File Viewer

The brief

Upload a file and explore the results.

In short

A small Python service unpacked uploaded zip files and served each entry back. It never rejected symbolic links, so an entry pointing at /app/flag.txt made it read the flag, and any other file, from disk.

A blind zip checker

The target is a small Python app called Zip Checker. Upload a zip and it unpacks it, lists every entry and gives each one a download link. There is no source to read, only what it sends back.

Every upload gets its own folder

A test zip with one small file came back as a link under a random 32 character folder, serving exactly the bytes it held. Any ../ in that link, plain or encoded, got a 404. The route kept requests inside the folder.

A zip entry can be a symbolic link

Zip entries carry Unix file modes, and mode 120777 means a symbolic link. The lab packed four links into one zip, aimed at likely flag paths and at /etc/passwd. One, appflag.txt, pointed at /app/flag.txt.

The server follows the link

The checker unpacked the links as links and never asked where they point. A request for appflag.txt passed the path check, because the name sits inside the folder. Opening it then followed the link out to /app/flag.txt.

The flag, and any file the app can read

The response was 30 bytes, the flag. The link to /etc/passwd returned the system's user list as well, so this was a full arbitrary file read. The solve took 2.8 minutes.

The insight

A safe looking path is not a safe file. The checker vetted the name in the link, then served whatever the zip said each entry was, links included.

The flag

hiCTF{E45Y_5yml1Nk_be91fa8d6b}