corydolphin · February 24, 2012 19:11
diff --git a/Stripe CTF level03 solution b/Stripe CTF level03 solution
 See the source of level02.php, the usage of cookies is unsafe as the content is not validated, but merely evaluated.
 Substituting an arbitrary file path for the randomly generated path allows you to access files with the permissions of the user running PHP, i.e. level03:

 Alter the cookie content to:"../../home/level03/.password"

 password: Or0m4UX***
 (password redacted so as to not ruin the game for anyone :-) ).
	See the source of level02.php, the usage of cookies is unsafe as the content is not validated, but merely evaluated.
	Substituting an arbitrary file path for the randomly generated path allows you to access files with the permissions of the user running PHP, i.e. level03:

	Alter the cookie content to:"../../home/level03/.password"

	password: Or0m4UX***
	(password redacted so as to not ruin the game for anyone :-) ).