Docker1

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-10 | Status: Solved Techniques: dockerfile_disclosure, lfi_path_traversal

Summary

LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191110_web_kids20_websrv1_docker1
• Tags: docker, lfi, dockerfile, path_traversal, static_files
• Indicators: static file serving with file parameter, Docker container environment, path traversal in file parameter, Dockerfile in application root
• Source: 20191110_web_kids20_websrv1_docker1.md

Foothold

Vulnerability / Misconfiguration

1. dockerfile_disclosure
2. lfi_path_traversal

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• dockerfile_disclosure
• lfi_path_traversal
• Tags: docker, lfi, dockerfile, path_traversal, static_files

Original Writeup

<details><summary>Click to expand original content</summary>

Description

LFI challenge in a Docker container. The web application serves static files through a parameter vulnerable to path traversal.

Analysis

The application has a /static/ endpoint with a file parameter used to serve static files. The parameter does not filter ../ sequences, allowing to escape the static files directory and read arbitrary files.

In Docker containers, the Dockerfile often contains:

• Environment variables with secrets (ENV)
• Comments with flags or passwords
• ARG directives with sensitive data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The Dockerfile is usually located in the application root or one level above the static directory.

Solution

1. Discovered the static files endpoint:

https://2019-11-10-docker1.ctf.su/static/?file=style.css

1. Verified path traversal vulnerability:

https://2019-11-10-docker1.ctf.su/static/?file=../

1. Read the Dockerfile via path traversal:

https://2019-11-10-docker1.ctf.su/static/?file=../Dockerfile

1. Found the flag in the Dockerfile (in an ENV variable or comment).

Typical flag locations in Dockerfile:

 dockerfile read-only • copy allowed Copy
# Flag can be in a comment
# FLAG: spbctf{...}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Or in an environment variable
ENV FLAG=spbctf{...}

# Or in ARG
ARG SECRET=spbctf{...}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR