Webverselabs Logcraft Challenge Command Injection

Scenario :

LogCraft is a log aggregation SaaS for engineering teams. One of its paid features is the Health Report generator, which produces a formatted summary of log volume, error rates, and active sources. The report is named with a custom title supplied by the user. The developer knew double quotes were dangerous inside a shell command, so they stripped them before passing the title in. The command wraps the title in double quotes — and inside double-quoted strings, backtick substitution still executes.

Solution :

First thing first , we start by creating our account , and navigating the application just like a normal user would , then we will check Burp’s history for endpoints that we can test further .

Few endpoints can be identified just from looking at the Home page .

/Search :

This allows us to filter and search for specific Logs .

/Dashboard :

This is just a Dashboard to visualize all the logs and events in a graph .

/Reports :

This allows us to generate a Health check report .

/alerts :

This allows us to create new Rules .

/Team :

This endpoint allows us to invite new user to our Projects

Now looking at the description , it meantions something about reports generation , as well as double quote filtering . Let’s go check the reports endpoint and use it to see the normal use case for it .

We see that whatever we type in the Report title gets rendered to us next to “Health Report :”

We already know this is a Command injection challenge so SSTI isn’t the way here , we can assume that whatever we specify it gets passed as a parameter to a command that echoes “ Health Report :”

I tried multiple Command injection payloads , but it just gets treated as text .

If we check the description , we find that it says something about “” which means , maybe whatever we insert gets passed inside a “” which interprets it like a text .

For example : “test;” / “test

id” / “test&&id” => All of this will be printed out as a result of the echo command like normal Text .

This means if we can add “ at the beguinning maybe we can break out of the quotes and run our command ?

Now our “ gets sanitized , which means there is probably a function that filters for “ .

Now we’ll just assume we are inside a double quote , there is always a way to interpret a command as an executable command even inside the “” , by using `` or $() , this will be treated like commands to run even if we put them inside a double quote .

For example echo “$(id)” will still execute id instead of printing it .

Now let’s try to inject this command : $(id) :

This worked perfectly . Now we can use this to get out flag .

We see that it is located in / as usual .

Another thing , if we do an ls we can see the source code for our application , it’s written in ruby .

If we try and take a look at it :

We’ll try and check the function that does the sanitization .

==>the tr command will Replace " with nothing :) . 
safe_title = title.tr('"', '')

It is indeed filtering our the “ inside of the title parameter whenever we try generating a report , this is done to eliminate the possibility of breaking out of the ““in the echo command .

But they didn’t filter other ones like $ () , ``` which can execute code even inside the double quote .

That was all for this challenge , see you in the next one :)