Bike has a challenge machine with IP address: 10.129.150.6

We will start with the traditional way i.e scanning with the NMAP

NMAP

As port 80 is for a website, so we will put this IP address into the address bar of FireFox browser. 

As we browse this IP, a simple web page with an input email address text bar shows up. 

More or less here we know that this email address input bar will be our play ground for this machine. 

So we start putting random email and text to check if the input is sanitized or what kind or error pops up.

My first instinct was to check if it even checks for character like @.
On putting asdsd in email address bar, the input is reflected as it is.
Lets check common SQL Injection payloads too.

Upon i nserting <script>echo alert('1'); </script>
Same input was reflected back.

Lets find the technology behind this webpage.
Here comes Wappalyzer int the game.
 

 Wappalyzer:

Wappalyzer is used as extension to inspect a webpage. Here we have it integrated in our FireFox browser.

It shows that this webpage is built on Express framework using Node.js language.

${7*7} was returned as it is.
But upon inserting {{7*7}}, an error was thrown as shown below;

Error: Parse error on line 1:

{{7*7}}

--^

Expecting 'ID', 'STRING', 'NUMBER', 'BOOLEAN', 'UNDEFINED', 'NULL', 'DATA', got 'INVALID'

    at Parser.parseError (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:268:19)

    at Parser.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:337:30)

    at HandlebarsEnvironment.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/base.js:46:43)

    at compileInput (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:515:19)

    at ret (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:524:18)

    at router.post (/root/Backend/routes/handlers.js:14:16)

    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)

    at next (/root/Backend/node_modules/express/lib/router/route.js:137:13)

    at Route.dispatch (/root/Backend/node_modules/express/lib/router/route.js:112:3)

    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)

The template engine in this webpage is "handlebars" as found from the error message.

Now that we have found what template engine is running behind the scenes, we can find and use exploits, designed specifically for "handlebars template engine".

The article on Hacktricks lists exploits for various exploits including php, java, node.js, python, .net, ruby, asp and go.
we will look for Handlebars (NodeJS).
Here java code for an exploit with its url encoding is provided.
But first, we will start BuirpSuit for better checking with repeater.

BuirpSuit:

After or before starting Buirpsuit, we have to configure proxy with our Firefox.
Settings>proxy>mannual proxy> 127.0.0.1, 8080

After doing these configurations, and seeing that intercept is on in BuirpSuit, we have to refresh our browser, Bike tab.

As we will have to try multiple payloads in place of email, we will first send this header to Repeater with CRTL+r.

The repeater tab turned red.
Go to repeater and insert the url encoded input from Handlers.js in place of email as followed;

On pressing Send, we see the following output.

change the above mentioned line to only "return process" as shown below.

Now encode this code as URL and copy. 

We will paste it into our email variable and press send in Repeater tab.

Press send;

The error message completely disappeared with returning of some empty objects. If we alter our code with further global variables, we get into the intersting information.

Enter this code to Decoder for url encoding.

The result was almost the same as previous, means no error.

Finally with the following final code, we got to the flag.

6b258d726d287462d60c103d0142a81c is the required flag.

Bike Tasks

Task1:

What TCP ports does nmap identify as open? Answer with a list of ports seperated by commas with no spaces, from low to high.

22,80 

Task 2

What software is running the service listening on the http/web port identified in the first question?

Node.js

Task 3

What is the name of the Web Framework according to Wappalyzer?

Express 

Task 4

What is the name of the vulnerability we test for by submitting {{7*7}}?

Server Side Template Injection 

Task 5

What is the templating engine being used within Node.JS?

Handlebars 

Task 6

What is the name of the BurpSuite tab used to encode text?

Decoder 

Task 7

In order to send special characters in our payload in an HTTP request, we'll encode the payload. What type of encoding do we use?

URL 

Task 8

When we use a payload from HackTricks to try to run system commands, we get an error back. What is "not defined" in the response error?

require 

Task 9

What variable is traditionally the name of the top-level scope in the browser context, but not in Node.JS?

global 

Task 10

By exploiting this vulnerability, we get command execution as the user that the webserver is running as. What is the name of that user?

root 

Submit Flag

Submit root flag

6b258d726d287462d60c103d0142a81c