[DevCTF 2022] ManDir

Hmm… quite an interesting text box, but one that seemingly does nothing. Wonder what sits behind it.

https://web.ctf.devclub.in/web/6/

The homepage mentions pandoc, and provides a text box for the input. Pandoc is popularly used for converting markdown to HTML. Let’s try it for this webpage.

This looks like a markdown editor.

As expected, the page converts markdown to HTML and displays it to us. We can assume that all of this is being done through Pandoc. If you read more about pandoc, it is a haskell library for converting from one markup format to the other. If you go through some CVEs for pandoc you might find script injection vulnerability in its older versions. Maybe we could try that vulnerability with this version as well.

<script src="file:///etc/passwd"></script>

Inspect the network

As you can see, the file contents are listed. This means we can read arbitrary files on the system.

Now, the challenge name is ManDir which breaks down to man-dir or the man page directory. The most obvious place to check is the pandoc’s man page.

If you read about man pages, you will find that they are usually compressed using gzip. The default man page of pandoc is located in

/usr/share/man/man1/pandoc.1.gz

Hence the natural exploit would be

<script src="file:///usr/share/man/man1/pandoc.1.gz"></script>

On entering the payload, we get the following response.

The response contains the flag at the end

Note that to make things easy, the request header includes an

Accept-Encoding: gzip, deflate

This means the gzip file is deflated in the response.

Voila! We have the flag

CTF{pandoc_for_d_win!!!}