Docker2

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: docker_env_leakage, lfi_proc_environ

Summary

Walkthrough of the CUSTOM Web Docker2. LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Description

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Analysis

An LFI vulnerability was found in the web application, allowing arbitrary file reads on the server. In Docker containers, secrets and configuration are often passed through environment variables. The file /proc/self/environ contains all environment variables of the current process.

Solution

1. Discovered an LFI vulnerability in a parameter (e.g., ?file= or ?page=)
2. Used LFI to read /proc/self/environ: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ

or with null-byte (for older PHP versions):

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ%00

1. The response contained the process environment variables, including the flag.

Alternative paths for reading env:

• /proc/self/environ - environment variables of the current process
• /proc/1/environ - environment variables of PID 1 (init process in Docker) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering docker_env_leakage, lfi_proc_environ was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-11-10 • CUSTOM • Docker2 • Difficulty: Easy