Echo v2

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-10-13 | Status: Solved Techniques: command_substitution_bypass, dollar_parenthesis_injection

Summary

An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191013_web_kids20_ping5
• Tags: command_injection, shell, echo, waf_bypass, sh
• Indicators: echo command with user input, backticks blocked but $() allowed, WAF blocking ; | && but not $(), shell command injection context
• Source: 20191013_web_kids20_ping5.md

Foothold

Vulnerability / Misconfiguration

1. Command_substitution_bypass
2. Dollar_parenthesis_injection

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• command_substitution_bypass
• dollar_parenthesis_injection
• Tags: command_injection, shell, echo, waf_bypass, sh

Original Writeup

<details><summary>Click to expand original content</summary>

Description

An "improved" echo server. The description says "the previous version was vulnerable... now EVERYTHING IS DEFINITELY SECURE!". Flag is in /flag.

URL: https://2019-10-13-cmdinj.ctf.su/task/echo2

Analysis

The service executes echo <user_input> command with user input.

WAF rules:

• ; - blocked
• | - blocked
• && - blocked
• ` (backtick) - blocked
• $() - ALLOWED
• # - blocked

Key vulnerability: developers blocked backticks to prevent command substitution, but forgot about the alternative $() syntax which does the same thing in shell. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

In shell there are two ways to perform command substitution:

1. `command` - backticks (blocked)
2. $(command) - dollar-parenthesis (allowed!)

Both syntaxes are equivalent - they execute the command inside and substitute its output.

Payload:

what=$(cat /flag)

Sending via POST:

curl -X POST https://2019-10-13-cmdinj.ctf.su/task/echo2 -d 'what=$(cat /flag)'

What happens on the server:

echo $(cat /flag)

Shell first executes cat /flag, gets the file contents, then substitutes it as an argument to echo, which outputs the flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR