Docker2

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-10 | Status: Solved Techniques: docker_env_leakage, lfi_proc_environ

Summary

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191110_web_kids20_websrv1_docker2
• Tags: docker, lfi, proc_filesystem, environment_variables
• Indicators: LFI vulnerability present, Docker container environment, /proc/self/environ readable, secrets in environment variables
• Source: 20191110_web_kids20_websrv1_docker2.md

Foothold

Vulnerability / Misconfiguration

1. Docker_env_leakage
2. Lfi_proc_environ

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• docker_env_leakage
• lfi_proc_environ
• Tags: docker, lfi, proc_filesystem, environment_variables

Original Writeup

<details><summary>Click to expand original content</summary>

Description

LFI challenge in a Docker container. The goal is to exploit a Local File Inclusion vulnerability to obtain the flag.

Analysis

An LFI vulnerability was found in the web application, allowing arbitrary file reads on the server. In Docker containers, secrets and configuration are often passed through environment variables. The file /proc/self/environ contains all environment variables of the current process.

Solution

1. Discovered an LFI vulnerability in a parameter (e.g., ?file= or ?page=)
2. Used LFI to read /proc/self/environ: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ

or with null-byte (for older PHP versions):

https://2019-11-10-docker2.ctf.su/?file=../../../proc/self/environ%00

1. The response contained the process environment variables, including the flag.

Alternative paths for reading env:

• /proc/self/environ - environment variables of the current process
• /proc/1/environ - environment variables of PID 1 (init process in Docker) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR