Challenge

An upload feature that takes an archive and extracts it with cpio.

Approach

cpio stores whatever path you give it and happily writes outside the target directory on extraction, so the filename inside the archive is a path traversal. The user records live in users/, so an entry named ../users/example.json overwrites the example account. Filling it with a known password hash and an elevated permission level hands over an admin login. The hash is just md5 of password.

echo "../users/example.json" | cpio -o --format=newc > malicious.cpio

root@e69ce97c6b84:/app/users# cat malicious.cpio
070701...../users/example.json{"passhash": "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8", "perm_level": 3}
07070100000000...TRAIL

The same trick shows up in real tools, which is why engrampa carries an advisory for exactly this (GHSA-c98h-v39w-3r7v). If you ever see cpio, assume path traversal.

After uploading the archive, example:password logs in at permission level 3.

Solution

There is a command injection further in, where the server runs find with -exec md5sum and shell=True, and I spent a while crafting a file named ;cat ../flag.txt;# to abuse it. That was a detour. The admin page already prints the Flask secret key, which is loaded straight from flag.txt.

For debugging purposes, here is the secret key: b'UlN7YjM0bV9tM191cF81YzB0dHl9Cg=='

Base64 decoding that gives the flag.

Flag

RS{b34m_m3_up_5c0tty}