File Downloader Command Injection – Write-up
Challenge Overview
This challenge has a file downloader in it, so my first guess was a Command Injection Vulnerability.
Apparently, when the URL contains two path segments (e.g., /123/123), the application returns an output.
The file referenced by the URL is downloaded using the wget command and then removed if it has a .php, .pht, .phtml, or similar extension (via
bash -c 'rm uploads/.../*.{php,pht,phtml,php4,php5,php6,php7}').
Analyzing page source (CTRL + U), we see this line:
When accessing:
we see the message GET ME.
My first instinct was to send the following link:
Sneaky you! is displayed, but maybe because that .php extension that could easily be bypassed ->
p'hp; p'h'p; ph'p'
After many attempts nothing worked and I decided to look in the manpage of wget.
There I saw the -i option, which simply allows wget to read URLS from A FILE.
I tried it on my host, and that's how it works.
Apparently, it enumerates each line, which is great in our situation.
There I got the flag and decode it using Cyberchef URL Decode.
made by k0d
