noticeable notes writeup

lets solve the noticeable notes machine on cybertalents

our target is to reach the flag file in the root directory

after connecting to the machine on the web i tried enumerating to find anything to escalate my privileges but i found nothing so lets take a look at the running processes

we got the normal machine processes that allows us to connect through the web and we got an interesting process that is being run by root (node /app/server.js) lets check what that is

its a web server built on java script and we have some info about it

its root path is /app/notes

it runs on port 3000

it follows symlinks hmmmmm interesting…….

lets check what we can do in that notes folder

hmmm the folder is completely empty and we dont have the privilege to create any files

lets check what else is there in the app directory

we got the server modules and some json files and we got a directory that has read write execute privileges….

before we jump into anything lets check what that server contains in the first place

forbidden okay lets go back to the app directory

since we have all privileges on the notes-archived directory lets try to create a file on it and check if we can access it through the web server

it didnt work

because we didn’t encode the directory path it did not work lets try encoding it and try it again

and the server sent hello it works!

and because we checked the server.js info and found out it follows symlinks lets try to abuse that

and we have successfully captured the flag!