Seccon CTF 2024 Quals

import express from "express";

const PORT = 3000;
const LOCALHOST = new URL(`http://localhost:${PORT}`);
const FLAG = Bun.env.FLAG!!;

const app = express();

app.use("/", (req, res, next) => {
  if (req.query.flag === undefined) {
    const path = "/flag?flag=guess_the_flag";
    res.send(`Go to <a href="${path}">${path}</a>`);
  } else next();
});

app.get("/flag", (req, res) => {
  res.send(
    req.query.flag === FLAG // Guess the flag
      ? `Congratz! The flag is '${FLAG}'.`
      : `<marquee>🚩🚩🚩</marquee>`
  );
});

app.get("/ssrf", async (req, res) => {
  try {
    const url = new URL(req.url, LOCALHOST);
    console.log(url)

    if (url.hostname !== LOCALHOST.hostname) {
      res.send("Try harder 1");
      return;
    }
    if (url.protocol !== LOCALHOST.protocol) {
      res.send("Try harder 2");
      return;
    }

    url.pathname = "/flag";
    url.searchParams.append("flag", FLAG);
    res.send(await fetch(url).then((r) => r.text()));
  } catch {
    res.status(500).send(":(");
  }
});

app.listen(PORT, () => {
  console.log('listen on', PORT)
});

var parseValues = function parseQueryStringValues(str, options) {
    var obj = { __proto__: null };

    var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
    cleanStr = cleanStr.replace(/%5B/gi, '[').replace(/%5D/gi, ']');
    var limit = options.parameterLimit === Infinity ? undefined : options.parameterLimit;
    var parts = cleanStr.split(options.delimiter, limit);
    var skipIndex = -1; // Keep track of where the utf8 sentinel was found
    var i;

    ...

    for (i = 0; i < parts.length; ++i) {
        if (i === skipIndex) {
            continue;
        }
        var part = parts[i];

        var bracketEqualsPos = part.indexOf(']=');
        var pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
        
        // ...
    }

    return obj;
};

Url.prototype.parse = function (url, parseQueryString, slashesDenoteHost) {
  if (typeof url !== "string") {
    throw new TypeError("Parameter 'url' must be a string, not " + typeof url);
  }

  var queryIndex = url.indexOf("?"),
    splitter = queryIndex !== -1 && queryIndex < url.indexOf("#") ? "?" : "#",
    uSplit = url.split(splitter),
    slashRegex = /\\/g;
  uSplit[0] = uSplit[0].replace(slashRegex, "/");
  url = uSplit.join(splitter);

  var rest = url;

  /*
   * trim before proceeding.
   * This is to support parse stuff like "  http://foo.com  \n"
   */
  rest = rest.trim();
  // ...
}

#!/usr/local/bin/node
const readline = require("node:readline/promises");
const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
});

const clone = (target, result = {}) => {
  for (const [key, value] of Object.entries(target)) {
    if (value && typeof value == "object") {
      if (!(key in result)) result[key] = {};
      clone(value, result[key]);
    } else {
      result[key] = value;
    }
  }
  return result;
};

(async () => {
  // Step 1: Prototype Pollution
  const json = (await rl.question("Input JSON: ")).trim();
  console.log(clone(JSON.parse(json)));

  // Step 2: JSF**k with 4 characters
  const code = (await rl.question("Input code: ")).trim();
  if (new Set(code).size > 4) {
    console.log("Too many :(");
    return;
  }
  console.log(eval(code));
})().finally(() => rl.close());

#!/usr/bin/python3
import sys
import subprocess
import tempfile

print(
    """
ʕ◔ϖ◔ʔ Go Language Jail Challenge ʕ◔ϖ◔ʔ

Input your program (the last line must start with __EOF__):
    """.strip(),
    flush=True,
)

# Input
code = ""
while True:
    line = sys.stdin.readline()
    if line.startswith("__EOF__"):
        break
    code += line

# Validation
if len(code) > 170:
    print("Too long code")
    exit(1)
if code.count("(") > 1:
    print("Don't use `(` except in `func main() { ... }`")
    exit(1)
if code.count("{") > 1:
    print("Don't use `{` except in `func main() { ... }`")
    exit(1)

# Run
with tempfile.TemporaryDirectory() as dirname:
    filename = "main.go"
    open(f"{dirname}/{filename}", "w").write(code)

    try:
        proc = subprocess.run(
            ["go", "run", filename],
            cwd=dirname,
            timeout=15,
            capture_output=True,
            env={
                "PATH": "/usr/local/go/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "HOME": dirname,
            },
        )
        print(proc.stdout.decode() if proc.returncode == 0 else ":(")
        print("Executed")
    except subprocess.TimeoutExpired:
        print("Timeout")
    except Exception:
        print("Error")