Web - Server

Wednesday 20 September 2017, 20:03  #1
Web - Server - Command Injection
sha4
  • 1 posts

Just fund that [... spoil alert ...] command or other work fine. But i stoped in next step? what to do?

Wednesday 20 September 2017, 20:14  #2
Web - Server - Command Injection
sambecks
  • 83 posts

Read the source.

Friday 22 September 2017, 09:15  #3
Web - Server - Command Injection
Alyssa Herrera
  • 3 posts

Find the flag, you need to familiarize yourself with bash commands to find it

Saturday 23 September 2017, 12:11  #4
Web - Server - Command Injection
ShntoGendeng
  • 1 posts

I already crawl all over the directory, but cant find a single flag? am i looking in the wrong place? i even read all the passwd file and bashrc file, but still no avail.

Sunday 24 September 2017, 10:58  #5
Web - Server - Command Injection
Alyssa Herrera
  • 3 posts

It’s a lot simpler than you think honestly. It’s in the last place you think to check lol

Tuesday 26 September 2017, 16:37  #6
Web - Server - Command Injection
Mute
  • 1 posts

So I’ve figured out how to display all of the directories and files on the page but I cant find any flags, any pointers towards which of the directories it may be in. Thanks.

Wednesday 27 September 2017, 20:02  #7
Web - Server - Command Injection
the-paladin
  • 2 posts

I can’t seem to escape the IP address at all. Can anyone offer any pointers?

Tuesday 3 October 2017, 15:13  #8
Web - Server - Command Injection
Salfreid
  • 1 posts

So I’ve bypassed the filter and identified the vulnerability but i’m struggling to find the right commands to read the index.php. Am I looking in the right place and if so any pointers to the commands I should be looking at would be appreciated

Wednesday 4 October 2017, 09:26  #9
Web - Server - Command Injection
the-paladin
  • 2 posts

Can you offer any tips on how you passed the filter? I feel like I’ve tried everything

Friday 6 October 2017, 21:34  #10
Web - Server - Command Injection
NE1W01F
  • 2 posts

yep can’t see how it can be done. tried "get /" and changed the form from "post" to "get". please help.

Tuesday 17 October 2017, 11:43  #11
Web - Server - Command Injection
shadow1212
  • 1 posts

wow i have literally spent 20 mins and now i realise how useless i am, and the flag was sitting there in front of me, just read the description of this task and the solution lies within the question