{"id":1439,"date":"2026-09-06T16:55:04","date_gmt":"2026-09-06T16:55:04","guid":{"rendered":"https:\/\/www.securesteps.tn\/?p=1439"},"modified":"2026-09-06T16:55:04","modified_gmt":"2026-09-06T16:55:04","slug":"clean-sweep-nns-ctf-walkthrough","status":"publish","type":"post","link":"https:\/\/www.securesteps.tn\/ar\/clean-sweep-nns-ctf-walkthrough\/","title":{"rendered":"Clean Sweep \u2014 ECOVACS CGI Command Injection Timing Oracle | NNS CTF"},"content":{"rendered":"

Clean Sweep \u2014 ECOVACS CGI Command Injection Timing Oracle<\/h1>\n

Platform:<\/strong> NNS CTF 2026
Category:<\/strong> Boot2Root \/ IoT
Target:<\/strong> clean-sweep-6144f20b1a6f.chall.nnsc.tf<\/code>
Firmware:<\/strong> ECOVACS DEEBOT T9 AIVI, version 1.4.9<\/code><\/p>\n

1. Objective<\/h2>\n

The objective was to recover the contents of \/root\/flag.txt<\/code> from a web service extracted from an ECOVACS DEEBOT T9 AIVI robot. The interesting part of this challenge was not merely finding a suspicious parameter: command output was not reliably returned to the client, so the final extraction had to work as a blind oracle.<\/p>\n

2. Offline firmware reconnaissance<\/h2>\n

The first step was to avoid guessing at the HTTP interface and inspect the firmware locally. The firmware was processed with the public ecovacs-firmware-tools<\/code> workflow. The extracted tree provided three useful artifacts:<\/p>\n

    \n
  • \/tmp\/ecovacs-root\/etc\/www\/route.txt<\/code> \u2014 route and handler information;<\/li>\n
  • \/tmp\/ecovacs-root\/etc\/conf\/cgi.conf<\/code> \u2014 CGI configuration;<\/li>\n
  • \/tmp\/ecovacs-root\/etc\/www\/reqDo<\/code> \u2014 the relevant CGI executable.<\/li>\n<\/ul>\n

    Following the route table led to the SetFct<\/code> handler. Its parameters included did<\/code>, password<\/code>, type<\/code>, and lb<\/code>. These values were not treated as inert data all the way to the underlying operation; they reached shell-sensitive command construction.<\/p>\n

    3. Vulnerability<\/h2>\n

    The bug is OS command injection caused by passing attacker-controlled CGI fields into a shell command without strict argument separation and safe quoting. A value containing shell syntax can therefore alter the command executed by the firmware process. This is especially dangerous in embedded appliances: the CGI process often runs with more privileges than a normal web application worker and may expose filesystem data unavailable through the intended API.<\/p>\n

    The route analysis was important because it established the exact vulnerable handler before sending probes. The target scope remained limited to the supplied challenge host.<\/p>\n

    4. Why a timing oracle was necessary<\/h2>\n

    A normal command-injection test would try to make the server reflect output in the response. Here, output was not dependable. Instead, the injected command was made conditional:<\/p>\n

      \n
    • if the tested condition was true, execute a short sleep<\/code>;<\/li>\n
    • if it was false, return immediately.<\/li>\n<\/ul>\n

      For a flag position i<\/code> and candidate character c<\/code>, the condition conceptually asked whether the character at position i<\/code> in \/root\/flag.txt<\/code> matched c<\/code>. The response latency then became one bit of information. Repeating this for candidate characters and positions reconstructed the secret without requiring command output.<\/p>\n

      5. Measurement and extraction<\/h2>\n

      The timing gap must be calibrated before extraction. Several baseline requests establish normal latency, and several known-true probes establish the delayed distribution. A threshold is selected with enough margin for network jitter. The extractor then proceeds position by position, records the candidate that produces the delayed response, and repeats successful characters to distinguish a real signal from transient delay.<\/p>\n

      The expected NNS{...}<\/code> wrapper is useful as a consistency check, but it is not the proof by itself. The recovered string was re-tested with the timing oracle and matched the expected structure and length.<\/p>\n

      6. Verified result<\/h2>\n
      NNS{th15_i5_o1D_firMw4r3_s0_0fc_7H1s_15_e4sY_For_yoU}<\/code><\/pre>\n
      7. Reproduction checklist<\/h2>\n
        \n
      1. Use the supplied firmware version 1.4.9<\/code>.<\/li>\n
      2. Decrypt and extract it with ecovacs-firmware-tools<\/code>.<\/li>\n
      3. Inspect route.txt<\/code>, cgi.conf<\/code>, and reqDo<\/code>.<\/li>\n
      4. Confirm the SetFct<\/code> parameter path.<\/li>\n
      5. Calibrate baseline and delayed response times.<\/li>\n
      6. Recover one position at a time and repeat probes for verification.<\/li>\n<\/ol>\n
        8. Defensive lessons<\/h2>\n
          \n
        • Never build shell commands from CGI parameters.<\/li>\n
        • Use an argument-vector API instead of a shell and allowlist each field.<\/li>\n
        • Run appliance CGI handlers with the least privilege possible.<\/li>\n
        • Apply request timeouts and monitor abnormal repeated latency probes.<\/li>\n
        • Firmware review should include route configuration and helper binaries, not only the main web page.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"
          Detailed NNS CTF IoT walkthrough covering firmware extraction, SetFct command injection, timing-oracle design, verification, and defensive lessons.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[80,1],"tags":[],"class_list":["post-1439","post","type-post","status-publish","format-standard","hentry","category-iot-security","category-webapplicationsecurity"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t