Barked
Barked is a small community for sharing pictures of your dog. Browse the gallery, post your own pictures, and leave a comment on someone's pup.
The Scenario
Barked is a much loved little corner of the internet where people share pictures of their dogs.
While tidying up the server the maintainer noticed a file sitting in the web root that nobody put there through the site, and cannot work out how it arrived.
Look at Barked the way an outsider would, starting from the public gallery, and work out how a file could end up on the server that the site never meant to accept.
Lab Intel
Synopsis
Barked's one upload handler sniffs magic bytes: a plain image is hardened (extension forced from the sniff, stored in a non-executable folder), but a .zip is restored with an unsanitised file_put_contents(dir + '/' + entry) loop. The uploads folder has PHP disabled and every PHP-family file denied, so a shell dropped there is inert. A zip entry named ../shell.php escapes one level up into the PHP web root, where it executes. The flag at /flag.txt is only readable after that code execution.
Architecture
An easy single-vulnerability lab on two containers, an nginx gateway and a PHP 8.2 / Apache app with an embedded SQLite gallery. The only public surfaces are the gallery, per-photo comment threads (escaped, a deliberate XSS red herring), and one upload form labelled Upload Pictures of your dog. The plural Pictures is the only hint that the form also takes a zip album. Zip-Slip via an entry named ../shell.php drops a web shell into /var/www/html and yields RCE, which reads /flag.txt.
Who It's For
Beginners meeting archive path traversal (Zip-Slip) for the first time. The recon is finding that the upload accepts an archive, the insight is that the uploads folder cannot execute PHP so the shell has to escape up one level, and the payload is a single ../ entry.
Skills You'll Practice
- Spotting an undocumented archive-upload path on a photo site
- Recognising an escaped comment thread as a non-sink
- Building a Zip-Slip archive with a ../ traversal entry
- Turning an unsanitised archive restore into a PHP web shell and RCE
What You'll Gain
- A reusable Zip-Slip archive-extraction traversal technique
- The instinct to escape a non-executable upload folder into an executable web root
- An understanding of why keeping an archive entry's own path during a restore is dangerous