webProhard

RootBabyKalmarCTF

kalmarctf

Task: CTFd 3.8.1 instance with admin credentials, flag at /flag2-<random>.txt. Solution: Exploit ZIP import path traversal via uploads// bypass to write .pth file for RCE.

path_traversal arbitrary_file_write python ctfd zip_upload pth_injection

zip_path_traversal_bypasspth_code_executionjinja2_template_overwrite

$ ls tags/ techniques/

path_traversal arbitrary_file_write python ctfd zip_upload pth_injection

zip_path_traversal_bypasspth_code_executionjinja2_template_overwrite

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups