Apprentice
← all rooms
RCE Expert

Remote Code Execution

Command injection and LFI-to-RCE. Commands run in a simulated shell only.

Mission briefing

StockPulse checks warehouse inventory by shelling out to system tools. A legacy ping utility and a comment-driven blog also live in the same deployment. Determine whether user input can influence commands or included files on the host.

0 / 3 tasks 0 / 45 pts

Objectives

  • Inject a second command into the stock checker
  • Bypass a character filter with a pipe
  • Get a stored comment executed as code
Task 1 Command Injection Medium 10 pts

Scenario

StockPulse checks inventory by passing your product id into a shell curl command. Special shell characters may run a second command after the intended one. Read the contents of flag.txt on the simulated server.

Your approach

  1. Submit a normal numeric product id and observe output.
  2. Append a command separator followed by a read command for flag.txt.
  3. Confirm flag text appears in the command output area.
  4. Submit the RCE flag from the response.

product_id is concatenated into a curl command.

Open lab →
Hint

?product_id=1; cat flag.txt

Task 2 Filter Bypass Hard 15 pts

Scenario

A network ping tool strips semicolons and ampersands from user input before execution. Other shell metacharacters may still be available. Run a read command on flag.txt despite the filter.

Your approach

  1. Test which characters survive the sanitiser in the ping field.
  2. Use an allowed operator such as a pipe to chain commands.
  3. Pass a host value that runs cat on flag.txt via the pipe.
  4. Copy the flag from the combined output.
  5. Submit the RCE flag.

; and & are stripped — the pipe is not.

Open lab →
Hint

127.0.0.1 | cat flag.txt

Task 3 LFI to RCE Expert 20 pts

Scenario

Blog comments are saved to disk and later included when posts are viewed. Your comment text becomes part of a server-side include path. Leave a comment that executes system commands when an admin opens the post.

Your approach

  1. Post a normal comment and confirm it appears on the blog view.
  2. Submit a comment containing server-side code that runs id or similar.
  3. Open the post view to trigger inclusion of your file.
  4. Read the uid line for www-data from the output.
  5. Submit the exact uid string shown in the lab.

Comments are included as code when viewed.

Open lab →
Hint

<?php system('id'); ?>