# Web Range-126-127
## Challenge 126
## Challenge 127

* Nmap
* 

* 主要就這表單
* 

* 有gitleak, 載下來研究發現幾個php, 先看到上傳路徑
* 
* 

* 看來就限定application type而已, 傳個phphinfo試試
* 
* 

* 附檔名前端就有過濾了
* 
*
* 繞過前端就行
* 
* 
* 

* 上webshell
* 
* 

* Got shell as www-data
* 

* Found DB credentials
* 

* 
* `myvalue:#D@yZer0UnhackUserMYVALUE`

* `find` has SUID permission
* 

* 
* 

## Answer
* Challenge 126:`customerrequirementdocs`
* Challenge 127:`H2W34DLpbv`

## Poc

import requests, argparse

if __name__ == "__main__"
    parser = argparse.ArgumentParser(description="CPENT Web Range Challenge 126")
    parser.add_argument("-u", "--url", required=True, help="Target.")
    parser.add_argument("-c"), "--command", help="Command to execute. If not use interactive mode it's required."
    parser.add_argument("--path", help="Upload path.", default="/customerrequirementdoc")