Day2

to sign in visit:?id=ODIzODI5MTNiYmYw

from src code

			<input type=file id="chooseFile" accept=".jpeg,.jpg,.png">

I then uploaded some picture, sadly it doesn't show where the images is save. I tried to us gobuster but the browser always return the main page even tho the requested page doesn't exits. I then need to try one by one, luckily I hit the correct directory at the first try /uploads

prepare 2 reverse shell, you can find php reverse shell by running find / -name php-reverse* 2> /dev/null. I changed the name and make it more cute :P. We know that the site only accept .jpeg,.jpg,.png by studying the src page.

now let change the name of the file and include .png our reverse shell. since this page is poorly implemented, this should be enough to by pass it.

┌──(kali㉿kali)-[~/THM/adventofcyber/2]
└─$ cp cutiecat.php cutiecat.png.php

Dont forget to change IP + Port in the script before upload it. Open nc and listen/wait for incoming reverse shell then visit /upload/cutiecat.png.php to execute our shell!!

Boom

let go grab the flag

cya tomorrow, GL happy hacking!!