Brick by Brick — UMass Cybersecurity CTF

Description

Organizer description was not preserved in the local task files.

English summary: a PHP website exposed internal documentation via robots.txt. Those documents described a file-read endpoint that could be abused with path traversal to read application source code, discover a hidden admin dashboard, and recover both credentials and the flag.

Analysis

The main clue was robots.txt, which pointed to /internal-docs/. One internal document described a file read feature that accepted ?file=.

Reading index.php showed the server prepended /var/www/html/ to the user-controlled filename and only blocked inputs starting with /etc/passwd. Because the application did not canonicalize the path, traversal sequences such as ../ still worked, giving a local file inclusion / arbitrary file read primitive.

Using that primitive on config.php revealed the hidden route /dashboard-admin.php. Reading that file then exposed default credentials administrator / administrator and the same flag constant returned after login.

Solution

1. Request robots.txt and discover /internal-docs/.
2. Read the internal documentation and identify the vulnerable ?file= endpoint.
3. Use traversal to read index.php and confirm weak blacklist-based filtering.
4. Read config.php to recover the hidden admin dashboard path.
5. Read dashboard-admin.php to obtain the default credentials and the flag constant.
6. Log in with administrator / administrator and retrieve the flag from the dashboard.

...