Skip to content

exotic-attacks: Fix session migration to match template structure #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnaSteopoae wants to merge 4 commits into
base: main
Choose a base branch
from
Open

exotic-attacks: Fix session migration to match template structure #106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
308efd0
modified exotic attacks to new version
Jul 14, 2024
4b312be
Merge PR #84: migrate exotic-attacks to template structure
AnaSteopoae Dec 6, 2025
c9c0cf5
exotic-attacks: Final template alignment and structural fixes
AnaSteopoae Dec 6, 2025
e2104ea
exotic-attacks: Fix image paths in reading/README.md
AnaSteopoae Dec 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...acks/activities/breaking-hashes/README.md → ...-attacks/drills/breaking-hashes/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,4 @@ A possible payload in POST data is:

`username[]="8"&password[]=8&submit=Login`

Exploit in `../sol/solution.sh`.
Exploit in `../solution/solution.sh`.
0 ...ties/breaking-hashes/deploy/.dockerignore → ...ills/breaking-hashes/deploy/.dockerignore
View file
Open in desktop
File renamed without changes.
0 ...ivities/breaking-hashes/deploy/Dockerfile → .../drills/breaking-hashes/deploy/Dockerfile
View file
Open in desktop
File renamed without changes.
0 ...ctivities/breaking-hashes/deploy/Makefile → ...ks/drills/breaking-hashes/deploy/Makefile
View file
Open in desktop
File renamed without changes.
0 ...c-attacks/activities/breaking-hashes/flag → ...xotic-attacks/drills/breaking-hashes/flag
View file
Open in desktop
File renamed without changes.
0 ...ctivities/breaking-hashes/sol/solution.sh → ...ills/breaking-hashes/solution/solution.sh
100755 → 100644
View file
Open in desktop
File renamed without changes.
100 changes: 50 additions & 50 deletions ...es/breaking-hashes/src/index-template.php → ...ls/breaking-hashes/src/index-template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,50 +1,50 @@
<?php
$flag = '__TEMPLATE__';
$error = '';
if (isset($_POST['submit'])) {
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] == $_POST['password']) {
$error = 'Your password can not be your username!';
} else if (hash('sha256', $_POST['username']) === hash('sha256', $_POST['password'])) {
die($flag);
} else {
$error = 'Invalid credentials!';
}
}
}
?>
<html>
<head>
<title></title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
</head>
<body>
<section>
<div class="card mt-5" style="width: 28rem; margin: auto;">
<div class="card-body">
<?php if ($error != ''): ?>
<div class="alert alert-danger" role="alert">
<?php echo $error; ?>
</div>
<?php endif; ?>
<form method="POST">
<div class="form-group">
<label for="username">Username</label>
<input type="text" name="username" class="form-control" id="username">
<!-- TODO: Remove source.phar -->
</div>
<div class="form-group">
<label for="password">Password</label>
<input type="password" name="password" class="form-control" id="password">
</div>
<input type="submit" class="btn btn-primary" name="submit" value="Login" />
</form>
</div>
</div>
</section>
</body>
</html>
<?php

$flag = '__TEMPLATE__';
$error = '';

if (isset($_POST['submit'])) {
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] == $_POST['password']) {
$error = 'Your password can not be your username!';
} else if (hash('sha256', $_POST['username']) === hash('sha256', $_POST['password'])) {
die($flag);
} else {
$error = 'Invalid credentials!';
}
}
}

?>

<html>
<head>
<title></title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
</head>
<body>
<section>
<div class="card mt-5" style="width: 28rem; margin: auto;">
<div class="card-body">
<?php if ($error != ''): ?>
<div class="alert alert-danger" role="alert">
<?php echo $error; ?>
</div>
<?php endif; ?>
<form method="POST">
<div class="form-group">
<label for="username">Username</label>
<input type="text" name="username" class="form-control" id="username">
<!-- TODO: Remove source.phar -->
</div>
<div class="form-group">
<label for="password">Password</label>
<input type="password" name="password" class="form-control" id="password">
</div>
<input type="submit" class="btn btn-primary" name="submit" value="Login" />
</form>
</div>
</div>
</section>
</body>
</html>
18 changes: 9 additions & 9 deletions ...activities/breaking-hashes/src/source.bak → ...cks/drills/breaking-hashes/src/source.bak
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] == $_POST['password']) {
$error = 'Your password can not be your username!';
} else if (hash('sha256', $_POST['username']) === hash('sha256', $_POST['password'])) {
die($flag);
} else {
$error = 'Invalid credentials!';
}
}
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] == $_POST['password']) {
$error = 'Your password can not be your username!';
} else if (hash('sha256', $_POST['username']) === hash('sha256', $_POST['password'])) {
die($flag);
} else {
$error = 'Invalid credentials!';
}
}
2 changes: 1 addition & 1 deletion ...acks/activities/defaced-website/README.md → ...-attacks/drills/defaced-website/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,4 @@ The final payload in POST data is:

