Beginner·200 points·15 solves
Archivr — Path Traversal
Learn path (directory) traversal: when a web app builds a file path from user input without confining it, ../ sequences let you climb out of the intended folder and read arbitrary files.
Archivr opens a document by pasting your filename onto the library folder:
open("/app/docs/" + YOUR_FILENAME)
Nothing stops YOUR_FILENAME from being ../../etc/passwd or an absolute path — each ../ climbs one directory up, so you escape /app/docs and read any file the process can. A powerful target is the process's OWN environment at /proc/self/environ, which contains every environment variable the app was started with — including its secrets. No shell runs here; this is pure file reading. The fix is to resolve the final path and confirm it stays inside the library (os.path.realpath + a prefix check), or to serve files by an id mapped to a fixed allow-list.
Your tasks
1
Open the viewer
Click Open lab. Archivr lists library files; opening one shows /view?file=<name>.
2
Escape the folder
The filename is joined onto the library path with no checks. Add ../ to climb out — try reading a well-known system file to confirm it works.
3
Find where secrets live
A running process keeps its environment variables at /proc/self/environ. That file holds the values the app was started with.
4
Read the process environment
Point the viewer at /proc/self/environ via traversal. The flag is one of the variables.
5
Capture the flag
Find CLV{...} in the environment output and submit it.
Submit the flag
Start the lab, capture the flag from the running machine, and submit it here.