← Back to Writeups
HTBN/AWeb
Bookmark

Commentary

XESXOR8/23/20263 min read
#web#htb#n/a

Commentary

Platform: Scarlet | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-09 | Status: Solved Techniques: default_page_disclosure, host_header_manipulation, virtual_host_enumeration

Summary

Task: find a hidden flag on an nginx web server. Solution: send an HTTP request to port 80 with the task name "commentary" as the Host header, triggering the nginx default page which contains the flag in HTML comments.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn
PortServiceVersionNotes
<PORT><SVC><VER><notes>

Enumeration highlights

  • Event: scarlet | ID: 20260109_scarlet_commentary
  • Tags: nginx, http, vhost, host-header, html-comments
  • Indicators: nginx server, Host header hint in description, task name as vhost, HTML comments
  • Source: 20260109_scarlet_commentary.md

Foothold

Vulnerability / Misconfiguration

  1. Default_page_disclosure
  2. Host_header_manipulation
  3. Virtual_host_enumeration
<command>

Exploitation

  • See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

  1. N/A for challenge-type writeup; see exploitation above.
  2. Flag obtained via challenge solve.
<command>

Flags

FlagLocationValue
flagREDACTED

Key Takeaways / Lessons

  • default_page_disclosure
  • host_header_manipulation
  • virtual_host_enumeration
  • Tags: nginx, http, vhost, host-header, html-comments

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"You're currently speaking to my favorite host right now (ctf.rusec.club), but who's to say you even had to speak with one?" "Sometimes, the treasure to be found is just bloat that people forgot to remove."

Analysis

The challenge description contains several key hints:

  1. "favorite host" - Points to Host header manipulation
  2. "who's to say you even had to speak with one" - Suggests using a simple word instead of a full domain
  3. "Commentary" (task name) - This IS the Host header value to use!
  4. "bloat that people forgot to remove" - HTML comments in the response ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The challenge exploits nginx virtual host behavior:

  • When nginx receives a request with an unknown Host header, it returns the default server's page
  • The default nginx page was modified to contain the flag in HTML comments
  • The key insight was that HTTP (port 80) behaves differently than HTTPS - it doesn't redirect when Host header doesn't match

Solution

Failed Attempts

  1. Checked HTTPS with various Host headers (ctf.rusec.club, localhost, admin.ctf.rusec.club, etc.)
  2. Checked SSL certificate for alternative names (found wildcard *.ctf.rusec.club)
  3. Tried HTTP/1.0 requests without Host header
  4. Checked robots.txt, source maps, JS files
  5. Tried various HTTP methods (OPTIONS, TRACE, COMMENT) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Successful Approach

The crucial realization was:

  1. The task name "Commentary" was literally the Host header value
  2. HTTP (port 80) behaves differently than HTTPS
  3. Nginx returns its default page for unknown virtual hosts

Exploit

curl -s -H "Host: commentary" http://ctf.rusec.club/

Response

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
...
<!-- you found me :3 --!>
<!-- RUSEC{REDACTED} --!>
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

Technical Details

PropertyValue
Targetctf.rusec.club (5.161.91.13)
Servernginx/1.24.0 (Ubuntu)
ProtocolHTTP (port 80)
VulnerabilityVirtual host misconfiguration

Lessons Learned

  1. Task name matters - The challenge name itself can be a crucial hint
  2. Try HTTP, not just HTTPS - Different protocols may have different configurations
  3. nginx default behavior - Unknown Host headers return the default server page
  4. HTML comments - Always check page source for hidden content
  5. Read hints carefully - "Commentary" + "comments" = HTML comments in response ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍
</details>

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR