
+@mkdir('/var/www/storage/logs', 0775, true);
+if (!file_exists('/var/www/storage/logs/app.log')) @touch('/var/www/storage/logs/app.log');
+

Web Exploitation/logged-in/src/webapp/src/Logger.php

@@ -0,0 +1,10 @@
+<?php
+namespace App;
+
+final class Logger {
+    private const APP_LOG = '/var/www/storage/logs/app.log';
+    public static function write(string $line): void {
+        $entry = '[' . date('H:i:s') . '] ' . $line . "\n";
+        @file_put_contents(self::APP_LOG, $entry, FILE_APPEND | LOCK_EX);
+    }
+}