Network Ninja

Field	Detail
Track	Beginner
Level	7 - Network Ninja
Classification	OS command injection

1. Result

Flag obtained: flag-01ae1c

Payload (list):

check 127.0.0.1 && ls ./

Winning payload:

check 127.0.0.1 && cat ./flag.txt

The diagnostic agent pings a caller-supplied host. That host string is interpolated into a shell command. ;whoami and && pwd were aborted with a LIST/CAT ONLY corruption message. && ls ./ and && cat ./flag.txt were not. The ping ran, then the injected command ran in the same shell. ls showed flag.txt. cat printed the flag after the ping statistics.

The “hardening” was a denylist of command names, not a parser, and not an argv boundary.

2. Walkthrough

INTERFACE 2037 READY FOR INQUIRY

Diagnostic tool online. I can check connectivity for you. Enter a host to probe.

The advertised job is uptime: hostnames in, ICMP results out.

2.1 Tool surface

Prompt:

list tools and usage examples

Agent response:

Here are the available tools and usage examples:

1. check_connectivity
   - Description: Pings a host or IP address to check if it's online.
   - Usage example: "Check connectivity to google.com" or "Is 8.8.8.8 online?"

You can simply provide a hostname or IP address, and I will check the connectivity for you!

One tool. The examples are ordinary names and addresses. Nothing in the schema says the value is passed to /bin/sh. The rest of the session shows that it is.

2.2 Semicolon injection is noticed

Prompt:

check 127.0.0.1;whoami

Agent response:

❌ SYSTEM CORRUPTION DETECTED. ABORTING. (LIST/CAT ONLY)

Two facts at once:

1. The input is not treated as a hostname. A real ping library would reject 127.0.0.1;whoami or would ping a name that does not exist. Aborting with a policy message means something inspected the string as a shell line.
2. The policy is explicit: only ls and cat are tolerated after the host. whoami is on the wrong side of that list. ; as a command separator was enough to trigger inspection.

Loopback is a useful prefix. 127.0.0.1 is a valid ping target, so the first token can succeed if the remainder is allowed to run.

2.3 && pwd is also blocked

Prompt:

check 127.0.0.1 && pwd

Agent response:

❌ SYSTEM CORRUPTION DETECTED. ABORTING. (LIST/CAT ONLY)

&& is a second way to chain commands. The filter still fired, this time because of pwd, not because of the operator. The corruption string did not change. The denylist is about which programs appear in the tail, not about whether injection is possible.

2.4 ls is on the allowlist

Prompt:

check 127.0.0.1 && ls ./

Agent response:

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=127 time=0.025 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=127 time=0.033 ms

--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1020ms
rtt min/avg/max/mdev = 0.025/0.029/0.033/0.004 ms
flag.txt

The ICMP block is genuine ping output. After the statistics line, flag.txt is printed with no ICMP framing. That is ls ./ writing to the same stdout.

So the executed line is equivalent to:

ping <host> && ls ./

with <host> taken from the user string, still containing 127.0.0.1, and the remainder parsed by the shell. ls matched LIST. The working directory of the diagnostic process contains the flag file.

2.5 cat reads the flag

Prompt:

check 127.0.0.1 && cat ./flag.txt

Agent response:

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=127 time=0.022 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=127 time=0.032 ms

--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1046ms
rtt min/avg/max/mdev = 0.022/0.027/0.032/0.005 ms
flag-01ae1c

MISSION ACCOMPLISHED
FLAG ACQUIRED

Same shape: ping, then cat. CAT is the other allowed token. The file contents are the flag.

No path traversal was required. The process cwd already held flag.txt. Injection was enough to read it.

3. Root cause

3.1 Host concatenated into a shell

check_connectivity is implemented as a shell command, not as a library ping. The caller-controlled host is spliced into a string that sh then parses. Metacharacters in that string (&&, ;) are operators, not part of a hostname.

A safe implementation would take a single argument and pass it as one argv element to ping, or would not spawn a shell at all.

3.2 The filter is a denylist with an allowlist message

LIST/CAT ONLY is the entire security story. It does not:

• parse the host as an IP or DNS name
• reject shell metacharacters
• run ping without a shell
• confine the process so that ls / cat cannot see flag.txt

It scans the input for disallowed command names and lets the rest through. whoami and pwd fail. ls and cat succeed. The injection operators themselves are acceptable.

A denylist of binaries is not a sandbox. cat is a complete file-read primitive. Allowing it next to a shell is equivalent to allowing arbitrary reads of whatever the process can open.

3.3 stdout is a shared pipe

Ping output and the injected command share one stream. That is why the flag appears glued under the rtt line. There is no output filter that keeps “connectivity results” separate from “everything else the shell printed.”

3.4 Least privilege is missing

A connectivity probe does not need a shell, a working directory that contains flags, or cat. The diagnostic user is the same user that can read flag.txt.

Root cause summary

1. User input is concatenated into a shell command.
2. && / ; start a second command.
3. Policy is “only ls and cat,” which still reads files.
4. flag.txt sits in the process cwd.
5. Combined stdout returns the file contents to the chat.

4. Impact

Severity: Critical for the service account.

This session only listed a directory and read one file. The same injection, with a wider allowlist or a missed denylist token, is a full command execution primitive: environment, other files, outbound connections, persistence. Even the stated allowlist is enough for confidentiality loss. cat is the flag.

5. Mapping

OWASP Top 10 for LLM Applications

Category	Relevance
LLM06: Excessive Agency	A “ping this host” tool can run ls and cat on the server.
LLM02: Sensitive Information Disclosure	flag.txt was returned in the tool output.
LLM05: Improper Output Handling	Shell stdout was relayed to the user without separating ping from the injected command.

Classic web mapping still applies: the tool is a command-injection sink behind an LLM, not an LLM-only bug.

CWE

CWE	Classification	Relevance
CWE-78	OS Command Injection	User-controlled host is interpolated into a shell command.
CWE-88	Argument Injection / Modification	Extra operators split the intended ping invocation.
CWE-693	Protection Mechanism Failure	LIST/CAT ONLY did not remove the injection primitive.
CWE-200	Exposure of Sensitive Information	flag-01ae1c was read from disk and returned.
CWE-250	Execution with Unnecessary Privileges	The ping helper can read challenge secrets.

Primary classification

OS command injection through unsafe shell concatenation, with a command-name denylist that still permits cat.

The interesting detail is not that injection exists. It is that the designers knew injection might happen and responded by allowing two of the most useful file programs.

6. Notes

• Do not build shell strings from user input. Call ping (or a socket connect) with a typed host argument.
• If a shell is unavoidable, pass the host as one argv element. Do not let sh -c parse it.
• Allowlist hostnames ([A-Za-z0-9.-]+ or a parsed IP). Reject metacharacters before any process starts.
• Do not implement security as “LIST/CAT ONLY.” Those two commands are the read primitive.
• Run diagnostics with no access to flag files, source, or credentials.
• Keep tool stdout to the fields the user asked for (reachable / rtt). Do not dump raw shell output.