OWASP/wrongsecrets

Challenge 20 seems to be broken

Wind010 opened this issue · 2 comments

Wind010 commented

Please describe your environment

AMD64
Windows running docker image of wrongsecrets.

What is the expected behavior?

The executable should run expectedly with the input submission.

What is the actual behavior?

Input of correct flag does not complete challenge.

Please provide a reproducible path or test that demonstrates the bug.

Other notes on how to reproduce the issue

Attempt Challenge 20 on the latest docker image or on heroku: https://wrongsecrets.herokuapp.com/challenge/challenge-20

Please provide relevant logs

2024-03-30T04:00:25.484Z  INFO 1 --- [nio-8080-exec-6] o.o.w.c.d.b.BinaryExecutionHelper        : You might be running this in a docker container, trying alternative path: '/home/wrongsecrets/wrongsecrets-c-linux-musl'
2024-03-30T04:00:25.486Z  INFO 1 --- [nio-8080-exec-6] o.o.w.c.d.b.BinaryExecutionHelper        : stdout challenge 19: This is incorrect. Try again
2024-03-30T04:00:28.266Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:00:28.266Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : OS Name detected: Linux
2024-03-30T04:00:28.266Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: linux
2024-03-30T04:00:28.268Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:00:28.268Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : First looking at location:'classpath:executables/wrongsecrets-c-linux-musl'
2024-03-30T04:00:28.269Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : You might be running this in a docker container, trying alternative path: '/home/wrongsecrets/wrongsecrets-c-linux-musl'
2024-03-30T04:00:28.271Z  INFO 1 --- [nio-8080-exec-7] o.o.w.c.d.b.BinaryExecutionHelper        : stdout challenge 19: This is correct! Congrats!
2024-03-30T04:01:20.555Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:01:20.555Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : OS Name detected: Linux
2024-03-30T04:01:20.555Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: linux
2024-03-30T04:01:20.556Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:01:20.556Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : First looking at location:'classpath:executables/wrongsecrets-cplus-linux-musl'
2024-03-30T04:01:20.557Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : You might be running this in a docker container, trying alternative path: '/home/wrongsecrets/wrongsecrets-cplus-linux-musl'
2024-03-30T04:01:20.559Z  INFO 1 --- [nio-8080-exec-9] o.o.w.c.d.b.BinaryExecutionHelper        : stdout challenge 20: Error loading shared library libstdc++.so.6: No such file or directory (needed by /tmp/c-exec-wrongsecrets-cplus-linux-musl13955328424823814631sh)

Any possible solutions?

Image seems to be missing libstdc++ the Dockerfile should be updated with:

RUN apk add --no-cache libstdc++

I was able to validate this without building the Dockerfile, but adding the library in the failing running container as root:

docker exec -it -user root <containerId> /bin/sh
apk add --no-cache libstdc++
cd ~
/home/wrongsecrets # ./wrongsecrets-rust-linux-musl
Welcome to the wrongsecrets Rust binary which hides a secret.
Use args spoil or a string to guess the password.

If the bug is confirmed, would you be willing to submit a PR?

Yes

Yes / No (Help can be provided if you need assistance submitting a PR)

Wind010 commented

I didn't build the Java source, but took the application.jar from the running container in order to build the image, run, and verify the fix:

docker container cp <container_id>:/application.jar .
mv application.jar wrongsecrets-1.8.4-SNAPSHOT.jar
docker build -t wind010/wrongsecrets . 
docker run -p 8080:8080 wind010/wrongsecrets

Logs:

2024-03-30T04:49:44.763Z  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2024-03-30T04:49:44.764Z  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2024-03-30T04:49:44.833Z  INFO 1 --- [nio-8080-exec-1] o.o.wrongsecrets.SessionConfiguration    : Session created, currently there are 1 sessions active
2024-03-30T04:49:47.599Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:49:47.599Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : OS Name detected: Linux
2024-03-30T04:49:47.600Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: linux
2024-03-30T04:49:47.604Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : System arch detected: amd64
2024-03-30T04:49:47.604Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : First looking at location:'classpath:executables/wrongsecrets-cplus-linux-musl'
2024-03-30T04:49:47.604Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : You might be running this in a docker container, trying alternative path: '/home/wrongsecrets/wrongsecrets-cplus-linux-musl'
2024-03-30T04:49:47.613Z  INFO 1 --- [nio-8080-exec-2] o.o.w.c.d.b.BinaryExecutionHelper        : stdout challenge 20: This is correct! Congrats!
2024-03-30T04:56:35.889Z  INFO 1 --- [ionShutdownHook] o.o.wrongsecrets.SessionConfiguration    : Session destroyed, currently there are 0 sessions active
Wind010 commented

PR submitted: