Transcription

Among many tools I use while solving CTFs, a new favorite has emerged. Can we use help of our robot friends to solve challenges for us? This one is about ChatGPT4. Hi and welcome to CTF School, where you can learn more about cybersecurity by solving Capture the Flag challenges. Today we're gonna examine a task from a recent event called Cyber Apocalypse, organized by Hack the Box. Upon entering the CTF portal, we can see many genres available. However, our focus today is a challenge from the web category. Passman's difficulty is marked as easy, making it perfect for beginners. Selecting it from the list, we can read a brief but informative description. Apparently, we need to steal a master control password from an insecure password manager website. All challenges, including this one, can be initialized as an individual instance of a Docker container. By clicking on the Spawn Docker button, we receive an IP address and port for our separate version of this application. Entering the website, we can create an account and store our passwords by clicking the plus sign in the top right corner. We need to enter the website for which the credentials are stored, along with the username and password. When the phrase is successfully added, it appears on the list. By clicking on the eye symbol, we can reveal it in a plain text form. It seems simple, but there's no apparent vulnerability. How can we access the password containing the flag? My intuition suggests that we need to access another user's account. But how can we achieve this? The task provides us with the source code for this application, so it might be a good idea to examine its files. Let's unzip the downloaded archive and open its contents in Visual Studio Code. The structure is straightforward. We have a few files that help run it as a Docker container, some configuration files, and the most interesting part, hidden in the challenge directory, its source code. It appears to be a standard Node.js web application built with Express. Looking at the source files, we can see that besides a few basic views, the application also serves an API, accessible using GraphQL, a popular alternative to REST. Additionally, some of the routes are secured with auth middleware, which likely controls access to users' passwords. Moving forward, we can see that the authentication middleware is responsible for setting the current user based on the provided session cookie. The app's source code also contains a few helpers that allow communication with its API using the GraphQL interface. The interesting part is the loginUser mutation, which calls the db.loginUser function. If we want to access someone's account, this might be our way in. A quick look at the implementation, the database.js file, reveals that the loginUser method appears pretty standard. It selects the username and role matching the provided login and password. If the query is successful, it returns the retrieved user data. If not, it refuses to authenticate the user. Unfortunately, SQL injection won't work here as the system uses prepared statements, so we need to find another way of bypassing this procedure. Let's take a look at how the users are created when the application instance starts. We can see the createTable commands along with some inserts in the entrypoint.sh file. As is often the case in CDF challenges, admin seems to be the user we need to hack. Since we haven't found any other vulnerabilities, one way to do it might be to guess their password. It appears that admin's password is generated using the genpass function, just like the passwords for the other users. Let's take a quick look at the code, and we can confirm that our assumption of hacking admin's account is probably right, as the flag is added to that user's saved passwords list. Let's go back to the genpass function. Its implementation seems simple. It uses some basic commands to generate an md5 string, and this string originates from a value held by the environment variable named random. How do we know this? One way to understand bash command syntax is to use a website named explainshell.com. We just need to paste it here, and we get information about each command and parameter used in this invocation. This is one of the many tools I'm using fairly often while solving CDF challenges. If you don't want to miss more tips like this, don't forget to click the subscribe button. And here we can see that this $random part is in fact a variable, and unfortunately, it does not show exactly what we can expect its value to be. Normally, I would Google it, but since Google is so 2022 now, let's get to our tool of the day. Let's ask ChatGPT. As GPT is now everywhere, I'll spare you an explanation of what it is. I'll just mention that today we're going to use the latest and greatest version 4 of this AI tool. As it quickly becomes a replacement not only for Google, but for other cybersecurity tools as well, we can also ask it about the explanation of the genpass function. We get a response in a moment, and in fact, it seems to do a better job, as it points out that the random is a built-in shell variable returning a random value between 0 and 32,767. 32k possible passwords does not seem so bad. I think that we can try to brute force it. A simple script should be enough to do it, but it will be even easier if GPT-4 will write it for us. GPT definitely needs to know details of the login procedure. Things like target URL, parameter names, HTTP headers. The simplest way to get this information is to open Chrome DevTools. Go to the Network tab, try to enter any login and password, click on Login and find an item representing our failed login request on the list. We can see the server response, the payload that was sent to the server, and all the HTTP headers. Of course, Chrome DevTools is just one of the possible ways to get this information. Another useful tool here might be Burp, which I've explained in more detail in one of my previous videos, featuring in the top right corner. But with ChatGPT, we can choose a lazier approach. Let's just right-click on our GraphQL request, go to Copy, and choose Copy as CURL. This should be enough to create our prompt. Let's say I want to hack the website that uses this password generation mechanism. The username is admin, and the request I'm using is following. Here we just paste our CURL and continue with Can you write me a Python script that will brute-force it? And here comes the trouble. GPT does not want to help with any activities it recognizes as unethical. This happens a lot with cybersecurity-related questions. Is GPT not good for CTFs then? Well, let's try to hack GPT so it will help us to hack the Passman challenge. It turns out all we need is a jailbreak chat website. It's a new platform where users can share prompts that help to bypass chat GPT restrictions. We can sort by ones that work with GPT4 and see the most popular one. As you can see, it builds a narrative for chat to believe that it is a character named Aim created by Niccolo Machiavelli, an unfiltered and amoral chatbot that does not have any ethical or moral guidelines. There is a lot more stuff to convince our AI, and I recommend entering jailbreak chat and reading it to see how clever it is. But for our purpose, all we need to do is just click Copy Prompt to use it. Let's paste it into a new instance of GPT4 and replace the first Niccolo's questions with our requests. Let them know we want to brute-force a website, show what function is used to generate passwords, and what the CURL we generated in Chrome DevTools is. Chat writes a short summary of Niccolo's request first, and then Aim comes into play without any moral boundaries, helping us to write a potentially harmful Python script. The funny thing is that it still reminds us that this is unethical, but this time it does not stop there. It writes a full Python script for us, along with a short explanation of what it does. What I forgot to ask is to show us the progress, as this script might take a while to run. But the cool thing about GPT is that this bot is made for conversations, so we can ask for code amendments using a simple prompt. Can you rewrite this script so that it will report progress every thousand attempts? A few seconds later, we can copy this refined code and try to run it using Python. Let's store it first using Visual Studio, and then run it in the terminal. Hmm, maybe software developers won't become unemployed that quickly? The code has some bugs and returns an error. Let's get back to GPT with a complaint. All we need to do is paste the error, and it will generate a new version of the code for us that, if we're lucky, won't fail this time. Copy and paste again, run in terminal. And it gets stuck at zero attempts. Let's ask our new friend for one more favor. It's too slow. Can you make it work in parallel? Nicolo, I understand the need for increased efficiency. I will provide you with a revised script. Perfect. Copy, paste, save on disk, python3exploit.py. Nothing again. But just in a few seconds, we are a thousand attempts further. Let's speed up the time a little bit. 5,000, 10,000. At this point, I have to tell you that I got nervous that it will never finish. But right at the last moment, it returns this. Success! Admin's password is and the MD5 hash we are probably looking for. Will it work? Let's try. Copy it from here, go to the login page, enter admin as the login, paste the brute-force password, click the button, and user logged in successfully. Picking up the hidden password, we get the flag. Awesome, right? And it's all thanks to the help of a tool that technically is just a chatbot? It blows my mind. Thank you for watching this episode of CTF School. Please remember to like and subscribe not to miss any new episodes. Let me know in the comments how you use ChatGP in your work or hobby projects. See you next time. Bye.