---
# System prepended metadata

title: CTF Range-113
tags: [file upload, CVE-2021-4034, linux, CPENT]

---

# CTF Range-113
## Challenge 113
## Challenge 114
![image](https://hackmd.io/_uploads/SJOHGzgcxl.png)


* Rustscan
    * ![image](https://hackmd.io/_uploads/rJfBNzl5xg.png)
* Nmap
    * ![image](https://hackmd.io/_uploads/Bk2SVGe5ee.png)

* Website
    * ![image](https://hackmd.io/_uploads/BJ4aVGg5gx.png)

* Admin login page
    * ![image](https://hackmd.io/_uploads/rkTzSzl9xg.png)

* Error infomation in a1.php
    * ![image](https://hackmd.io/_uploads/r16pUzl5le.png)

* And found a db file but it need password
    * ![image](https://hackmd.io/_uploads/rk3GPfx9xl.png)

* Another error message
    * ![image](https://hackmd.io/_uploads/HyLfdMgcgl.png)

* This CMS has RCE vulnerable
    * https://www.exploit-db.com/exploits/47881
    * ![image](https://hackmd.io/_uploads/SyvCwQlqxe.png)

* PwnKit
    * ![image](https://hackmd.io/_uploads/HJ48tNx9gx.png)

* flag
    * ![image](https://hackmd.io/_uploads/H1FuYElqge.png)


## Answer
* Challenge 113:`014891b2`
* Challenge 114:`215f83bf`


