[Charon]

Hey, I came along this site vulnerable to an LFI injection, and thought it'd be fun to put it up as a challenge.

Website: http://www.tudodebomdf.com.br/

You have to find the vulnerability yourself and try to spawn a shell or try to get the MySQL database info somehow!

Good luck. :blackhat:


Solvers:

1. Prestige
2. Dyme
3. האקר
4. Workaholics
5. Cyber Caliph

[BreShiE]

Here's my proof:

[Charon]

Here's my proof:

The goal was to spawn a shell or get the MySQL database info. I'll wait until you get it. :blackhat:

[JackDaniels]

Here is how far I got. Got the error log.
That's not even 1/10 but can't post everything. Now a night snack and I will attempt some more.

Code:

17:45:43 2013] [error] [client 187.86.27.130] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:45:43 2013] [error] [client 187.86.27.130] Premature end of script headers: index.php [Sat Feb 23 17:45:43 2013] [error] [client 187.86.27.130] File does not exist: /home/rgaidc/public_html/CENTRAL/500.shtml [Sat Feb 23 17:45:46 2013] [error] [client 187.86.27.130] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:45:46 2013] [error] [client 187.86.27.130] Premature end of script headers: index.php [Sat Feb 23 17:45:46 2013] [error] [client 187.86.27.130] File does not exist: /home/rgaidc/public_html/CENTRAL/500.shtml [Sat Feb 23 17:45:54 2013] [error] [client 187.40.93.200] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root?, referer: http://autosurf10.com/surfbar.php?PHPSESSID=ecfeb09616fea81912afcee530a14fac&vc_val=c4e3cafd656f79a4627a44db31eff52d [Sat Feb 23 17:45:54 2013] [error] [client 187.40.93.200] Premature end of script headers: index.php, referer: http://autosurf10.com/surfbar.php?PHPSESSID=ecfeb09616fea81912afcee530a14fac&vc_val=c4e3cafd656f79a4627a44db31eff52d [Sat Feb 23 17:45:54 2013] [error] [client 187.40.93.200] File does not exist: /home/sexprime/public_html/granafacil.net/500.shtml, referer: http://autosurf10.com/surfbar.php?PHPSESSID=ecfeb09616fea81912afcee530a14fac&vc_val=c4e3cafd656f79a4627a44db31eff52d [Sat Feb 23 17:46:31 2013] [error] [client 65.36.241.77] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:31 2013] [error] [client 65.36.241.77] Premature end of script headers: index.php [Sat Feb 23 17:46:31 2013] [error] [client 65.36.241.77] File does not exist: /home/redemogi/public_html/500.shtml [Sat Feb 23 17:46:35 2013] [error] [client 187.79.72.184] client denied by server configuration: /home/pwunixco/public_html/.htaccess, referer: http://inprivit.blogspot.com.br/ [Sat Feb 23 17:46:35 2013] [error] [client 187.79.72.184] File does not exist: /home/pwunixco/public_html/favicon.ico [Sat Feb 23 17:46:35 2013] [error] [client 187.79.72.184] File does not exist: /home/pwunixco/public_html/404.shtml [Sat Feb 23 17:46:40 2013] [error] [client 187.86.27.130] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:40 2013] [error] [client 187.86.27.130] Premature end of script headers: index.php [Sat Feb 23 17:46:40 2013] [error] [client 187.86.27.130] File does not exist: /home/rgaidc/public_html/CENTRAL/500.shtml [Sat Feb 23 17:46:42 2013] [error] [client 212.95.58.204] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root?, referer: http://xatopos.0fees.net/?br/info/www.tdbhost.com.br [Sat Feb 23 17:46:42 2013] [error] [client 212.95.58.204] Premature end of script headers: index.php, referer: http://xatopos.0fees.net/?br/info/www.tdbhost.com.br [Sat Feb 23 17:46:42 2013] [error] [client 212.95.58.204] File does not exist: /home/tdbhostc/public_html/500.shtml, referer: http://xatopos.0fees.net/?br/info/www.tdbhost.com.br [Sat Feb 23 17:46:42 2013] [error] [client 66.249.73.18] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:42 2013] [error] [client 66.249.73.18] Premature end of script headers: index.php [Sat Feb 23 17:46:42 2013] [error] [client 66.249.73.18] File does not exist: /home/tdbhostc/public_html/500.shtml [Sat Feb 23 17:46:52 2013] [error] [client 177.83.97.136] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:52 2013] [error] [client 177.83.97.136] Premature end of script headers: index.php [Sat Feb 23 17:46:52 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/500.shtml [Sat Feb 23 17:46:53 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/favicon.ico [Sat Feb 23 17:46:53 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/404.shtml [Sat Feb 23 17:46:54 2013] [error] [client 177.83.97.136] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:54 2013] [error] [client 177.83.97.136] Premature end of script headers: index.php [Sat Feb 23 17:46:54 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/500.shtml [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/favicon.ico [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/404.shtml [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] Premature end of script headers: index.php [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/500.shtml [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/favicon.ico [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/404.shtml [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] SecurityException in Application.cpp:188: Do not have root privileges. Executable not set-uid root? [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] Premature end of script headers: index.php [Sat Feb 23 17:46:55 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/500.shtml [Sat Feb 23 17:46:56 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/favicon.ico [Sat Feb 23 17:46:56 2013] [error] [client 177.83.97.136] File does not exist: /home/rgaidc/public_html/404.shtml [Sat Feb 23 17:46:56 2013] [error] [client 177.83.97.136]

[Charon]

No one have succeeded yet, come on guys! Think out of the box.

[Prestige]

I solved it finally:

Spoiler:

[Charon]

I solved it finally:

Spoiler:

Congratulations, you're the first one that has solved this challange!

[Prestige]

come on guys try it's not that hard

[Dyme]

Loling at skads who can't get this. A monkey with a tutorial could figure this out.

Spoiler:

[BreShiE]

Pretty easy shit.



I deleted the code at the bottom, just to make it look better in the notepad.