Voice Changer [206 Solves]

Description

I made a cool app that changes your voice.

Author: Ido

https://uoftctf-voice-changer.chals.io/

Short Solution

Argument Injection in [POST] /upload pitch parameter.

Solution

Explore functionality

Recording and submitting:

The ffmpeg command that appears to have been executed on the server side has been output. At this time, [POST] /upload request was sent:

Argument Injection

I send the previous request to Burp Repeater and remove unnecessary headers. And, I inject id command in the pitch parameter:

The result of id command is got so exploit Argument Injection. Now, all that's left is to retrieve the flag.

Flag

uoftctf{Y0UR Pitch IS 70O H!9H}