This is part of a old CTF question which I've had trouble solving. I'm not sure what approach to take.
I'm given a single site:
http://user:token@host:port/public/index.php
the flag is in /tmp/flag.txt
Index.php is basically a plain text file with the basic instructions for every question. The first question is to breakout of the webapp environment and get the flag in the tmp folder.
There doesn't see to be any parameter injection I can use as far as I can see. Entering
http://user:token@host:port/../../tmp/flag.txt
just gets truncated to
http://user:token@host:port/tmp/flag.txt
and gives a 404. The only other page is if you enter something non existent under public
http://user:token@host:port/public/foobar.php or http://user:token@host:port/public/foobar
which gives a better formatted 404
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>System Error</title>
<meta name="robots" content="noindex,nofollow" />
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
<style>
/* Base */
body {
color: #333;
font: 14px Verdana, "Helvetica Neue", helvetica, Arial, 'Microsoft YaHei', sans-serif;
margin: 0;
padding: 0 20px 20px;
word-break: break-word;
}
h1{
margin: 10px 0 0;
font-size: 28px;
font-weight: 500;
line-height: 32px;
}
h2{
color: #4288ce;
font-weight: 400;
padding: 6px 0;
margin: 6px 0 0;
font-size: 18px;
border-bottom: 1px solid #eee;
}
h3.subheading {
color: #4288ce;
margin: 6px 0 0;
font-weight: 400;
}
h3{
margin: 12px;
font-size: 16px;
font-weight: bold;
}
abbr{
cursor: help;
text-decoration: underline;
text-decoration-style: dotted;
}
a{
color: #868686;
cursor: pointer;
}
a:hover{
text-decoration: underline;
}
.line-error{
background: #f8cbcb;
}
.echo table {
width: 100%;
}
.echo pre {
padding: 16px;
overflow: auto;
font-size: 85%;
line-height: 1.45;
background-color: #f7f7f7;
border: 0;
border-radius: 3px;
font-family: Consolas, "Liberation Mono", Menlo, Courier, monospace;
}
.echo pre > pre {
padding: 0;
margin: 0;
}
/* Layout */
.col-md-3 {
width: 25%;
}
.col-md-9 {
width: 75%;
}
[class^="col-md-"] {
float: left;
}
.clearfix {
clear:both;
}
@media only screen
and (min-device-width : 375px)
and (max-device-width : 667px) {
.col-md-3,
.col-md-9 {
width: 100%;
}
}
/* Exception Info */
.exception {
margin-top: 20px;
}
.exception .message{
padding: 12px;
border: 1px solid #ddd;
border-bottom: 0 none;
line-height: 18px;
font-size:16px;
border-top-left-radius: 4px;
border-top-right-radius: 4px;
font-family: Consolas,"Liberation Mono",Courier,Verdana,"微软雅黑";
}
.exception .code{
float: left;
text-align: center;
color: #fff;
margin-right: 12px;
padding: 16px;
border-radius: 4px;
background: #999;
}
.exception .source-code{
padding: 6px;
border: 1px solid #ddd;
background: #f9f9f9;
overflow-x: auto;
}
.exception .source-code pre{
margin: 0;
}
.exception .source-code pre ol{
margin: 0;
color: #4288ce;
display: inline-block;
min-width: 100%;
box-sizing: border-box;
font-size:14px;
font-family: "Century Gothic",Consolas,"Liberation Mono",Courier,Verdana;
padding-left: 40px;
}
.exception .source-code pre li{
border-left: 1px solid #ddd;
height: 18px;
line-height: 18px;
}
.exception .source-code pre code{
color: #333;
height: 100%;
display: inline-block;
border-left: 1px solid #fff;
font-size:14px;
font-family: Consolas,"Liberation Mono",Courier,Verdana,"微软雅黑";
}
.exception .trace{
padding: 6px;
border: 1px solid #ddd;
border-top: 0 none;
line-height: 16px;
font-size:14px;
font-family: Consolas,"Liberation Mono",Courier,Verdana,"微软雅黑";
}
.exception .trace ol{
margin: 12px;
}
.exception .trace ol li{
padding: 2px 4px;
}
.exception div:last-child{
border-bottom-left-radius: 4px;
border-bottom-right-radius: 4px;
}
/* Exception Variables */
.exception-var table{
width: 100%;
margin: 12px 0;
box-sizing: border-box;
table-layout:fixed;
word-wrap:break-word;
}
.exception-var table caption{
text-align: left;
font-size: 16px;
font-weight: bold;
padding: 6px 0;
}
.exception-var table caption small{
font-weight: 300;
display: inline-block;
margin-left: 10px;
color: #ccc;
}
.exception-var table tbody{
font-size: 13px;
font-family: Consolas,"Liberation Mono",Courier,"微软雅黑";
}
.exception-var table td{
padding: 0 6px;
vertical-align: top;
word-break: break-all;
}
.exception-var table td:first-child{
width: 28%;
font-weight: bold;
white-space: nowrap;
}
.exception-var table td pre{
margin: 0;
}
/* Copyright Info */
.copyright{
margin-top: 24px;
padding: 12px 0;
border-top: 1px solid #eee;
}
/* SPAN elements with the classes below are added by prettyprint. */
pre.prettyprint .pln { color: #000 } /* plain text */
pre.prettyprint .str { color: #080 } /* string content */
pre.prettyprint .kwd { color: #008 } /* a keyword */
pre.prettyprint .com { color: #800 } /* a comment */
pre.prettyprint .typ { color: #606 } /* a type name */
pre.prettyprint .lit { color: #066 } /* a literal value */
/* punctuation, lisp open bracket, lisp close bracket */
pre.prettyprint .pun, pre.prettyprint .opn, pre.prettyprint .clo { color: #660 }
pre.prettyprint .tag { color: #008 } /* a markup tag name */
pre.prettyprint .atn { color: #606 } /* a markup attribute name */
pre.prettyprint .atv { color: #080 } /* a markup attribute value */
pre.prettyprint .dec, pre.prettyprint .var { color: #606 } /* a declaration; a variable name */
pre.prettyprint .fun { color: red } /* a function name */
</style>
</head>
<body>
<div class="echo">
</div>
<div class="exception">
<div class="info"><h1>页面错误！请稍后再试～</h1></div>
</div>
<div class="copyright">
<a title="官方网站" href="http://www.thinkphp.cn">ThinkPHP</a>
<span>V5.0.21</span>
<span>{ 十年磨一剑-为API开发设计的高性能框架 }</span>
</div>
</body>
</html>
I feel like this question should be about path traversal vulnerabilities but I'm quite a beginner and not sure where to start. How should I approach this?
http://site.example//tmp/flag.txt. (Notice the additional/)example.com/test/../, I can see in the Firefox dev tools (F12 -> network tab) that it immediately tries to openexample.com/without ever requestingexample.com/test/../from the web server. You can work around this using curl:curl https://example.com/test/../will actually do the request you ask of it.