[Keeper]

I've took aside some time to put up something rather different into this section and get some PHP-based challenges to your attention. So far there are eight of them. Each challenge has a brief description as to how to go about exploiting the script supplied. Post a PoC if eager and PM me the solutions individually. The following topics have been covered:

• Directory Traversal & Null byte Injection
  ~ http://keeperax.netai.net/Antagonism/DirTra.php ~ 5 points
  - Look at the given code here. You want to execute the code block as if you were in fact logged in. You can't control the $user object directly and thus you can't get to the code that includes admin.php file. But you have control over the $page variable, via the GET-parameter p. In the code ".html" is concatenated to the filename and we can effectively stop that with the null byte (depending on the server settings though, so don't expect a 100% success rate with this kind of an attack). The admin.php file is located one directory before the folder 'pages'.
  
• PHP Register Globals Exploitation
  ~ http://keeperax.netai.net/Antagonism/PRG.php ~ 10 points
  - Again, let's view the code. If the user provides correct credentials, the $loggedIn variable is set to true; further if the user has administrator privileges, the $priv variable is set to 1. Later then those values are checked and depending on their values, the program flow is determined. Naturally we are aiming for administrative account. Let's now apply our knowledge about register globals to this level.
  
• Unsafe Usage of Extract Function
  ~ http://keeperax.netai.net/Antagonism/Extract.php ~ 10 points
  - It is a good idea to always initialize the variables, like $pass_file here. It is not a good idea though to initialize them just before "extract($_REQUEST);". What extract() basically does, is it reads the keys and values from an array and creates variables corresponding to them. Overwrite the pass_file argument in such a way that you don't need to supply a value for the $pass variable. Use the string value 'foobar' where needed.
  
• PHP Object Injection (unserialize())
  ~ http://keeperax.netai.net/Antagonism/Objectz.php ~ 15 points
  - Perform a code injection by supplying a crafted string of the serialized object from the below script in order to obtain the IP address of the server. Refer to the docs ~ http://php.net/manual/en/function.serialize.php in case of experiencing any difficulty. Encode the serialized object in Base64 due to stupid SPAM filters.
  
• Server Side Includes Injection
  ~ http://keeperax.netai.net/Antagonism/SSI.php ~ 10 points
  In order to pass this challenge you need to know the basics of SSI. For the sake of this one, include the file named "a77.txt" located in the directory of "scripts". Finally, encode the payload in Base64 due to SPAM filters again..
  
• Cross-site Scripting Filter Evasion
  ~ http://keeperax.netai.net/Antagonism/XSS.php ~ 5 points
  - This is a simple filter evasion challenge. Pop-up your name in a Javascript window. A piece of the filtration has been give to you.
  
• Basic Cryptography Sequence
  ~ http://keeperax.netai.net/Antagonism/Cryptography.php ~ 5 points
  - A basic cryptography sequence that needs to get decoded. No custom shit, no tricks. Testing the ability to identify public encodings.
  
• PHP-based Obfuscation Challenge
  ~ http://keeperax.netai.net/Antagonism/Obfuscation.php ~ 10 points
  - Deobfuscate the following PHP-based code. Input the final result in the form below.
  

A total of 70 points is for all of them completed. According to that:

• 5 points ~ 7% success rate
  
• 10 points ~ 14% success rate
  
• 15 points ~ 21% success rate
  
• 20 points ~ 28% success rate
  
• 25 points ~ 35% success rate
  
• 30 points ~ 42% success rate
  
• 35 points ~ 50% success rate
  
• 40 points ~ 57% success rate
  
• 45 points ~ 64% success rate
  
• 50 points ~ 71% success rate
  
• 55 points ~ 78% success rate
  
• 60 points ~ 85% success rate
  
• 65 points ~ 92% success rate
  
• 70 points ~ 100% success rate
  

Let's see who will get 'em first.

