BC

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: command_injection_filter_bypass, heredoc_escape, shell_wildcard_expansion

Summary

"Can you pwn a calculator?" — a calculator service using the bc command.

BC — Web Kids 2.0

Description

"Can you pwn a calculator?" — a calculator service using the bc command.

URL: https://hy17-bc.spb.ctf.su/

Analysis

The web calculator uses the bc utility for computations. User input is passed to the command line, but there's a filter blocking letters g-w and y-z. However, other characters are allowed, including shell special characters.

Key observation: shell wildcards (?, *) are not filtered and can be used to bypass restrictions.

Solution

1. Identified that the filter blocks letters g-w and y-z

2. Used shell wildcards to form commands:

   • /b??/ca? expands to /bin/cat
   • ./*a* matches the flag file ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. Applied heredoc escape technique to break out of the bc command context

Payload:

 bash read-only • copy allowed Copy
/b??/ca? ./*a*

This expands by the shell to:

 bash read-only • copy allowed Copy
/bin/cat ./flag

Alternative approach with heredoc:

1+1
EOF
/b??/ca? *

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