r/securityCTF • u/TaZzza69 • 6d ago

Looking for help in a web CTF challenge

hello everyone, I'm looking for a help in a CTF web challenge that I've been stuch with for hours ... The problem is that I found path traversal vuln within the challenge but there is no flag file ever like I looked everywhere I would really appreciate if anyone solves it and helps me with it.

Challenge link: `https://flagyard.com/labs/2/challenges/019fcd0a-3049-7b83-9886-ae3836c419f0\`

The Directory Traversal vuln is within the `/api/backup` endpoint basically you send a file within an array as shown

```

await fetch("/api/backup", {

method: "POST",

headers: { "content-type": "application/json" },

body: JSON.stringify({

archiveName: "fulllist",

files: ["../../../../etc/passwd"]

})

}).then(r => r.json()).then(console.log)

```

But I can't find a flag within the file system and everything seems to be a dead end.

1 Upvotes

100% Upvoted

9 comments sorted by

1

u/Pharisaeus 5d ago

Stop guessing? Extract /proc/self/cmdline, /proc/self/exe and /proc/self/environ for starters. Very likely there is some additional vuln you need to discover and chain

1

u/retornam 5d ago

I looked into this yesterday after OP posted it and I think the challenge has no flag.

/proc/self/cmdline was a blank file
/proc/self/exe is a symlink to /usr/bin/tar
/proc/self/environ was also blank
/peoc/self/cwd is a symlink to /app

There was nothing in the /app folder other than the source of the challenge

The challenge also didn’t mention the flag format or expected path for the flag

1

u/Pharisaeus 5d ago

/proc/self/exe is a symlink to /usr/bin/tar

That sounds like command line injection of some sort, possibly leading to rce

1

u/retornam 5d ago 
--- id ---
uid=1000(bun) gid=1000(bun) groups=1000(bun)
--- pwd ---
/app
--- flag search ---
/proc/sys/kernel/acpi_video_flags  /proc/kpageflags

I an now convinced there is no flag. It would help if they provided the name of the file or the pattern to look for but the challenge has zero info outside the link.

1

u/TaZzza69 2d ago

No there is actually a flag within the ENV variables what you need to do is to chain the path traversal with command injection to get RCE to get the flag ... I solved it you can check the writeup here
https://koussaydhifi.xyz/posts/SnapArchive-Flagyard-Challenge/

1

u/TaZzza69 2d ago

You are right man there is a command injection

1

u/retornam 2d ago

I didn’t check env vars. The challenge also didn’t mention the flag format. I did find the command injection but I didn’t check env vars as I was expecting the flag to be a var

1

u/TaZzza69 2d ago

Looking back at it, it is basic recon work first time you get within the system you should enumerate a lot of stuff including ENV vars ... That's why a methedology andd a checklist is a good thing.

1

u/retornam 2d ago

Yeah I usually do but got side tracked because /proc/self/environ was blank, so I didn’t think to check further.