e-Shop "Union"

Full solution below. Spoilers ahead.

Task description

A local shop built a site where customers track their purchase history. You register, and when you shop in person you give your username so your history updates.

The original was in Croatian; this is my translation.

The title is the hint

This CTF hid most of its hints in task titles, and here the word is UNION. In SQL, UNION joins the results of two queries into one list, as long as both return the same number of columns. Attackers use it in an injection to bolt a second query onto the first, so a page that was only meant to show your own data returns rows from another table instead.

So we looked for a field where our input reaches a query. The registration form worked. We registered with this as the username:

writeUp' UNION SELECT username, role, password FROM users WHERE role='admin'; -- '

The opening quote ends the value the site expected, then our UNION SELECT adds a second query that pulls the username, role and password of the admin account out of the users table. The three columns match what the original query returns, so the database accepts the combined result. The -- comments out the rest of the original line.

Logging in as admin

The injected row came back and gave us the admin’s password as a hash. As in SELECT error FROM info, we ran it through CrackStation, which turned it back into a password: zlocinikazna (“zlocin i kazna” is Crime and Punishment in Croatian).

We logged in as admin with that password, and to our pleasant surprise it worked, showing the flag. The fix is the same one that defeats every injection task here: a parameterised query, so the username you register with stays a username and can never carry its own UNION SELECT.