$cat linux-rot13.mdWebHacknite 2.0
Linux ROT13
The ROT13 tool builds its answer by running a Linux command with your text in it, so the right input makes the server run a command of your choosing.
$man linux-rot13
What this one teaches:
- What it means for a site to run a system command, and how one page here does it.
- Command injection, where input is read as part of the command instead of as data.
- Searching a whole Linux filesystem for a known piece of text.
$hint --one-at-a-time
Stuck? Open one hint, then go back and try again before reading the next.
Hint 1 of 2show
The site tells you it's built on Linux commands. Where does your input end up?
Hint 2 of 2show
If you can add your own command to theirs, you can search the server for the flag.
Task description
Ivica loves Linux and tries to use Linux commands wherever he can. He needed a ROT13 calculator for CTFs, so he built a web page that does ROT13 using Linux commands.
The original was in Croatian; this is my translation.
The source is on the site
The page is a ROT13 calculator (ROT13 shifts each letter 13 places). There’s a link titled “How was this ROT13 site made”, which shows the PHP code behind it. PHP is the language the server runs to build the page.
The code takes your input and runs a Linux command with it to do the ROT13, passing your text straight into that command. That’s the whole problem.
Command injection
When a site runs a system command and drops your input into it, you can often add a command of your own. On Linux, && between two commands means “run the first, then run the second”, and # starts a comment that hides whatever comes after. So if we end their command early and tack on our own, the server runs ours too. This is command injection, and it lets you run commands on the server itself (often called remote code execution, or RCE).
Since we didn’t know where the flag file was, we searched the whole machine for it. grep searches text; -r means search inside every folder from a starting point, and -n adds line numbers. Searching from /, the top of the Linux filesystem, covers everything:
' && grep -rn 'CTF2021' / ; #The leading quote and the trailing # close off their command cleanly, and our grep runs in the middle. It found the file holding the flag and printed it.
The fix is the same idea as the other injection tasks: never put user input into a command. A ROT13 calculator doesn’t need a shell at all; it’s a few lines of plain code.
$cat flag.txt reveal
CTF2021[254523043216]