BC - 20260309_web_kids20_bc

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: command_injection_filter_bypass, heredoc_escape, shell_wildcard_expansion

Summary

"Can you pwn a calculator?" — a calculator service using the bc command.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_bc
• Tags: command_injection, filter_bypass, bc_calculator, shell_wildcards
• Indicators: calculator using bc command, character filter blocking letters, shell command execution context
• Source: 20260309_web_kids20_bc.md

Foothold

Vulnerability / Misconfiguration

1. Command_injection_filter_bypass
2. Heredoc_escape
3. Shell_wildcard_expansion

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• command_injection_filter_bypass
• heredoc_escape
• shell_wildcard_expansion
• Tags: command_injection, filter_bypass, bc_calculator, shell_wildcards

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"Can you pwn a calculator?" — a calculator service using the bc command.

URL: https://hy17-bc.spb.ctf.su/

Analysis

The web calculator uses the bc utility for computations. User input is passed to the command line, but there's a filter blocking letters g-w and y-z. However, other characters are allowed, including shell special characters.

Key observation: shell wildcards (?, *) are not filtered and can be used to bypass restrictions.

Solution

1. Identified that the filter blocks letters g-w and y-z
2. Used shell wildcards to form commands:

• /b??/ca? expands to /bin/cat
• ./*a* matches the flag file ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Applied heredoc escape technique to break out of the bc command context

Payload:

/b??/ca? ./*a*

This expands by the shell to:

/bin/cat ./flag

Alternative approach with heredoc:

1+1
EOF
/b??/ca? *

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR