Echo v2

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: command_substitution_bypass, dollar_parenthesis_injection

Summary

Walkthrough of the CUSTOM Web Echo v2. An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

Description

An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

URL: https://2019-10-13-cmdinj.ctf.su/task/echo2

Analysis

The service executes echo <user_input> command with user input.

WAF rules:

• ; - blocked
• | - blocked
• && - blocked
• ` (backtick) - blocked
• $() - ALLOWED
• # - blocked

Key vulnerability: developers blocked backticks to prevent command substitution, but forgot about the alternative $() syntax which does the same thing in shell. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

In shell there are two ways to perform command substitution:

1. `command` - backticks (blocked)
2. $(command) - dollar-parenthesis (allowed!)

Both syntaxes are equivalent - they execute the command inside and substitute its output.

Payload:

what=$(cat /flag)

Sending via POST:

 bash read-only • copy allowed Copy
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/echo2 -d 'what=$(cat /flag)'

What happens on the server:

 bash read-only • copy allowed Copy
echo $(cat /flag)

Shell first executes cat /flag, gets the file contents, then substitutes it as an argument to echo, which outputs the flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering command_substitution_bypass, dollar_parenthesis_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-13 • CUSTOM • Echo v2 • Difficulty: Easy