Coridor

Hello world

Hello Long time no Hack no Blog but we back now. Let’s get started with Corridor challenge from Webverse.

Corridor challenge from Webverse simulates a website called Ridgeline Press. This website at first view look very static but upon further digging and investigation i find out the website is vulnurable to a Local File Inclusion Vulnurability that allows arbitrary file access on the server. Once exploited we can get access to sensitive files and informations and ultimately our flag.

Here we have our dashboard after starting up the the machine and receiving our IP address to attack.

We have a DNS problem and to fix we have to resolve the IP address to the hostname (ridgelinepress.co)

Here after we resolve the DNS problem (It’s always DNS)

New Look web page after DNS resolve.

Browsing through the web pages and features i notice the many usernames as they could be useful, i also try to observe the robots.txt and we have an interesting find

Here we see a hidden notes.html file inaccessible to users. Now i try to access the file but i have to browse through the web pagess to see how the it call up resources on the webpage and i found an interesting parameter slug=tidewater-by-anna-mills.html

Now i see i can access a file from the web server called tidewater-by-anna-mills.html

This is a strong indicator of a potential Local File Inclusion, user input is not properly validated.

But i need to access the interesting notes.html file instead and i have just one job

This is the result in browser

Also testing for more LFI POC. I get access to /etc/passwd here

How it look in browser

Calling back the informations from notes.html we have our flag in the home directory of the Mike user. Now we have our flag

Browser look