picoCTF Write-up 05 / 06 · Injection / RCE / Linux · 2025
Command Injection (ping).
Ping utility with insufficient input validation allowed command injection via semicolon separator.
NetcatCommand InjectionInput Validation
Method
Solution path.
01
Input filter only allowed '8.8.8.8' but didn't sanitize metacharacters
02
Injected
8.8.8.8 ; ls -la to enumerate directory03
Followed with
8.8.8.8 ; cat flag.txt to exfiltrate the flagFlag (spoiler)
picoCTF{p1nG_c0mm@nd_3xpL0it_su33essFuL_d1fdbdd0}