Path Traversal 101

Can you pass the path traversal exam? 👀 There might be some requirements tho for your specie…

https://path-traversal-101.knping.pl

We’re given a zip file containing the source files for the website. Let’s take a look.

Firstly, robot.js:

1
export default (req, res, next) => {
2
    const userAgent = req.get("User-Agent");
3
    if (userAgent == "robot") {
4
        next();
5
    } else {
6
        res.render("robot", { error: "🤖🤖🤖🤖🤖" });
7
    }
8
};

Seems like we need to change our User-Agent to robot. This can easily be done with the Google Chrome extensions Requestly or with BurpSuite. I chose to do it with Requestly.

To do it with Requestly, create a new rule to modify HTTP Request Headers, and modify User-Agent to robot. Reloading the page now gets us in!

Now take a look at index.js:

1
import express from "express";
2
import { randomUUID } from "crypto";
3
import withCatch from "./withCatch.js";
4
import { task1, task2, task3, tasks } from "./tasks.js";
5
import cookieParser from "cookie-parser";
6

7
import rl from "./ratelimit.js";
8
import robot from "./robot.js";
9

10
const { FLAG } = process.env;
11

12
const app = express();
13
const port = 3000;
14

15
const sessions = [];
16

17
const createSession = () => {
18
    const id = randomUUID();
19
    return {
20
        id,
21
        task1: false,
22
        task2: false,
23
        task3: false,
24
    };
25
};
26

27
app.set("view engine", "ejs");
28
app.use(express.static("static"));
29
app.use(express.urlencoded({ extended: true }));
30
app.use(express.json());
31
app.use(cookieParser());
32

33
app.get("/", (req, res) => {
34
    res.render("robot", {
35
        error: "",
36
    });
37
});
38

39
app.get("/robots.txt", (req, res) => {
40
    res.type("text/plain");
41
    res.send("User-agent: *\nDisallow: /🤖");
42
});
43

44
app.get("/%F0%9F%A4%96", robot, (req, res) => {
45
    const token = req.cookies.token;
46
    if (!token) {
47
        const session = createSession();
48
        sessions.push(session);
49
        res.cookie("token", session.id);
50
        res.render("exam", {
51
            task: tasks[0],
52
        });
53
    } else {
54
        const session = sessions.find((session) => session.id === token);
55
        if (!session) {
56
            const session = createSession();
57
            sessions.push(session);
58
            res.cookie("token", session.id);
59
            res.render("exam", {
60
                task: tasks[0],
61
            });
62
        } else {
63
            if (!session.task1) {
64
                res.render("exam", {
65
                    task: tasks[0],
66
                });
67
            } else if (!session.task2) {
68
                res.render("exam", {
69
                    task: tasks[1],
70
                });
71
            } else if (!session.task3) {
72
                res.render("exam", {
73
                    task: tasks[2],
74
                });
75
            } else {
76
                res.render("exam", {
77
                    task: FLAG,
78
                });
79
            }
80
        }
81
    }
82
});
83

84
app.get("/*", (req, res) => {
85
    res.render("robot", {
86
        error: "",
87
    });
88
});
89

90
app.post(
91
    "/%F0%9F%A4%96",
92
    rl,
93
    robot,
94
    withCatch(async (req, res) => {
95
        const token = req.cookies.token;
96
        if (!token) {
97
            throw new Error("Unauthorized");
98
        }
99
        const session = sessions.find((session) => session.id === token);
100
        if (!session) {
101
            throw new Error("Unauthorized");
102
        }
103
        const { solution } = req.body;
104
        if (!session.task1) {
105
            const result = task1(solution);
106
            if (result) {
107
                session.task1 = true;
108
                res.render("exam", {
109
                    task: tasks[1],
110
                });
111
            } else {
112
                res.render("exam", {
113
                    task: tasks[0],
114
                    error: "Try again!",
115
                });
116
            }
117
        } else if (!session.task2) {
118
            const result = task2(solution);
119
            if (result) {
120
                session.task2 = true;
121
                res.render("exam", {
122
                    task: tasks[2],
123
                });
124
            } else {
125
                res.render("exam", {
126
                    task: tasks[1],
127
                    error: "Try again!",
128
                });
129
            }
130
        } else if (!session.task3) {
131
            const result = task3(solution);
132
            if (result) {
133
                session.task3 = true;
134
                res.render("exam", {
135
                    task: FLAG,
136
                });
137
            } else {
138
                res.render("exam", {
139
                    task: tasks[2],
140
                    error: "Try again!",
141
                });
142
            }
143
        }
144
    })
145
);
146

147
app.listen(port, () => {
148
    console.log(`Server is running on http://localhost:${port}`);
149
});

Immediately, we can notice that at /robots.txt, /🤖 is disallowed from web crawling. Visiting that site presents us with our first task of tasks.js. Here’s tasks.js for reference:

