HTS Realistic Mission 12 Solution

Perl Script Injection

Collecting Information

Global structure

The first thing we have to do is to get as much information as we can about this portal. We immediately notice that the portal is based on a frameset with:

internet.pl: controller
page.pl?page=<something>: page that is called from the controller

Read files

In addition, by clicking on student work > Joey Simons > Sign my guestbook, we see a form. Here is the source code

Message:

</form>

</body></html>

We notice that:

form action is “../cgi-bin/guest.pl”, a perl script inside cgi-bin/
there is a hidden field named action, which value is “write”. We suppose that it exists a value “read” to read files.

Access hard drive

The main controller (internet.pl) is not protected. Indeed, it is possible to request the hard drive content by injecting “file://” instead of “http://”. We discover a new form, named “heartlandadminpanel.html” in C:\WEB\HTML:

Here is what it looks like (http://www.hackthissite.org/missions/realistic/12/heartlandadminpanel.html)

By viewing the source code of this page, we notice that the form action is

cgi-bin/heartlandadminpanel.pl

Our first mission is to find valid credential to access the protected content.

Step 1: Find valid credential

Using our *fake* file editor, we are going to view the content of cgi-bin/heartlandadminpanel.pl file. To do so, we are going to enter this address in our URL bar:

http://www.hackthissite.org/missions/realistic/12/cgi-bin/guest.pl?action=read&file=heartlandadminpanel.pl

action=read is our supposition, since there is a “write” method, “read” is likely to work
file=heartlandadminpanel.pl: we are going to suppose that there is a “file” parameter. Since the guest.pl script is already hosted in the cgi-bin/ directory, we can directly request heartlandadminpanel.pl file

Here is what it produces: