# downloader-v1

## File Downloader Command Injection – Write-up

| Info       | Details              |
| ---------- | -------------------- |
| Category   | **Web Exploitation** |
| Difficulty | **Easy**             |

## Challenge Overview

This challenge has a **file downloader** in it, so my first guess was a **Command Injection Vulnerability**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fj7Sn5VWoAvoAaybC9eFq%2Fwu.png?alt=media&#x26;token=f6f98b6c-6828-4ea8-b1e5-f5be76481d49" alt=""><figcaption><p>overview</p></figcaption></figure>

Apparently, when the URL contains **two path segments** (e.g., `/123/123`), the application returns an output.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FSmfWroB3RFlZqf1Nt2tg%2F2.png?alt=media&#x26;token=8793ad7d-b2f8-4b08-86e0-c4dffd3b991b" alt=""><figcaption><p>wget, rm .php</p></figcaption></figure>

The file referenced by the URL is downloaded using the **wget** command and then removed if it has a **.php, .pht, .phtml, or similar extension** (via\
`bash -c 'rm uploads/.../*.{php,pht,phtml,php4,php5,php6,php7}`').

Analyzing **page source (CTRL + U)**, we see this line:

```html
<!-- <a href="flag.php">###</a> -->
```

When accessing:

```
http://34.40.99.144:30320/flag.php
```

we see the message **`GET ME`**.

## Exploitation

My first instinct was to send the following link:

```
https://127.0.0.1/flag.php
```

**`Sneaky you!`** is displayed, but maybe because that **.php extension** that could easily be bypassed ->\
\&#xNAN;**`p'hp; p'h'p; ph'p'`**

After many attempts nothing worked and I decided to look in the **manpage of wget**.

There I saw the **`-i` option**, which simply allows **wget to read URLS from A FILE**.\
I tried it on my host, and that's how it works.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FdW3v9F2wu56HbMokQrJU%2Fexample.png?alt=media&#x26;token=cbd12e98-01b7-4844-bf1f-77abc582b1db" alt="" width="375"><figcaption></figcaption></figure>

Apparently, it enumerates **each line**, which is great in our situation.

## Final Payload

```
https://example.com/123 -i flag.'p'hp
```

There I got the **flag** and decode it using **Cyberchef URL Decode**.

*made by k0d*
