[xermes]

Greetings, I've ran into this challenge hackme website, however, to dont drag the thread for no reason heres some details :

scoreshell.certifiedsecure.org

If you navigate site properly you'll find robots.txt:

Code

Disallow: /cgi-bin/
Disallow: /log/

So next logical step is to go into

Code

/log/ (since /cgi-bin/ cant be accessed)

Anyway when you navigate to /log/ you get login form page...😯

So i tried to intercept the traffic with proxy, and I got some pretty nice info:
if you examine the resposne i got, I got some information about the system, and bash logs, so I figured using shellshock might work 😵 . Gosh I was wrong, I tried every single shellshock trough user-agent/refferer/cookie, everything I could've think off.

Thank in advance,
Hack the world,
Xermes

[Wordlist]

what exactly are you trying to do?

hsve u tried htaccess shell ?

[Sheeple]

https://hackforums.net/shell.php

[Vellichor]

It's clear shellshock won't work, look at the last time the box has been internally updated. It's listed on the uname.

[xermes]

what exactly are you trying to do?

hsve u tried htaccess shell ?

go and checkout the challenge for yourself.

[necross]

have you managed to get access?

[redlightrouter]

Did you solve this one? Currently struggling with this one aswell.

[jasjar101]

i am also stuck on this one

[lowquality]

Did you solve this one? Currently struggling with this one aswell.

Did you solve it yet?
I've been trying for hours, editing headers, trying to find a shellshock vuln. It doesn't seem like it's shellshock but the challenge just screams netcat shell all-over :|

Let me know, I am anxious to solve this

[NightWidow]

Anybody who has more information about this challenge?

[onlyspam]

Any luck on this one? After 1,5 years I still haven't solved it yet...

[Bulletcatcher007]

Still nothing? Im currently in the same boat and tried for hours to get something going....strange challenge :(