Axino.net

This mission will introduce some new concepts we haven’t come up until now. Though solution is fairly simple without clues you’ll probably need some time to figure it out and come up with idea to use SSI (server side includes).

Intro of mission pointed us to SSI:

The password is yet again hidden in an unknown file. Sam’s daughter has begun learning PHP, and has a small script to demonstrate her knowledge. Requirements: Knowledge of SSI (dynamic html executed by the server, rather than the browser)

Furthermore, when you open mission you see somewhat extensive story behind mission

Level 8

Sam remains confident that an obscured password file is still the best idea, but he screwed up with the calendar program. Sam has saved the unencrypted password file in /var/www/hackthissite.org/html/missions/basic/8/

However, Sam’s young daughter Stephanie has just learned to program in PHP. She’s talented for her age, but she knows nothing about security. She recently learned about saving files, and she wrote an script to demonstrate her ability.

So if you make additional reading either on wikipedia or on the sites they suggest you will probably know what to do. In addition if you have solved previous mission you have required knowledge to solve this. So let’s do it.

<!--#exec cmd="ls" -->

With following command you will be able to list all files in the directory Sam’s daughter saves file. When we execute this recieved result is:

Hi, tshngmww.shtml hipykpqu.shtml ztxdhjxn.shtml avpfeoie.shtml fviqpmaw.shtml kqbybdzc.shtml dzrnmzgx.shtml npcsygfl.shtml whqxxojt.shtml ylomcmvu.shtml uhdppswp.shtml gzntiicx.shtml dzwbqiuu.shtml qvzuieng.shtml smcerykh.shtml qjhnmhmq.shtml znodwztr.shtml!

Your name contains 254 characters.

Avoid going trough all these files just notice URL where file open. So what shell we do now? Simple, we need to obtain files from missions root directory. And as command ls accepts parameter for directory we will use following command. That returns us one level up in directory tree and therefore we are able to obtain list of files in missions’s root directory:

<!--#exec cmd="ls ../" -->

Result is here:

Hi, au12ha39vc.php index.php level8.php tmp!

Your name contains 39 characters.

Now its obvious that password is saved in: au12ha39vc.php

After opening this file we obtain password: cdea748e

Similar Posts:

• hackthissite.org basic 9 :: tricky easy not
• Basic web hacking 9 :: null poison byte
• hackthissite.org basic 7 :: calendar is it!
• hackertest.net level 17 :: Do you like cookies
• hackthissite.org basic 3 :: password.php