---
# System prepended metadata

title: CTF-like vulnerable web app on Docker

---

# CTF-like vulnerable web app on Docker
## Intro
This is a simple and lightweight challenge on CRLF injection. Learner has to enumerate and find exposed directories. Identify and exploit misconfiguration to escalate privileges and get the flag, located in `/home/flag.txt`.

## Walkthrough
Navigate to http://localhost/. Currently front-end is not set and doesn't provide musch interest to the user.

![](https://i.imgur.com/UqXlTle.png)


Simple manual enumeration of directories may expose `/files` index and `/files/home` directory which gives redirect to users without the secret cookie. 

![](https://i.imgur.com/0Meh3v9.png)
![](https://i.imgur.com/RMLQ43n.png)

In order to overcome the redirects and get access to the flag, user should take advantage of redirects and utilize the CRLF nginx vulnerability. *CR* and *LF* are special characters (also referred to as `\r\n`) that are used to signify the End of Line (EOL). In case of a web application `%0d%0a` - represent the CRLF characters and let the attacker to manupulate the HTTP responce, like adding a header or splitting response. 

Payload ` %0d%0aSet-Cookie:%20User=Admin` added to the URL on `/files/home` page would create a `User=Admin` cookie and would grant access to the `flag.txt`.

![](https://i.imgur.com/QeBnaz3.png)

