File Inclusion-LFI and File Uploads

HTB Content Academy
1

I can’t find the flag, please help me.

2

Have you gotten RCE on the machine?

3

Yes

4

Have you listed the / directory with ls?

Take care when assuming every flag will be named flag.txt, I totally spent 20 minutes the other day in the same situation.

5

I listed all the directories, but I didn’t find flag.txt

6

@GPS, Take note of what I said and try listing the / directory again. Look for something that doesn’t belong.

Feel free to DM me and I will help you further.
-onthesauce

1 Like
7

I listed the / directory using ls / command, am not able to get your hint- Look for something that doesn’t belong. Am able to see a file named GIF82f40d853e2d4768d87da1c81772bae0a.txt in / directory… I used cat GIF82f40d853e2d4768d87da1c81772bae0a.txt to read the contents, but am not able to… please help me further

8

It sounds like you are attaching the magic bytes to the file name. Remove the GIF8:
cat 2f40d853e2d4768d87da1c81772bae0a.txt

1 Like
9

I did try thi sway,but I could see only GIF8 when I cat 2f40d853e2d4768d87da1c81772bae0a.txt, there is no flag

1 Like
10

Thanks for the hint… was missing / infront of txt file… Hence solved the entire module…

1 Like
11

Nice, glad you got it! Just take that pic off though because it contains the flag!!!
-onthesauce

1 Like