Quals NDH 2018 - Crawl me maybe

Solves: 47 / Points: 100 / Category: Web

Challenge description

A website test if a web page validity. You can provide this page by url only. Find a way to find and get the flag.

Challenge resolution

This challenge was pretty straightforward.

The web application only presented the following form:

When a site like www.google.com was provided, the application fetched the HTML page and printed its contents:

While manipulating the only parameter sent (url), the following stack trace was returned by the web server:

This error page disclosed the actual source code of the aplication as well as the software version:

A quick look for exploits revealed that the application was vulnerable to path traversal attacks:

After a little bit of digging, the application also turned out to be vulnerable to OS command injection:

From there, we found the flag was located in a subdirectory of the user challenge home folder:

However, as the strings flag and txt were prohibited, the following error message was returned:

We thus used the find command to search for files in the /home/challenge/src folder that we displayed using the “cat” command:

And… bingo!

Author: @_MrB0b

Post date: 2018-04-01