`username=QNKCDZO&password=&submit=Login`

Exploit in `../sol/solution.sh`.
Exploit in `../solution/solution.sh`.
0 ...ties/defaced-website/deploy/.dockerignore → ...ills/defaced-website/deploy/.dockerignore
View file
Open in desktop
File renamed without changes.
0 ...ivities/defaced-website/deploy/Dockerfile → .../drills/defaced-website/deploy/Dockerfile
View file
Open in desktop
File renamed without changes.
0 ...ctivities/defaced-website/deploy/Makefile → ...ks/drills/defaced-website/deploy/Makefile
View file
Open in desktop
File renamed without changes.
0 ...c-attacks/activities/defaced-website/flag → ...xotic-attacks/drills/defaced-website/flag
View file
Open in desktop
File renamed without changes.
0 ...ctivities/defaced-website/sol/solution.sh → ...ills/defaced-website/solution/solution.sh
100755 → 100644
View file
Open in desktop
File renamed without changes.
0 ...ities/defaced-website/src/img/defaced.png → ...rills/defaced-website/src/img/defaced.png
View file
Open in desktop
File renamed without changes
106 changes: 53 additions & 53 deletions ...es/defaced-website/src/index-template.php → ...ls/defaced-website/src/index-template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,53 +1,53 @@
<?php
$flag = '__TEMPLATE__';
$sec_pass = '0e413229387827631581229643338212';
$error = '';
$message = '';
if (isset($_POST['username']) && isset($_POST['password'])) {
if (md5($_POST['password'] . $_POST['username']) == $sec_pass) {
$message = $flag;
} else {
$error = 'You will never get your site back, haha!';
}
}
?>
<html>
<head>
<title></title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
</head>
<body>
<section>
<div class="card mt-5" style="width: 28rem; margin: auto;">
<div class="card-body">
<img src="img/d3f4c3d.png" style="height:1px;" />
<h1 class="mb-4">Defaced website :(</h1>
<?php if ($error != ''): ?>
<div class="alert alert-danger" role="alert">
<?php echo $error; ?>
</div>
<?php endif; ?>
<form method="POST">
<div class="form-group">
<label for="username">Username</label>
<input type="text" name="username" class="form-control" id="username">
</div>
<div class="form-group">
<label for="password">Password</label>
<input type="password" name="password" class="form-control" id="password">
</div>
<input type="submit" class="btn btn-primary" name="submit" value="Login" />
</form>
</div>
</div>
</section>
<?php if ($message != ''): ?>
<div class="alert alert-info mt-5 text-center" role="alert">
<?php echo $message; ?>
</div>
<?php endif; ?>
</body>
</html>
<?php

$flag = '__TEMPLATE__';
$sec_pass = '0e413229387827631581229643338212';
$error = '';
$message = '';

if (isset($_POST['username']) && isset($_POST['password'])) {
if (md5($_POST['password'] . $_POST['username']) == $sec_pass) {
$message = $flag;
} else {
$error = 'You will never get your site back, haha!';
}
}
?>

<html>
<head>
<title></title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css">
</head>
<body>
<section>
<div class="card mt-5" style="width: 28rem; margin: auto;">
<div class="card-body">
<img src="img/d3f4c3d.png" style="height:1px;" />
<h1 class="mb-4">Defaced website :(</h1>
<?php if ($error != ''): ?>
<div class="alert alert-danger" role="alert">
<?php echo $error; ?>
</div>
<?php endif; ?>
<form method="POST">
<div class="form-group">
<label for="username">Username</label>
<input type="text" name="username" class="form-control" id="username">
</div>
<div class="form-group">
<label for="password">Password</label>
<input type="password" name="password" class="form-control" id="password">
</div>
<input type="submit" class="btn btn-primary" name="submit" value="Login" />
</form>
</div>
</div>
</section>
<?php if ($message != ''): ?>
<div class="alert alert-info mt-5 text-center" role="alert">
<?php echo $message; ?>
</div>
<?php endif; ?>
</body>
</html>
8 changes: 5 additions & 3 deletions ...c-attacks/activities/handy-tool/README.md → ...xotic-attacks/drills/handy-tool/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ LFI + PHP Object Injection / PHP Insecure Object Deserialization + RCE
## Exploit

The exploit involves opening a reverse shell. You'll need to:

1. Create an account on [ngrok](https://ngrok.com/) (also confirm your email address).
2. Install `ngrok` on you machine.
3. Forward your 1234 port using: `ngrok tcp 1234`. A ngrok host and IP will be forwarded to your local port.
Expand All @@ -26,8 +27,9 @@ You guessed it, the handy one is **Unserialize**.

