ExtBasic 10

I'm probably the only one who got stuck on this mission, but could I get some hints please? I tried using the exec(''); command and some other commands but I'm getting nowhere.

I am also having issues with this mission. I've tryed a few PHP functions, like exec, and exec_shell. But nothing is seaming to work. I have a feeling though the solution has something to do with using eval to our advantages, I'm just unsure how to make it do what I want it to do, and no silverlining you are not the only one that is stuck.

PatTheGamer wrote:I am also having issues with this mission. I've tryed a few PHP functions, like exec, and exec_shell. But nothing is seaming to work. I have a feeling though the solution has something to do with using eval to our advantages, I'm just unsure how to make it do what I want it to do, and no silverlining you are not the only one that is stuck.

Exactly what I've tried. I also tried system() since it's basically the same as exec(), no luck. I know what eval does, but don't have much experience with it. It's setting $getit to $y. It looks like $y is what you type in the box. $getit is "htsf", there I'm stuck. Don't know how that relates to shells or this challenge.

yeah I googled htsf and I didn't find anything related to shells or programing. I think the challenge is to get the exec() to execute after the htsf is executed but I have no idea how to go about doing that.

I, too, am stuck on this... I would really appreciate a hint on how the input should be submitted. Are we supposed to set arg as a PHP variable ($_GET[arg]=...) or as a GET argument (?arg=...) or how are we supposed to submit this??

It would really help me focus on the argument in stead of trying different syntaxes xD

its more about showing the folders index.
(jumping to that location...)

by **Aesmade** on Thu Jul 03, 2008 2:34 am ([msg=6422]see Re: ExtBasic 10[/msg])

I-MrKnox-I wrote:I, too, am stuck on this... I would really appreciate a hint on how the input should be submitted. Are we supposed to set arg as a PHP variable ($_GET[arg]=...) or as a GET argument (?arg=...) or how are we supposed to submit this??

It would really help me focus on the argument in stead of trying different syntaxes xD

Well, the submit button has to be there for a reason =P I haven't completed it, but just like all the other extbasics, I suppose that the $_GET['arg'] is what you submit.

_cypher_ wrote:its more about showing the folders index.
(jumping to that location...)

I don't understand what you mean by that...
And since eval("\$getit = \$y;"); is eval'd to $getit = $y; and the rest of the script is just assigning variables, I don't see how it could be exploited...

I've looked at it for a while, and I don't see anyway possible to exploit it. Has anyone actually been able to complete this mission?

First $getit is set to an initial value;
Then $y is set to $_GET['arg']
then eval evaluates a string as php code... so eval("\$getit = \$y;") is the same as $getit = $y;

so the vulnerability is at $y = $_GET['arg']... i just dont know the code to get it working

and i dont find the explanation of the problem enough... am i looking for the php code a uri or what???