Bad login/password! Return to the login page
"; } exit(); } ?>
``` After doing some research, the code is vulnerable to php type juggling vulnerability. Read more [here](https://owasp.org/www-pdf-archive/PHPMagicTricks-TypeJuggling.pdf?ref=infosecarticles.com). ```php if (strcmp($_POST['username'], "admin") == 0 && strcmp($_POST['password'], $pass) == 0) { ``` By sending the password variable as array `password[]=""` will result in authentication bypass.  Direct to the dashboard and check the logs option.  Select the log and click Get the log button. Intercept the request in the Burp suite and send it to repeater for further inspection. Change the file name of the log file to `../../../../../../etc/passwd`. The application is vulnerable to LFI vulnerability. Now copy the webadmin user hash locally and crack the password using john.  Now SSH to user `webadmin` using the password `dragon`. ### Privilege Escalation Check the user permission allowed for the user webadmin. ```sh badmin@serv:~$ sudo -l Matching Defaults entries for webadmin on serv: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User webadmin may run the following commands on serv: (ALL : ALL) /bin/nice /notes/* webadmin@serv:~$ ``` The user has permission to run the binary `/bin/nice` on directory `/notes/*`. The `/notes/*` essentially means all the files and subdirectories that are contained within the "notes" directory. This is often used in commands to perform operations on multiple files or directories within a specific directory.  The user webadmin does not have any permission to add or edit existing files in the notes directory. So create a bash script with content as `"/bin/bash"` and save it in the webadmin home directory. Apply `chmod +x` to the script to make it executable file. Run the below command to obtain root shell.  **Root Obtained** Thanks for reading! For more updates and insights, follow me on Twitter: [@thevillagehacker](https://twitter.com/thevillagehackr). --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://thevillagehacker-security.gitbook.io/ctf-writeups/writeups/2023-09-20-proving_grounds_play-potato.md?ask=