Understanding the CTF Root Me Nginx - Alias Misconfiguration

In this scenario, a web developer has completed the development of a new intranet for a company. Your mission is to evaluate the security of this site before it goes live.

Key Points

• Objective: Assess the security of the newly developed intranet.
• Initial Observation: The site features a login interface.
• Discovery: A comment in the source code hints at a potential vulnerability.
• Exploitation: Utilizing the alias traversal vulnerability in Nginx to retrieve sensitive information.

Process

Initial Access

1. Visit the Site: Navigate to the provided URL: http://challenge01.root-me.org:59092/.
2. Login Attempts: Try various combinations of credentials without success.

Code Inspection

1. Inspect Source Code: Open the browser console and inspect the source code.
2. Discover Comment: Find the comment <!--TODO: Patch /assets/ -->.

Exploiting the Vulnerability

1. Initial Attempt: Try accessing http://challenge01.root-me.org:59092/assets/ without success.
2. Alias Traversal:
   • Attempt http://challenge01.root-me.org:59092/assets.. with no result.
   • Successfully access http://challenge01.root-me.org:59092/assets../ to retrieve the flag.

Learn More

• Alias Traversal: This vulnerability allows an attacker to access files outside the intended directory by manipulating the URL path.
• Nginx Configuration: Proper configuration of Nginx can prevent such vulnerabilities. Ensure that all directories are correctly secured.