I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be recovered by uploading a QR code to the website. No other file extensions besides JPEG are allowed for upload. Given that, I tried to generate a QR code with the provided login info, with no results. Please notice that my understanding on this matter is very bad. So I was wondering if exploiting a QR code would a good attack vector. But I'm starting to realize that might not be a practical/executable way. Am I going in the right direction?

  • Do you have any information on what parser is used for the QR code reading and what version? Did you find a local file include bug that could execute a script you uploaded with a jpeg extension? – Tobi Nary Oct 15 '17 at 9:07
  • @SmokeDispenser no I don't have any info on QRcode parser. Is there any way to get it? – fish202 Oct 15 '17 at 16:25

Instead of uploading user info to QR code try to upload a malicious script to bypass the login. If you found the uploads directory, you can run your script and get more access.

| improve this answer | |
  • As I mentioned before the upload only allows .jpeg/.jpg extensions. How could I find the uploads directory? I tried to use dotdotpwn in order to know about vulnerable directories but this don't have a module for https – fish202 Oct 15 '17 at 16:23
  • I think I misunderstood you. Were you suggesting to "disguise" malicious code on QRcode and then submit it to the website? Will this trigger a script by simply doing that? – fish202 Oct 15 '17 at 18:16
  • use a directory brute force to know the upload directory,, then upload a malicious script disguised in QR image .jpeg/.jpg , then from the upload page you found trigger the script. – mrashid Oct 15 '17 at 22:19
  • @fish202 What I think is wanted here is for you to try to upload something else other than a JPEG file. It's likely that the server is only checking the file extension rather than the content, so you can upload something else by changing the file extension. What needs to go in the specially-crafted file I have no idea, I imagine the idea would be to trigger some kind of injection or buffer overflow attack. – Micheal Johnson Nov 11 '17 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.