Trying to visit the page https://caas.mars.picoctf.net/cowsay/hellooooo where {message}=hellooooo in this case, I get:
First Try
As we can see, it is cowsay, a free software that generates an ASCII art image of a cow with a speech bubble containing a message that we can enter at our leisure. If you want to try installing it, you can simply run:
1
sudo apt install cowsay
However, since it is executed via a CLI (Command Line Interface) command, we can chain other commands to it, for example, by using ;second command, where the ; is a special bash character used to separate multiple commands. Or we can use &, which is a special character in bash that allows us to concatenate the execution of multiple commands. Let’s do a local test after installing cowsay:
Local Cowsay
Now, trying to add, for example, & second command, as we can see, the second command we specify is also executed:
Local Cowsay Injection
This results in the output of the cowsay command along with the output of whoami (a command that displays the username of the current user). Now that we understand how to potentially exploit the cowsay command for an OS Command Injection, let’s move on to the exploitation phase.
🔬 Vulnerability Analysis
Potential Vulnerabilities
OS Command Injection
🎯 Solution Path
Exploitation Steps
Initial setup
As a first step, I assume there is a flag.txt file to read in order to find the flag. So, the first thing I try is to send the message &ls to concatenate cowsay with ls. The final command that will be executed on the server will look like this: cowsay & ls.
Exploitation
I then visit the URL: https://caas.mars.picoctf.net/cowsay/&ls
Remote Cowsay Injection
As we can see, it works! Now that we have achieved the injection, as shown in the image, I noticed a suspicious file called falg.txt. So, trying to view the file’s content by concatenating cowsay & cat falg.txt, the content of the file falg.txt is printed, and inside it, there is the flag.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The exploit simply makes a GET request to https://caas.mars.picoctf.net/cowsay/&cat%20falg.txt, as seen in the manual approach, and extracts the flag from the response using a regex.
