Docker2

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: docker_env_leakage, lfi_proc_environ

Summary

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Docker2 — Web Kids 2.0

Description

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Analysis

An LFI vulnerability was found in the web application, allowing arbitrary file reads on the server. In Docker containers, secrets and configuration are often passed through environment variables. The file /proc/self/environ contains all environment variables of the current process.

Solution

1. Discovered an LFI vulnerability in a parameter (e.g., ?file= or ?page=)
2. Used LFI to read /proc/self/environ: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ

or with null-byte (for older PHP versions):

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ%00

1. The response contained the process environment variables, including the flag.

Alternative paths for reading env:

• /proc/self/environ - environment variables of the current process
• /proc/1/environ - environment variables of PID 1 (init process in Docker) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