1
import path from "path";
2

3
const preTask = (solution) => {
4
    if (typeof solution !== "string") {
5
        throw new Error("Solution must be a string");
6
    }
7
    if (solution.length > 512) {
8
        throw new Error("Solution must be less than 512 characters");
9
    }
10
    if (solution === "flag") {
11
        throw new Error("Your solution can't be 'flag'");
12
    }
13
    if (solution === "./flag") {
14
        throw new Error("Your solution can't be './flag'");
15
    }
16
};
17

18
export const task1 = (solution) => {
19
    preTask(solution);
20
    if (!solution.startsWith("/robot") || solution.endsWith("/flag")) {
21
        throw new Error(
22
            "You cannot access the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
23
        );
24
    }
25

26
    const solutionPath = path.join("/", solution);
27
    return solutionPath === "/flag";
28
};
29

30
export const task2 = (solution) => {
31
    preTask(solution);
32
    solution = solution.replaceAll("../", "");
33
    if (solution === "/flag") {
34
        throw new Error(
35
            "You cannot ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
36
        );
37
    }
38

39
    const solutionPath = path.join("/", solution);
40
    return solutionPath === "/flag";
41
};
42

43
export const task3 = (solution) => {
44
    preTask(solution);
45
    if (solution.includes("../") || solution === "/flag") {
46
        throw new Error(
47
            "You CANNOT ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
48
        );
49
    }
50

51
    const solutionPath = path.join("/", solution);
52
    return solutionPath === "/flag";
53
};
54

55
export const tasks = [
56
    `if (!solution.startsWith("/robot") || solution.endsWith("/flag")) {
57
    throw new Error(
58
        "You cannot access the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
59
    );
60
}
61

62
const solutionPath = path.join("/", solution);
63
return solutionPath === "/flag";`,
64
    `solution = solution.replaceAll("../", "");
65
    if (solution === "/flag") {
66
        throw new Error(
67
            "You cannot ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
68
        );
69
    }
70

71
    const solutionPath = path.join("/", solution);
72
    return solutionPath === "/flag";`,
73
    `if (solution.includes("../") || solution === "/flag") {
74
    throw new Error(
75
        "You CANNOT ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
76
    );
77
}
78

79
const solutionPath = path.join("/", solution);
80
return solutionPath === "/flag";`,
81
];

Let’s take a look at task 1:

1
export const task1 = (solution) => {
2
    preTask(solution);
3
    if (!solution.startsWith("/robot") || solution.endsWith("/flag")) {
4
        throw new Error(
5
            "You cannot access the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
6
        );
7
    }
8

9
    const solutionPath = path.join("/", solution);
10
    return solutionPath === "/flag";
11
};

Firstly, to locally test our solution, it’s easy to use a Node.js compiler like this and run each task there. Just note that importing the path module requires the use of this statement: var path = require('path');, not the one they provide in tasks.js.

Now let’s develop our solution. The first one requires that our path start with /robot and not end with /flag. This can be pretty easily done with .., which allows us to traverse backwards. Thus, we can construct the following string:

/robot/../flag/a/..

The idea here is that /robot/.. travels into and then out of the robot directory, while /a/.. travels into and then out of the a directory, leaving us with just /flag, our desired outcome!

Here’s task 2:

1
export const task2 = (solution) => {
2
    preTask(solution);
3
    solution = solution.replaceAll("../", "");
4
    if (solution === "/flag") {
5
        throw new Error(
6
            "You cannot ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
7
        );
8
    }
9

10
    const solutionPath = path.join("/", solution);
11
    return solutionPath === "/flag";
12
};

Task two seems to just be removing all ../ and replacing them with black spaces. Once the removal is done it simply checks if the result of the replacement is /flag. After solving this and moving onto task 3, I realized that the intended solution was probably the following payload:

/flag/a/....//

The reason this would work is because the replace operation would actually result in the following:

/flag/a/../

Which would evaluate as a path to the flag. However, I actually found a different solution:

//flag

The first forward slash doesn’t actually do anything to change the path, so this works just fine to pass task 2!

Here’s task 3:

1
export const task3 = (solution) => {
2
    preTask(solution);
3
    if (solution.includes("../") || solution === "/flag") {
4
        throw new Error(
5
            "You CANNOT ACCESS the flag!!! You are UNAUTHORIZED!!! 🤖🤖🤖🤖🤖"
6
        );
7
    }
8

9
    const solutionPath = path.join("/", solution);
10
    return solutionPath === "/flag";
11
};

Conveniently, because I found the unintended solution to task 2, my solution there worked completely fine here as well.

//flag

Once I completed the final task, the website presented me with the flag!

1
ping{p4th_tr4V3Rs4L_06c22f693acd46015891c98cb72f45e3}