Official discussion thread for Micro Storage. Please do not post any spoilers or big hints.
took me a while to work out what to research here, especially as itâs a âmiscâ challenge⌠could be so many things. got there in the end and it was actually a really tarrific challenge imo, nice work @hfz!
1 Like
Finally did it !!! Nice challenge. Easy if you know what you are looking for !!! Look good at the available options to find a wayâŚ
1 Like
Good challenge. If you have no idea, try to figure out which commands are executed for each option. Feel free to message me for hints.
1 Like
Just wanted to post this so others donât waste as much time as I dd with it. If you canât seem to get the service to do much; likely youâre using telnet as I was.
If youâve telnet in, the script will not take your input. See below:
1 => Upload a new file (10 file(s) remaining)
2 => List your uploaded files (0 file(s) uploaded so far)
3 => Delete a file
4 => Print file content
5 => Compress and download all your files
0 => Quit (you will lose your files!)
Choose an option: 1
[-] No such option.
1 => Upload a new file (10 file(s) remaining)
2 => List your uploaded files (0 file(s) uploaded so far)
3 => Delete a file
4 => Print file content
5 => Compress and download all your files
0 => Quit (you will lose your files!)
Choose an option:
If you use nc instead; it works fine.
1 => Upload a new file (10 file(s) remaining)
2 => List your uploaded files (0 file(s) uploaded so far)
3 => Delete a file
4 => Print file content
5 => Compress and download all your files
0 => Quit (you will lose your files!)
Choose an option: 1
[] Enter your file name: fjfjf
[] Start typing your file content: (send âEOFâ when done)
4 Likes
Its quite nice challenge though :). It really took me some time to figure out what to do, but all the efforts are worth at the end :). If someone needs some hints, can contact me. I will be glad to help.
F to those who tried to send Ctrl+D, but not manually type âEOFâ 
. PM me if you need a nudge
1 Like
Late to the party here.
I think I way over-complicated this one. I got the flag but am unsure how what it refers to could be useful. Anyone else use time-based blind RCE? If you used what was mentioned in the flag, how so?
The filename seems to be sanitized so none special chars can be placed, also the contents of the file donât allow to show env variables so I might be missing out with something with the other options⌠any guess?
That challenge was great, and easy except me overthinking. if youâre stuck, stop trying to own it, work towards the objective. and remember that everything is a command in linux
This challenge would have benefited from sharing the source code. The bug shouldnât be too obvious while minimizing tedious probing. At least I didnât enjoy the âfuzzingâ, the vuln is nice and was quite discoverable with a bit of research. nice work!