https://anthr4ce.github.io/tags/brunnerctf/Recent content in BrunnerCTF on Anthrace | CTF WriteupsHugoen-usSun, 24 Aug 2025 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/brunnerctf-2025/web/Sun, 24 Aug 2025 00:00:00 +0000https://anthr4ce.github.io/ctf-writeups/brunnerctf-2025/web/<hr> <p>This challenge demonstrates a classic prototype pollution vulnerability that leads to remote code execution through PATH hijacking. We exploit a dangerous <code>deepMerge</code> function to pollute <code>Object.prototype.env</code>, hijack the system&rsquo;s PATH variable, and execute a malicious binary disguised as the legitimate <code>zip</code> command.</p> <h2 id="overview--attribution"> Overview &amp; Attribution <a class="heading-link" href="#overview--attribution"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>When I first tackled this challenge, I had a gut feeling we were dealing with prototype pollution. But the real “enlightment” moment came when I found an epic writeup <strong>Mizu</strong> at <a href="https://mizu.re/post/infinite-mario" class="external-link" target="_blank" rel="noopener">mizu.re</a>. This absolute legend in the web security game, and his breakdown of a similar exploit was like finding the perfect recipe for this challenge. If you’re into this stuff, you have to check out Mizu’s work. His DOMPurify research is really insane. Huge props to them for sharing knowledge that helps us all level up!</p>