Search for a command to run...
Writeup for Google CTF's Mindreader Challenge from 2017.
I'm an App Developer, Security Researcher and Designer living in Phoenix, Arizona. In the past I've worked with Apple, Zoom, Axon, Starbucks and many more great companies. My security and app dev work has been featured in the press – Bloomberg, Techcrunch, and many more.
No comments yet. Be the first to comment.
This is my second bug bounty - a bug that I discovered while messing around on a Facebook group. It was my freshman year at ASU, and I was administering this Facebook called "The Great Indian Dream, Class of '23" – a group dedicated to Indian high sc...
It was the end of my Grade 12th Preboard exams and I needed something to destress, and what better way to destress by bug hunting (atleast after doing something as awful highschool exams). Typically, I just browse through the apps on my phone and sta...
The challenge is mainly based on the Path Transversal attack which is a common vulnerability in websites. The Path Transversal attack is a method of using special characters to access directories and files on a server. This method works only when the query string variables are used to access files on the server (which was the case here).
Let’s start with the challenge now. This was the screen I was presented with.
Entering something random got us this.
This takes us to a 404 page, but now we have a parameter f in the field which probably takes in a file. Let's try /etc/passwd
http://mindreader.web.ctfcompetition.com/f=/etc/passwd
Wow, that was a little too easy, but we're quite a bit away from it. The flag was not in flag.txt, ../flag or flag.
But hold on... if I can read any file, it means I can read the source code too 😏 I tried a few guesses: “main.py”, “app.py”, “server.py” and voila, main.py was actually a file.
A flask webserver that reads the flag from OS environment. Also a regex that filters out the words proc, random, stdout and stderr so you can't read those. /proc/self/environ is typically the file that shows the environment variables but due to the regex we can't access that.
The challenge has now boiled down to finding a way to access that file by bypassing the regex. Let's see if there are any Symbolic Links that map to that. Tried to check this locally on my Mac and eventually, I did notice that /dev/fd links to /proc/self/fd. This means I could try /dev/fd/../environ to access /proc/self/environ.
And boom! Here's our flag.
http://mindreader.web.ctfcompetition.com/?f=/dev/fd/../environ
FLAG=CTF{ee02d9243ed6dfcf83b8d520af8502e1}