> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/authored/nyp-infosec-december-ctf-2022/breadsecurity.md).

# BreadSecurity

## BreadSecurity

| Difficulty | Points | Solves |
| ---------- | ------ | ------ |
| Medium     | 300    | 2      |

## Description

> Poem by ChatGPT

## Solve

In the challenge description, we can identify that the place we should investigate is on github and discord. In InfoSec discord, we can see that there is a `Bread Security` discord bot.

Playing around with the command returns nothing useful

However, when running the `!pickle` command, the message got deleted instantly and I received a direct message from the bot.

Since we have no way to proceed from here, lets swap to the other point of entry which is `github`

Searching `[Bread Security](https://github.com/search?q=Bread+Security)` on github shows a [repository](https://github.com/edwinczd/BreadSecurity) `edwinczd/BreadSecurity`(repo no longer exists)

Reading the source code, we see that `!pickle` perform base64 decoding and `pickle.loads()` function on the input.

Referring to [this](https://davidhamann.de/2020/04/05/exploiting-python-pickle/) article, we are able to perform RCE and gain a reverse shell.

1. Start a [ngrok](https://ngrok.com/docs/getting-started) tunnel so that we are able to catch the reverse shell
2. Create a payload based on the article above

   The `command` is a simple python reverse shell taken from [payloadallthethings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#python)
3. Use `nc -nvlp 4444` to catch the reverse shell
4. Send the payload to the discord bot and win :D