<-- back

UMassCTF '21 Hermit 1 WriteUp

hermit logo


There is only one form that accepts a file.

The validation of the file is based on extension so we can try and upload shell.php.jpg image with content like this:


When image is uploaded we see the page like this:

hermit logo

Click on See image and we see a blank page with some strange PHP errors. It’s because our “image” expects get param called “0” so let’s add one.

and we can see list of directories in the project root.

hermit logo

Now it’s time to search for flag. Let’s check home directory like this: /home

we see there is only one folder hermit

Let’s check that folder: /home/hermit - and there is flag folder now. /home/hermit/flag - shows us userflag.txt /home/hermit/flag/userflag.txt - shows us the flag

hermit logo

Feel free to contact me for feedback or questions. Find my contacts on About page.