Micro Storage v1.0 — HackTheBox Labs

Description

A group of people made a network service that lets you store files temporarily. But they made a mistake coding their script. The goal is to leak the contents of /flag.txt.

Target: 83.136.249.164:31556 (TCP network service)

Reconnaissance

The service ("Micro Storage v1.0") is a TCP-based file storage application with the following menu:

Option	Function
1	Upload a new file (max 10 files, filename ≤ 32 chars, content terminated by EOF)
2	List uploaded files (shows identifiers 0–9)
3	Delete a file by identifier
4	Print file content by identifier
5	Compress and download all files — creates a tar archive, base64-encodes, outputs
0	Quit

Security Filters

The service blocks certain characters in filenames:

• Blocked: /, ../, $, &, (, {, `, <, |, ;
• Error message: "No no no, you're trying to hack us"
• Max filename length: 32 characters

What's NOT blocked

Filenames starting with -- (double dash) pass all filters. This is the critical oversight.

Analysis

Vulnerability: Tar Wildcard Injection

Option 5 ("Compress and download") internally runs tar with a shell wildcard (*) to archive all uploaded files in the user's storage directory:

tar cf archive.tar *

When the shell expands *, filenames that look like command-line arguments (starting with --) are interpreted by tar as options, not as filenames. This is a well-known technique documented on GTFOBins.

Key tar options for exploitation

Option	Effect
--checkpoint=N	Triggers a checkpoint action every N records
--checkpoint-action=exec=CMD	Executes CMD at each checkpoint

...