HackThisSite - Realistic Mission 9

Posted on In Views: Disqus:

Challenge

Pay employee r-conner and remove the evidence from CrappySoft's logs.

Solution

1. Log in as the employee

The challenge provides:

1
2
Username: r-conner@crappysoft.com
Password: ilovemywork

The login response sets the employee cookies. The employee page exposes a Private Message link and Pay Salaries link, but the latter requires administrator privileges.

2. Use the simulated XSS step

Send a JavaScript payload to m-crap through Private Messages. The challenge explicitly supplies the simulated administrator cookie afterward:

1
2
3
strUsername=m-crap%40crappysoft.com
strPassword=94a35a3b7befff5eb2a8415af04aa16c
intID=1

Replace the three challenge cookies with these values. Then open payday.php and submit the Pay form. The server displayed the employee's thank-you message and marked the payment transaction complete.

3. Clear the logs

The mailing-list form contains:

1
2
3
4
5
<input
  type="hidden"
  name="strFilename"
  value="./files/mailinglist/addresses.txt"
/>

The log is publicly listed at ./files/logs/logs.txt. Submit the mailing form with the hidden path changed to:

1
./files/logs/logs.txt

Use an address without @ so the cleanup logic removes it.