> For the complete documentation index, see [llms.txt](https://ctf.laet4x.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.laet4x.com/ctf-2021/rootcon-15-ctf/exploitation-4.md).

# Exploitation 4

<figure><img src="/files/XnLMWnUI4LkidfyMPkak" alt=""><figcaption></figcaption></figure>

This challenge requires us to read the /flag.txt file

During our enumeration we found the **Elasticsearch Directory Traversal (CVE-2015-5531)** vulnerabilities

Description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

<figure><img src="/files/FsrxL2BrhoseeV7axRTM" alt=""><figcaption></figcaption></figure>

We change the path to /flag.txt to read the file. But we got encoded data.

<figure><img src="/files/yNlUHp3vGOGLQWLlzRXQ" alt=""><figcaption></figcaption></figure>

We used some online decoding tools to decode the data from decimal into ascii.

<figure><img src="/files/fs9hlRaFgbC8HNB5KFSC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/nGIvIJzAaaYDvorFadpG" alt=""><figcaption></figcaption></figure>

Flag: ***RC15{J5ekuUdMY7BLZmktYCXzWZhZZ4J3W8pv}***