Путь к флагу

Platform: bug-makers | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: authentication_bypass_via_path_traversal, git_repository_dumping, nginx_alias_traversal

Summary

Task: static nginx site with a flag file protected by Basic Auth; .git directory exposed. Solution: dump git repo to find nginx config with alias off-by-slash misconfiguration, traverse via /images../fourth/flag.txt to bypass auth.

Путь к флагу — Bug Makers CTF

Description

Добро пожаловать на сайт с выставкой лучших флагов. Для широкой публики доступны только три, а путь к четвертому закрыт от лишних глаз – это эксклюзив.

English summary: A static website hosts a "gallery of the best flags" with 4 items. Three flag images are publicly accessible, but the 4th flag at /secret/flag.txt is protected by HTTP Basic Authentication. The goal is to read the 4th flag without credentials.

Analysis

Reconnaissance

The main page is a static HTML gallery ("Галерея лучших флагов") served by nginx/1.18.0. It displays four items: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• /images/1.png, /images/2.png, /images/3.png — publicly accessible images
• /secret/flag.txt — the 4th flag, referenced in HTML but protected

Requesting /secret/flag.txt directly returns HTTP 401 Unauthorized with header WWW-Authenticate: Basic realm="Secret Vault".

Git Repository Exposure

Checking /.git/HEAD returns ref: refs/heads/main — the .git directory is exposed on the web server. Using git-dumper, the full repository was downloaded, revealing two files:

• index.html — the gallery page
• README.md — developer notes with critical configuration details ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Developer Notes (README.md)

The README.md contains project history notes in Russian:

– Картинки залили не туда и не открываются :(

– Чтобы картинки не переносить, прокинул алиас в конфиге nginx:

location /images {
    alias /var/www/uploads/;
}

– Попросили добавить 4й флаг в галерею, но пока не показывать никому, закинул его в /var/www/fourth/flag.txt

– Новые вводные пришли, добавить админу просмотр флага по публичной ссылке, но закрыть авторизацией. Добавил alias к файлу, чтобы открывался в браузере по ссылке /secret/flag.txt и закрыл путь basic auth ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key facts extracted:

1. Images were placed in the wrong directory, so an nginx alias was added to serve them
2. The 4th flag is stored at /var/www/fourth/flag.txt
3. A separate nginx location with Basic Auth was added at /secret/flag.txt for admin access

Vulnerability: Nginx Alias Traversal (Off-by-Slash)

The nginx configuration has a classic misconfiguration known as "off-by-slash" or "alias traversal":

 nginx read-only • copy allowed Copy
location /images {
    alias /var/www/uploads/;
}

The critical mismatch:

• location /images — no trailing slash
• alias /var/www/uploads/ — has trailing slash ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

When nginx processes a request like /images../fourth/flag.txt:

1. It matches the /images location prefix
2. Strips /images from the URI, leaving ../fourth/flag.txt
3. Appends the remainder to the alias path: /var/www/uploads/ + ../fourth/flag.txt
4. Resolves to /var/www/fourth/flag.txt

This bypasses the Basic Auth entirely because the authentication only protects the /secret/ location block — we access the same underlying file via a completely different nginx location.

Solution

Step 1: Discover exposed .git repository

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s "http://31.207.77.216:4024/.git/HEAD"
# ref: refs/heads/main

Step 2: Dump the git repository

 bash read-only • copy allowed Copy
git-dumper http://31.207.77.216:4024/.git/ repo/

Step 3: Read developer notes revealing nginx config

 bash read-only • copy allowed Copy
cat repo/README.md
# Reveals: location /images { alias /var/www/uploads/; }
# Reveals: flag is at /var/www/fourth/flag.txt

Step 4: Exploit nginx alias traversal

 bash read-only • copy allowed Copy
curl -s "http://31.207.77.216:4024/images../fourth/flag.txt"
# BugCTF{REDACTED}

The request traverses from /var/www/uploads/ up one directory to /var/www/, then into fourth/flag.txt, completely bypassing the Basic Auth on /secret/flag.txt. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