Docker2

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-10 | Status: Solved Techniques: docker_env_leakage, lfi_proc_environ

Summary

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191110_web_kids20_websrv1_docker2
• Tags: docker, lfi, proc_filesystem, environment_variables
• Indicators: LFI vulnerability present, Docker container environment, /proc/self/environ readable, secrets in environment variables
• Source: 20191110_web_kids20_websrv1_docker2.md

Foothold

Vulnerability / Misconfiguration

1. docker_env_leakage
2. lfi_proc_environ

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• docker_env_leakage
• lfi_proc_environ
• Tags: docker, lfi, proc_filesystem, environment_variables

Original Writeup

<details><summary>Click to expand original content</summary>

Description

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Analysis

An LFI vulnerability was found in the web application, allowing arbitrary file reads on the server. In Docker containers, secrets and configuration are often passed through environment variables. The file /proc/self/environ contains all environment variables of the current process.

Solution

1. Discovered an LFI vulnerability in a parameter (e.g., ?file= or ?page=)
2. Used LFI to read /proc/self/environ: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ

or with null-byte (for older PHP versions):

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ%00

1. The response contained the process environment variables, including the flag.

Alternative paths for reading env:

• /proc/self/environ - environment variables of the current process
• /proc/1/environ - environment variables of PID 1 (init process in Docker) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR