[Music]
all right everybody I am here my name is
Mike I work for secur works as a new
little baby penetration tester super fun
uh I'm here to give kind of an overview
of the Door Company Challenge on the CTF
and kind of how I went through it so
here we go uh challenge gives you a few
different uh hosts says pick one so
we're just going to pick one of these
here and as we open it we realize it's a
standard uh Door Company page so what
what I like to do first is what does the
page give me that I can um naturally
interact with so I start clicking
buttons and scrolling pages and I
quickly realize that this page does
absolutely
nothing like nothing nothing so progress
from there and go to all right if if I
think the page isn't doing anything
we'll just easily inspect the source of
the
page see some uh references the style
sheets for bootstrap and jQuery which
are pretty standard for the styling of
the page but I also don't find anything
it's just a pretty standard blank page
so
um progress from there to all right what
happens when I load the page so if I go
back open up to just trying to keep
things as easy as can with the the
browser Dev tools
here open up my little Network tab
reload the
page and we get like the the request
response headers
I said maybe it's a CTF maybe they snuck
something cool in there you never know U
so as we scroll
through these uh request response
headers here I'm scrolling scrolling
down um there's an X powered by header
that has a a specific PHP version which
we're always Keen to take specific
versions and search them on the Internet
and of course the first three items may
be polluted due to my previous searching
our remote code executions for this very
specific PHP
version uh so we click on one and check
it
out give it a read uh yeah remote code
execution looks
cool look at the code I don't want to be
like sending creds to somebody's home
server
or things like that it looks cool uh so
I downloaded
that which we have over here and as we
run exploit. it's nice enough to give us
some prompts as you can see on the left
so we'll give it the URL of the this
door company website
here and
Kow sh on the the web host or that web
server box super easy uh it probably
doesn't get any easier than that like
there's other exploits that are pretty
similar but this one's easy so I'm on a
I'm on the box uh where am I
I'm I'm in a vww HTML folder and who am
I are usually like the first two things
you want to figure out before you got to
figure out where you need to go or what
you can escalate to um I can read files
and there's only as I said the one PHP
index file um so I always like to start
start at root listed out see what you
can get and low behold
um there's a uh flag doct Tex just
sitting on the route so there you go the
solution little bit of oin stuff for
exploit code for the door company
challenge uh one note I did go down kind
of a rabbit hole with the um there's a
jQuery exploit too but it's for like
prototype pollution which would be handy
if the page actually did anything but in
this case it just turned out to be not
applicable to this target so any
questions open you wrote the whole thing
in open AI like you just told it it's a
pretty nice looking standard bootstrap
page I should just have it right front
ends for me from now on
because I'd have the spacing all messed
up anything
else super nice little easy
one thanks
guys