1 of 22

​

lightning talks @ Pykonik Tech Talks #63

by disconnect3d

​

disconnect2d

Topics:

  • 18 sesja windowsowa
  • Task "Collector" from PlaidCTF 2023 aka Postgres replica "bug"
  • Envvars
  • CPython 3.11 speedup

2 of 22

17 Sesja Linuksowa

​

https://17.sesja.linuksowa.pl/

3 of 22

18 sesja windowsowa

4 of 22

18 sesja windowsowa

https://18.sesja.linuksowa.pl/

​

Now:

DEMO + ovh + dig

Also thx to @efpee#0659 for finding and showing this bug to me & CLUG.

5 of 22

Zadanko "Collector" z PlaidCTF

aka Postgres vs Postgres

6 of 22

Collector z Plaid CTF 2023

main db

worker db

Frontend/backend

node.js

webhook �napisany w

C na aarch64

7 of 22

Collector z Plaid CTF 2023

main db

worker db

Frontend/backend

node.js

webhook �napisany w

C na aarch64

Webhook:

  • kind=...
  • target=http:/…
  • secret=...

HTTP

request

8 of 22

Collector z Plaid CTF 2023

main db

worker db

Frontend/backend

node.js

webhook �napisany w

C na aarch64

Webhook:

  • kind=...
  • target=http:/…
  • secret=...

HTTP

request

webhook

webhook

9 of 22

Collector z Plaid CTF 2023

main db

worker db

Frontend/backend

node.js

webhook �napisany w

C na aarch64

Webhook:

  • kind=...
  • target=http:/…
  • secret=...

HTTP

request

webhook

webhook

webhook

10 of 22

Collector z Plaid CTF 2023

main db

worker db

Frontend/backend

node.js

webhook �napisany w

C na aarch64

Webhook:

  • kind=...
  • target=http:/…
  • secret=...

HTTP

request

webhook

webhook

webhook

HTTP

request��(libcurl)

11 of 22

Screenshot z Ghidra

12 of 22

Screenshot z Ghidra

13 of 22

Screenshot z Ghidra

14 of 22

Screenshot z Ghidra

15 of 22

Screenshot z Ghidra

16 of 22

Collector z Plaid CTF 2023

in a nutshell:

count1 = SQL(" select count(*) from hooks where kind='$kind' ")

​

if count1 > 10:

count1 = 10

​

count2 = SQL(" select target, secret from hooks � where kind='$kind' � order by target limit 10 ");

​

# bug gdy count1 != count2

17 of 22

Collector z Plaid CTF 2023

# docker exec -it --user postgres collector_maindb_1 psql -c "select 'A'>'a'"

?column?

----------

f

(1 row)

​

# docker exec -it --user postgres collector_workerdb_1 psql -c "select 'A'>'a'"

?column?

----------

t

(1 row)

​

18 of 22

Collector z Plaid CTF 2023

​

19 of 22

Environment variables�"quirk"

20 of 22

CPython 3.11

speedups

(https://docs.python.org/3/whatsnew/3.11.html)

21 of 22

…and that's all

22 of 22

Thanks!

​

by ~disconnect3d