hackburger.ee Warmup write up

hackburger.ee Warmup write up

great wargame

to solve this, go http://burger.laboratorium.ee:8000/

you can see it when you visit this site. we can guess it will use system() function. 

Using system() function, it sends ping message to target. 

But, system() function is vulnerable from command injection. 

If you input ;id , you can see the result when you typed it in bash shell.

Like this. 

By doing this, we can know there's the command injection vulnerabilit y.

- You can see the index.php source by requesting view-source:http://burger.laboratorium.ee:8000/?host=%3B+cat+index.php

You can get files in your directory by typing ; ls  

See the 'flag.php'

9reat. The flag is f1b35744925a3f5946c542a1ee64267af8b93b06