Escape_202

MediumWeb Security

Overview

S C E N A R I O
A lightweight web service has been deployed to help administrators search for files across the server. The application provides a simple interface where users can submit a filename and retrieve matching results from the underlying system. For transparency, the source code of the service is also available for review. While the functionality appears straightforward, the service interacts directly with the system environment to perform its operations. Somewhere on the server, a sensitive file exists following a specific naming pattern. Your task is to explore the application’s behavior and determine whether its implementation properly enforces input handling.

O B J E C T I V E
Analyze the application and retrieve the contents of the hidden flag file.

Infrastructure Web Application (HTTP)

Provided Files source code via web interface

Flag Format FLAG{...}

Job Positions

Penetration Tester

Tags

RceCommand InjectionPhpInput ValidationSource Code Review