[OSCP] PHP Wrappers

1. Exploit the Local File Inclusion vulnerability on WEB18 (VM #1) by using the php://filter with base64 encoding to include the contents of the /var/www/html/backup.php file with Burp or curl. Copy the output, decode it, and find the flag.
   -->OS{4d59cd004b853a37683343a5c4399bb3}
2. Follow the steps above and use the data:// PHP Wrapper in combination with the URL encoded PHP snippet we used in this section to execute the uname -a command on WEB18 (VM #1). Enter the Linux kernel version as answer.
   -->5.4.0-137-generic

인코딩 되지 않은 page를 보기위해 php://filter를 사용, php 코드가 LFI 취약성을 통해 포함되고 실행

 

2번문제