-- Ranking:

• -๖ۣۜDivine-
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• Phizo
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• ankr-
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• bckslsh.
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• cheatson
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• Pendragon
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• Ergo
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• vεxү
  - Points: 70
  - Success Rate: 100%
  - Solved: All of them
  
• Deso
  - Points: 55
  - Success Rate: 78%
  - Solved: Basic Cryptography Sequence, PHP-based Obfuscation, Directory Traversal & Null byte Injection, Cross-site Scripting Filter Evasion, PHP Register Globals Exploitation, Server-side Includes Injection, Unsafe Usage of Extract Function
  
• ryuk`
  - Points: 55
  - Success Rate: 78%
  - Solved: Directory Traversal & Null byte Injection, PHP Register Globals Exploitation, Unsafe Usage of Extract Function, Server-side Includes Injection, Cross-site Scripting Filter Evasion, Basic Cryptography Sequence, PHP-based Obfuscation
  
• KoVex
  - Points: 50
  - Success Rate: 71%
  - Solved: Directory Traversal & Null byte Injection, Cross-site Scripting Filter Evasion, PHP-based Obfuscation, Basic Cryptography Sequence, Server-side Includes Injection, PHP Object Injection
  
• MrCathal09
  - Points: 50
  - Success Rate: 71%
  - Solved: Cross-site Scripting Filter Evasion, Directory Traversal & Null byte Injection, Server-side Includes Injection, Basic Cryptography Sequence, PHP-based Obfuscation, PHP Object Injection
  
• PuzzuS
  - Points: 25
  - Success Rate: 35%
  - Solved: Server-side Includes Injection, Cross-site Scripting Filter Evasion, Directory Traversal & Null byte Injection, Basic Cryptography Sequence
  
• VipVince
  - Points: 25
  - Success Rate: 35%
  - Solved: Server-side Includes, Cross-site Scripting Filter Evasion, Basic Cryptography Sequence, Directory Traversal & Null byte Injection
  
• John4782
  - Points: 20
  - Success Rate: 28%
  - Solved: Directory Traversal & Null byte Injection, PHP Register Globals Exploitation, Cross-site Scripting Filter Evasion
  
• Agent Raigar
  - Points: 15
  - Success Rate: 21%
  - Solved: Directory Traversal & Null byte Injection, Server-side Includes Injection
  
• crossera
  - Points: 15
  - Success Rate: 21%
  - Solved: Cross-site Scripting Filter Evasion, Server-side Includes Injection, Directory Traversal & Null byte Injection
  
• Pillows
  - Points: 5
  - Success Rate: 7%
  - Solved: Basic Cryptography Sequence
  
• vehla
  - Points: 5
  - Success Rate: 7%
  - Solved: Cross-site Scripting Filter Evasion
  
• Lambasoft
  - Points: 5
  - Success Rate: 7%
  - Solved: Directory Traversal & Null byte Injection
  
• -
  - Points: ...
  - Success Rate: ...
  - Solved: ...
  
• ...
  

Good luck to those who participate and please do not disclose any solutions.

[log dot zip]

Keeper never fails to deliver fun and challenging stuff. I'll try, keep up the good work! =3

[shellfu]

Great Challenges! Good luck to anybody trying them out!

[Suit®]

This is beautiful. Great work man! I'm already digging into this

[Keeper]

We got the first solver of some of them. Thread updated.

[Agent Raigar]

Great challenges. Going to try these ASAP

[Keeper]

Updated with four more and resulting in total of eight. Points & success rate altered as well.

[-๖ۣۜDivine-]

Nice challenges Keeper. Thanks, was fun.
Can you put 'Success Rate' in some gay color like this?

[cheatson]

Looks good, gonna give these a try later

[-๖ۣۜDivine-]

Looks good, gonna give these a try later

Good guy Cheatson. Doesn't do it yet, but posts so the thread doesn't die. You would be surprised at how many views it already got lol.

[Pendragon]

Would love to try this out, but the website doesn't seem to be loading for me.

Spoiler (Click to View)

[-๖ۣۜDivine-]

Would love to try this out, but the website doesn't seem to be loading for me.

Spoiler (Click to View)

It loads fine for me and the others. It's just you mate.

[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

Like that (For the XSS), Or do we actually make an alert box? I'm tired atm so

[-๖ۣۜDivine-]

Like that (For the XSS), Or do we actually make an alert box? I'm tired atm so

Does the php source he provided mean nothing to you? That's the easiest thing he put in this thread.

[Pendragon]

It loads fine for me and the others. It's just you mate.

DONT U PULL THAT "MATE" ON ME MR. I KNOW YOU'RE NOT AUSTRALIAN YOU DIRTY SERBIAN.