CTF based around CVE-2016-10033# CTF_CVE-2016-10033
CTF based around CVE-2016-10033\
By: Evan Brooks\
Ohio University CS4900
## Description
You are the founder of a new email service called Bobcats Send Mail Over the Internet™. You hoped to make a lot of money from this product, but no one wants to use your mailing service. After doing tons of research you found that the reason is customers prefer using a service called Vulnerable Mail Form™. Vulnerable Mail Form has a minimalistic, easy-to-understand design. You have a plan to get customers using your mail service: disable the competetor's website and embarrass them in the process.
## Setup
This CTF utilizes a docker image from docker user *Vulnerables*. The image provides a site that utilizes a vulnerable version of PHPMailer, which will be run on localhost:8080. Follow the instructions [here](https://hub.docker.com/r/vulnerables/cve-2016-7434) to get the image setup.
## Goals
-Disable the competing mail service running on localhost:8080 using the vulnerability revealed in CVE-2016-10033\
-Leave a message to embarrass your adversaries\
\
Show your localhost:8080 to one of the CTF staff when complete.
## Solution
My solution to this CTF, *deface.sh*, is given in the repository. This shell script begins by choosing a base64 decoder, then begins the exploit. The script creates a backdoor, *backdoor.php*, in the target system. It then connects to this backdoor and replaces the form on the site with the word "Defaced". This prevents the site from being used any more.
[4.0K] /data/pocs/72e0a642292beb31f2cfb23ef3e0aac0509bf30d
├── [1.9K] deface.sh
└── [1.5K] README.md
0 directories, 2 files