\n\nThis page has been machine-translated from the original page.
\n
The web challenge ”Truth about Pi” from TSG LIVE! 6 CTF taught me a lot, so I want to summarize what I learned in the form of a writeup and memo.
\nAt first I assumed it was an injection challenge, so I kept falling deeper and deeper into a rabbit hole.
\nThese are notes from the serious studying I did afterward, partly as a reminder to myself.
\nWhen you access the challenge server, you see a page built with the koa framework.
\nAfter reading the provided challenge code, I found that the following section processes the input value, and that the flag is output when the final value of digit becomes 0.
if (ctx.method === 'POST') {\n\tconst { index } = ctx.request.body; // 1\n const pi = Math.PI.toString(); \t\t// 2\n const digit = parseInt(get(pi, index)); //3\n content = `\n\t\t<h1>円周率の${index}桁目は${digit}です！</h1>\n\t\t${digit === 0 ? `<p>${process.env.FLAG}</p>` : ''}\n\t`;\n}The final solution request that retrieves the flag is:
\ncurl -X POST -d \"index=toString.length\" http://localhost:3000Let’s trace through exactly why this request works.
\nFirst, let’s look at const { index } = ctx.request.body;, which runs immediately after the POST request is received.
The body of the submitted POST request is parsed into an object by koa-bodyparser.
\nReading the module’s source code, it appears the body is ultimately returned as JSON-parsed data. As a result, the value of \"index\" is stored in the const variable index via destructuring assignment.
Due to the parsing process, any value the user submits will always become a String object — it is not possible to send a Number object.
\nAs a side note (unrelated to this challenge), if you define \"index\" multiple times in a POST request, it is stored in index as an Array object.
The value of pi, \"3.141592653589793\", is converted to a String object and stored in the variable pi.
(If only Math.PI gave us a longer precision, none of this would have been a puzzle at all…)
After steps 1 and 2, both variables index and pi contain String objects.
From here, we need to find an input value that makes parseInt(get(pi, index)) return 0.
First, the outermost parseInt() simply converts a string to a number, so we don’t need to think too hard about it. The real question is: what input makes get(pi, index) return the string '0'?
Looking at the challenge code, get is defined as const get = require('lodash.get');, so let’s look at the lodash.get source.
The third argument defaultValue defines the return value when result is null. Unfortunately, there is no way to pass that argument in this challenge.
function get(object, path, defaultValue) {\n const result = object == null ? undefined : baseGet(object, path)\n return result === undefined ? defaultValue : result\n}In the code above, the variable pi is passed as object and index as path.
This means baseGet is called. Let’s look at that too.
function baseGet(object, path) {\n path = castPath(path, object)\n\n let index = 0\n const length = path.length\n\n while (object != null && index < length) {\n object = object[toKey(path[index++])]\n }\n return (index && index == length) ? object : undefined\n}The first key point here is the castPath function.
Reading the code, when the incoming value is not an array, it is passed to stringToPath for conversion into an array:
var stringToPath = memoize(function(string) {\n string = toString(string);\n\n var result = [];\n if (reLeadingDot.test(string)) {\n result.push('');\n }\n string.replace(rePropName, function(match, number, quote, string) {\n result.push(quote ? string.replace(reEscapeChar, '$1') : (number || match));\n });\n\n return result;\n});\n\nfunction castPath(value) {\n return isArray(value) ? value : stringToPath(value);\n}The way that conversion works is the key insight.
\nstringToPath splits the string on '.' characters using reLeadingDot. So if a string like 'toString.length' is passed as value, the resulting array is split into two elements: ['toString', 'length'].
Now back to baseGet.
At this point, the variable path holds an array converted from the user-supplied string.
let index = 0\nconst length = path.length\nwhile (object != null && index < length) {\n\tobject = object[toKey(path[index++])]\n}\nreturn (index && index == length) ? object : undefinedThe variable object is the return value of baseGet, which is therefore also the return value of get(pi, index).
Let’s trace through the while loop. Here is a modified version that prints intermediate values:
\nlet index = 0;\nlet object = Math.PI.toString();\nconst path = [\"toString\", \"length\"];\nconst length = path.length;\nconsole.log(\"Before :\" + object);\nwhile (object != null && index < length) {\n\tobject = object[toKey(path[index++])]\n \tconsole.log(\"Count \" + index.toString() + \": \" + object);\n}\nconsole.log(\"After :\" + object);The output is:\n\n“Before :3.141592653589793”\n“Count 1: function toString() { [native code] }”\n“Count 2: 0”\n“After :0”
\n
Here is what is happening.\n\nInside the loop, properties are accessed on `object` using bracket notation.\n\nOn the first iteration, accessing the `toString` property on the String object `\"3.14...\"` yields the Function object for `toString`, which is stored in `object`.\n\nOn the second iteration, the code accesses the `length` property of that Function object.\n\nThis was new to me: in JavaScript, the `length` property of a Function object returns the number of parameters the function accepts.\n\nReference: [Function.length - JavaScript | MDN](https://developer.mozilla.org/ja/docs/Web/JavaScript/Reference/Global_Objects/Function/length)\n\nThe `toString` function we accessed takes zero parameters, so `baseGet` returns `0`, `get(pi, index)` also returns `0`, and the flag is printed.\n\n## Summary\n\nAs a side note: for the same reason described above, any zero-parameter function accessible on the String object — such as `valueOf` or `toLowerCase` — can be substituted for `toString` and will also yield the flag.\n\nWeb challenges are not something I tackle often, but I happened to try this one. I had been carefully reading through the library source code, but my shallow understanding of JavaScript's prototype system meant I couldn't reach the flag on my own. Despite that, it was an excellent and educational challenge. Big thanks to the problem author!