# NetDiag — OS Command Injection (CTF challenge)

> NetDiag is an internal 'is this host up?' tool that shells out to ping with the hostname you provide — and it trusts internal users a little too much.

Canonical: https://codelivly.com/ctf/challenges/netdiag-cmdi

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 200 |
| Estimated time | 30 min |
| Type | Live instance |
| Solves | 27 |
| Author | Codelivly |

NetDiag is an internal 'is this host up?' tool that shells out to ping with the hostname you provide — and it trusts internal users a little too much. Make it run your command and read the flag file at /tmp/.netdiag/flag.txt.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)