Clicking on the Go to this challenge button, I was redirected to the following page:
Challenge Page
As we can see and infer from the URL http://challenges.ringzer0ctf.com:10075/?page=lorem.php, we can likely achieve an LFI by changing the page parameter. Since the title of the challenge is “Looking For Password File”, I assume we need to read the contents of /etc/passwd (the password file). Let’s move on to the exploitation phase.
🔬 Vulnerability Analysis
Potential Vulnerabilities
LFI (Local File Inclusion)
🎯 Solution Path
Exploitation Steps
Exploitation
As expected, the exploitation phase is simply changing the page parameter’s path to /etc/passwd, resulting in the complete URL: http://challenges.ringzer0ctf.com:10075/?page=/etc/passwd. By visiting the page, the contents of the /etc/passwd file are displayed, and the flag is inside it.
