CTF based around CVE-2016-10033# CTF_CVE-2016-10033
CTF based around CVE-2016-10033\
By: Evan Brooks\
Ohio University CS4900
## Description
You are the founder of a new email service called Bobcats Send Mail Over the Internet™. You hoped to make a lot of money from this product, but no one wants to use your mailing service. After doing tons of research you found that the reason is customers prefer using a service called Vulnerable Mail Form™. Vulnerable Mail Form has a minimalistic, easy-to-understand design. You have a plan to get customers using your mail service: disable the competetor's website and embarrass them in the process.
## Setup
This CTF utilizes a docker image from docker user *Vulnerables*. The image provides a site that utilizes a vulnerable version of PHPMailer, which will be run on localhost:8080. Follow the instructions [here](https://hub.docker.com/r/vulnerables/cve-2016-7434) to get the image setup.
## Goals
-Disable the competing mail service running on localhost:8080 using the vulnerability revealed in CVE-2016-10033\
-Leave a message to embarrass your adversaries\
\
Show your localhost:8080 to one of the CTF staff when complete.
## Solution
My solution to this CTF, *deface.sh*, is given in the repository. This shell script begins by choosing a base64 decoder, then begins the exploit. The script creates a backdoor, *backdoor.php*, in the target system. It then connects to this backdoor and replaces the form on the site with the word "Defaced". This prevents the site from being used any more.
登录后查看神龙缓存的 POC 文件快照
登录查看