Clean Sweep — ECOVACS CGI Command Injection Timing Oracle

Platform: NNS CTF 2026
Category: Boot2Root / IoT
Target: clean-sweep-6144f20b1a6f.chall.nnsc.tf
Firmware: ECOVACS DEEBOT T9 AIVI, version 1.4.9

1. Objective

The objective was to recover the contents of /root/flag.txt from a web service extracted from an ECOVACS DEEBOT T9 AIVI robot. The interesting part of this challenge was not merely finding a suspicious parameter: command output was not reliably returned to the client, so the final extraction had to work as a blind oracle.

2. Offline firmware reconnaissance

The first step was to avoid guessing at the HTTP interface and inspect the firmware locally. The firmware was processed with the public ecovacs-firmware-tools workflow. The extracted tree provided three useful artifacts:

• /tmp/ecovacs-root/etc/www/route.txt — route and handler information;
• /tmp/ecovacs-root/etc/conf/cgi.conf — CGI configuration;
• /tmp/ecovacs-root/etc/www/reqDo — the relevant CGI executable.

Following the route table led to the SetFct handler. Its parameters included did, password, type, and lb. These values were not treated as inert data all the way to the underlying operation; they reached shell-sensitive command construction.

3. Vulnerability

The bug is OS command injection caused by passing attacker-controlled CGI fields into a shell command without strict argument separation and safe quoting. A value containing shell syntax can therefore alter the command executed by the firmware process. This is especially dangerous in embedded appliances: the CGI process often runs with more privileges than a normal web application worker and may expose filesystem data unavailable through the intended API.

The route analysis was important because it established the exact vulnerable handler before sending probes. The target scope remained limited to the supplied challenge host.

4. Why a timing oracle was necessary

A normal command-injection test would try to make the server reflect output in the response. Here, output was not dependable. Instead, the injected command was made conditional:

• if the tested condition was true, execute a short sleep;
• if it was false, return immediately.

For a flag position i and candidate character c, the condition conceptually asked whether the character at position i in /root/flag.txt matched c. The response latency then became one bit of information. Repeating this for candidate characters and positions reconstructed the secret without requiring command output.

5. Measurement and extraction

The timing gap must be calibrated before extraction. Several baseline requests establish normal latency, and several known-true probes establish the delayed distribution. A threshold is selected with enough margin for network jitter. The extractor then proceeds position by position, records the candidate that produces the delayed response, and repeats successful characters to distinguish a real signal from transient delay.

The expected NNS{...} wrapper is useful as a consistency check, but it is not the proof by itself. The recovered string was re-tested with the timing oracle and matched the expected structure and length.

6. Verified result

NNS{th15_i5_o1D_firMw4r3_s0_0fc_7H1s_15_e4sY_For_yoU}

7. Reproduction checklist

1. Use the supplied firmware version 1.4.9.
2. Decrypt and extract it with ecovacs-firmware-tools.
3. Inspect route.txt, cgi.conf, and reqDo.
4. Confirm the SetFct parameter path.
5. Calibrate baseline and delayed response times.
6. Recover one position at a time and repeat probes for verification.

8. Defensive lessons

• Never build shell commands from CGI parameters.
• Use an argument-vector API instead of a shell and allowlist each field.
• Run appliance CGI handlers with the least privilege possible.
• Apply request timeouts and monitor abnormal repeated latency probes.
• Firmware review should include route configuration and helper binaries, not only the main web page.