$cat local-login-inclusion.mdWebHacknite 2.0
Local Login Inclusion
A page that opens document files by name will open any file on the server if you give it a path, including the web server's log, where the flag was left.
$man local-login-inclusion
What this one teaches:
- How file paths work, and what ../ (go up one folder) means.
- Local file inclusion (LFI), where a page meant to open one folder's files is tricked into opening others.
- Why you must never build a file path out of raw user input.
$hint --one-at-a-time
Stuck? Open one hint, then go back and try again before reading the next.
Hint 1 of 2show
The documents page opens files by name. What happens if you ask it for a file that isn't a document?
Hint 2 of 2show
The task stresses it's an Apache server on Linux. Server software keeps logs, and their location is well documented.
Task description
Peter was bored over the summer and built a simple site. He wasn’t sure where to host it, so he ran it from his own Linux computer using the Apache web server. He made himself an admin account. The site isn’t finished and has some mistakes, but Peter is sure he left no security holes. Can you check?
The original was in Croatian; this is my translation.
Looking around
The task is unusually specific: it’s Apache (a common web server program) running on Linux. We checked the version with Burp Suite, a tool that sits between the browser and the site so you can inspect the raw requests. It was Apache 2.4.48, current at the time, so there was no known hole in the server itself. The weakness had to be in Peter’s own pages.
The site has a documents tab. Opening a document led to this:
view.php?file=dokument1.txtThe page takes a filename and shows that file’s contents. Here it returned a placeholder text file.
Asking for a different file
If view.php opens whatever filename you give it, the question is whether it will open files that aren’t documents. On a computer, files live in folders, and ../ means “go up one folder”. Starting from the site’s own folder, enough ../ steps reach the top of the disk, and from there you can point back down to any file. Reaching outside the intended folder like this is called path traversal, and using it to read files through a page is local file inclusion, or LFI.
The task kept pointing at Apache, so the useful file is its log. On Debian and Ubuntu Linux, Apache records every request to:
/var/log/apache2/access.logWe asked the page for that, with enough ../ in front to climb out of the site folder first:
view.php?file=../../../../var/log/apache2/access.logThat returned the server’s log, and the flag was sitting in it in plain text, left there as part of the task. The fix is to never build a file path from user input: keep a fixed list of allowed documents and look them up by a safe key, so ../ has nothing to act on.
$cat flag.txt reveal
CTF2021[712199829382]