Docker1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: dockerfile_disclosure, lfi_path_traversal

Summary

Walkthrough of the CUSTOM Web Docker1. LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Description

LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Analysis

The application has a /static/ endpoint with a file parameter used to serve static files. The parameter does not filter ../ sequences, allowing to escape the static files directory and read arbitrary files.

In Docker containers, the Dockerfile often contains:

• Environment variables with secrets (ENV)
• Comments with flags or passwords
• ARG directives with sensitive data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The Dockerfile is usually located in the application root or one level above the static directory.

Solution

1. Discovered the static files endpoint:

https://2019-11-10-docker1.ctf.su/static/?file=style.css

1. Verified path traversal vulnerability:

https://2019-11-10-docker1.ctf.su/static/?file=../

1. Read the Dockerfile via path traversal:

https://2019-11-10-docker1.ctf.su/static/?file=../Dockerfile

1. Found the flag in the Dockerfile (in an ENV variable or comment).

Typical flag locations in Dockerfile:

 dockerfile read-only • copy allowed Copy
# Flag can be in a comment
# FLAG: spbctf{...}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Or in an environment variable
ENV FLAG=spbctf{...}

# Or in ARG
ARG SECRET=spbctf{...}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering dockerfile_disclosure, lfi_path_traversal was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-11-10 • CUSTOM • Docker1 • Difficulty: Easy