After inspecting the source code in the archive, you see what the serialized input object should look like.
It has to be a PHP class with two attributes:
* `$condition` - boolean with the value `true`
* `$prop` - a string you can use for remote code execution on the server

* `$condition` - boolean with the value `true`
* `$prop` - a string you can use for remote code execution on the server

Since the actual output of the command is not shown, only the unserialized string, you should try to create a reverse shell.

Expand Down Expand Up @@ -91,4 +93,4 @@ Now access `/backdoor.php` in the browser and you should have a shell in the `nc

Find the flag file and perform a `cat` on it; it should be in `home/ctf/`: `cat /home/ctf/flag.txt`.

Exploit in `../sol/solution.sh`.
Exploit in `../solution/solution.sh`.
0 ...s/activities/handy-tool/deploy/Dockerfile → ...tacks/drills/handy-tool/deploy/Dockerfile
View file
Open in desktop
File renamed without changes.
0 ...cks/activities/handy-tool/deploy/Makefile → ...attacks/drills/handy-tool/deploy/Makefile
View file
Open in desktop
File renamed without changes.
0 exotic-attacks/activities/handy-tool/flag → ...ity/exotic-attacks/drills/handy-tool/flag
View file
Open in desktop
File renamed without changes.
0 ...-attacks/activities/handy-tool/sol/app.py → ...attacks/drills/handy-tool/solution/app.py
View file
Open in desktop
File renamed without changes.
0 ...tivities/handy-tool/sol/backdoor_name.txt → ...lls/handy-tool/solution/backdoor_name.txt
View file
Open in desktop
File renamed without changes.
0 ...tivities/handy-tool/sol/make_backdoor.php → ...lls/handy-tool/solution/make_backdoor.php
View file
Open in desktop
File renamed without changes.
0 ...cks/activities/handy-tool/sol/solution.sh → ...ks/drills/handy-tool/solution/solution.sh
100755 → 100644
View file
Open in desktop
File renamed without changes.
0 ...tacks/activities/handy-tool/src/index.php → ...c-attacks/drills/handy-tool/src/index.php
View file
Open in desktop
File renamed without changes.
2 changes: 1 addition & 1 deletion ...tacks/activities/jar-of-pickles/README.md → ...c-attacks/drills/jar-of-pickles/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,4 +46,4 @@ Make the request again.
You should have a shell now in the `nc` terminal.
Find the flag file and perform a `cat` on it; it should be in `home/ctf/`: `cat /home/ctf/flag.txt`.

Exploit in `../sol/solution.sh`.
Exploit in `../solution/solution.sh`.
0 ...tivities/jar-of-pickles/deploy/Dockerfile → ...s/drills/jar-of-pickles/deploy/Dockerfile
View file
Open in desktop
File renamed without changes.
0 ...activities/jar-of-pickles/deploy/Makefile → ...cks/drills/jar-of-pickles/deploy/Makefile
View file
Open in desktop
File renamed without changes.
0 ...ic-attacks/activities/jar-of-pickles/flag → ...exotic-attacks/drills/jar-of-pickles/flag
View file
Open in desktop
File renamed without changes.
0 .../activities/jar-of-pickles/sol/payload.py → ...drills/jar-of-pickles/solution/payload.py
View file
Open in desktop
File renamed without changes.
0 ...activities/jar-of-pickles/sol/solution.sh → ...rills/jar-of-pickles/solution/solution.sh
100755 → 100644
View file
Open in desktop
File renamed without changes.
0 ...acks/activities/jar-of-pickles/src/app.py → ...-attacks/drills/jar-of-pickles/src/app.py
View file
Open in desktop
File renamed without changes.
0 ...pickles/src/static/img/jar-of-pickles.jpg → ...pickles/src/static/img/jar-of-pickles.jpg
View file
Open in desktop
File renamed without changes
0 ...s/jar-of-pickles/src/templates/index.html → ...s/jar-of-pickles/src/templates/index.html
View file
Open in desktop
File renamed without changes.
2 changes: 1 addition & 1 deletion ...ttacks/activities/meme-uploader/README.md → ...ic-attacks/drills/meme-uploader/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,4 @@ Now navigate to: `/uploads/5c7dce216dceb5c1a61108e9db9fa835.php`.

The flag should be in the page source (inspect it).

Exploit in `../sol/solution.sh`.
Exploit in `../solution/solution.sh`.
0 ...ctivities/meme-uploader/deploy/Dockerfile → ...ks/drills/meme-uploader/deploy/Dockerfile
View file
Open in desktop
File renamed without changes.
0 .../activities/meme-uploader/deploy/Makefile → ...acks/drills/meme-uploader/deploy/Makefile
View file
Open in desktop
File renamed without changes.
0 exotic-attacks/activities/meme-uploader/flag → .../exotic-attacks/drills/meme-uploader/flag
View file
Open in desktop
File renamed without changes.
0 .../activities/meme-uploader/sol/solution.sh → ...drills/meme-uploader/solution/solution.sh
100755 → 100644
View file
Open in desktop
File renamed without changes.
Loading