gnh1201/Vulnerable-Web-Application
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Ufuk Süngü 2018-11-30 23:39:41 +03:00 committed by GitHub
parent 1791c1e415
commit 65159ba034
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 53 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
CommandExecution/CommandExec-4.php Normal file
View File

@ -0,0 +1,53 @@
<html>
<head>
<link rel="shortcut icon" href="../Resources/hmbct.png" />
<title>CommandExec-4</title>
</head>
<body>
<div style="background-color:#afafaf;padding:15px;border-radius:20px 20px 0px 0px">
<button type="button" name="homeButton" onclick="location.href='../homepage.html';">Home Page</button>
<button type="button" name="mainButton" onclick="location.href='commandexec.html';">Main Page</button>
</div>
<div style="background-color:#c9c9c9;padding:20px;">
<h1 align="center">Browse The Files!</h1>
<form align="center" action="CommandExec-4.php" method="$_GET">
<input type="text" name="typeBox" value=""><br>
<input type="submit" value="Submit">
</form>
</div>
<div style="background-color:#ecf2d0;padding:20px;border-radius:0px 0px 20px 20px" align="center">
<?php
if(!file_exists(".hidden")){
mkdir(".hidden");
exec("echo \"flag:secret\" > .hidden/log4.txt");
if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'){
exec("attrib +h .hidden");
}
}
if(isset($_GET["typeBox"])){
$target =$_GET["typeBox"];
$substitutions = array(
'&&'=>'',
'& ' => '',
'&& ' => '',
';' => '',
'|' => '',
'-' => '',
'$' => '',
'(' => '',
')' => '',
'`' => '',
'||' => '',
'/' => '',
'\\' => '',
);
$target = str_replace(array_keys($substitutions),$substitutions,$target);
echo shell_exec($target);
if($_GET["typeBox"] == "secret")
echo "You really found my secret!";
}
?>
</div>
</body>
</html>