Webverselabs Netcheck Challenge Command Injection

Scenario :

Netcheck is a bootstrapped uptime-monitoring SaaS founded in 2021 by two ex-SRE friends in Lisbon, with about 800 paying teams on plans that start at $19/month. The Manual Diagnostics panel was a sales-led feature, built in an afternoon to close a deal with a customer who wanted “proof from outside our network,” and it has been quietly earning revenue ever since. The annual customer audit lands in two weeks and the founders asked you to take a look first.

Solution :

We first create an account then browse the application just like a normal user to see different endpoints , functionalities and finally check Burp’s History to see the differernt requests made to the server .

Upon navigating the application , we find this Diagnostics endpoint , which Pings whatever address we give it to check if it’s alive . This is porbably just running a ping command underneath , which can be abused for a command injection if the parameter being passed to the server isn’t well sanitized

I first tried some basic commmand injection payloads to see which one will break the application , but this one worked pretty well .

Injecting in the action field didn’t work so i decided to inject the Host Parameter instead and it worked , we got our command injection , Now to read the flag we just need to bypass the space filter if it exists , for this we can simply use :

${IFS} ==> This is our space

action=diag&host=8.8.8.8;cat${IFS}/flag.txt

Just like that we get our flag . That was it for this challenge , see you in the next one :)