In the heart of Valeria’s bustling capital, the Moonbeam Tavern stands as a lively hub of whispers, wagers, and illicit dealings. Beneath the laughter of drunken patrons and the clinking of tankards, it is said that the tavern harbors more than just ale and merrimentโit is a covert meeting ground for spies, thieves, and those loyal to Malakar’s cause. The Fellowship has learned that within the hidden backrooms of the Moonbeam Tavern, a crucial piece of information is being tradedโthe location of the Shadow Veil Cartographer, an informant who possesses a long-lost map detailing Malakarโs stronghold defenses. If the fellowship is to stand any chance of breaching the Obsidian Citadel, they must obtain this map before it falls into enemy hands.
๐ฏ Challenge Files & Infrastructure
Provided Files
1
Files:None
๐ Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
By clicking on “Enter Tavern,” I was redirected to the following page:
Terminal
where it was possible to execute commands. If we pay attention, there is a message at the bottom of the page: Tip: Use โโ for history, Tab for completion, ; for command injection. From this, we can already infer what it’s about…
๐ฌ Vulnerability Analysis
Potential Vulnerabilities
OS Command Injection
๐ฏ Solution Path
Exploitation Steps
Initial setup
First, I used the help command to list all the available commands:
Help
Then I tried the gossip command:
Gossip
and apparently, it lists directories, very similar to ls… In fact, when I sent gossip a:
Gossip a
I got, as we can see, the error message Command failed: ls a, ls: a: No such file or directory. So, it is indeed executing ls. Let’s move on to the next phase.
Exploitation
Now, as suggested, I simply added ; at the end of the command, which in bash is used as a command separator. This means that if we want to execute multiple commands inline, we just need to write command1;command2. That said, I sent gossip;cat flag.txt, and by doing so, I read the contents of the flag.txt file, thus obtaining the flag.
Flag capture
Manual Flag
๐ ๏ธ Exploitation Process
Approach
The automatic exploit sends a POST request to the /api/command endpoint (I found this by looking at the request made when sending a command), sending the payload command;cat flag.txt. Once the response is received, it extracts the flag using a regex.
