Обычная страница

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Local File Inclusion via path traversal, Static file serving bypass

Summary

Task: Flask application with static file endpoint. Solution: LFI via path traversal (../../flag.txt) to read the flag file.

Обычная страница — hackerlab

Description

Решил попрактиковаться в написании приложений на Flask-e. Флаг лежит по пути "/flag.txt" :D

Target: http://62.173.140.174:16012/

Analysis

1. Main page reconnaissance:

   • Discovered Flask/Werkzeug server
   • Found an interesting endpoint on the page: /static?file=rikka.gif

2. Endpoint analysis:

   • The file parameter is used to load static files
   • The server likely reads files from /static/ directory + parameter value
   • No validation of path traversal sequences ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Vulnerability:

   • Local File Inclusion (LFI) via path traversal
   • Can escape the static directory using ../

Solution

LFI Exploitation

Using path traversal to read the /flag.txt file:

 bash read-only • copy allowed Copy
curl -s "http://62.173.140.174:16012/static?file=../../flag.txt"

Path traversal logic:

• Server constructs path: /static/ + ../../flag.txt
• ../ exits the static directory
• ../ exits to the application or system root
• Result: reading /flag.txt

Defense

To prevent LFI:

 python read-only • copy allowed Copy
import os
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def safe_static(filename):
    # Path normalization and check that it's inside the allowed directory
    base_dir = os.path.abspath('/app/static')
    requested_path = os.path.abspath(os.path.join(base_dir, filename))
    
    if not requested_path.startswith(base_dir):
        abort(403)
    
    return send_file(requested_path)

References

• OWASP Path Traversal
• Flask send_from_directory ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