Intermediate·300 points·18 solves
NetDiag — OS Command Injection
Learn OS command injection: when a web app builds a shell command out of your input, shell metacharacters let you run commands of your own on the server.
The diagnostic runs a shell command built like this:
ping -c 1 -W 1 YOUR_INPUT
Your input is pasted in with no sanitisation, and it runs through /bin/sh — so shell syntax in your input is executed. A semicolon ends the ping and starts a new command; `$(…)` and backticks substitute a command's output; `|` pipes. The flag is the container's $FLAG environment variable. The fix is to never build shell strings from input — pass arguments as a list to the program directly, with no shell.
Your tasks
1
Open the tool
Click Open lab. Enter a host like 127.0.0.1 and run the diagnostic. (There is no network egress, so ping itself just reports unreachable — that is fine.)
2
Realise it uses a shell
Your host is pasted into a shell command. Shell metacharacters ( ; | && $() ) will be interpreted.
3
Chain a second command
End the ping with a semicolon and add your own command after it.
4
Print the flag
The flag is in the $FLAG environment variable. echo it.
5
Capture the flag
Read $FLAG from the command output and submit it.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.