> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/web-exploitation/trickster-medium.md).
# Trickster (Medium)
***
From the nature of this challenge, this is likely going to be a LFI challenge.
**"Local File Inclusion (LFI)** occurs when a web application dynamically loads files based on unsanitized user input. Attackers can exploit this to read system files, configuration data, user credentials, or even gain code execution with PHP filters or log injection."
Additionally you may not know what PHP is.
"PHP is one of the most used languages for back-end web development and therefore it has become a target by hackers. PHP is a language which makes it painful to be secure for most instances, making it every hacker's dream target." PHP is often in lined alongside HTML.
Anyways we can check using a tool called "gobuster".
```
gobuster dir -u http://atlas.picoctf.net:/ -w /usr/share/dirb/wordlists/big.txt
```
This give us a directory to search in, in being finding robots.txt and /uploads.
{% hint style="info" %}
**robots.txt** is a standard file used by websites to communicate with web crawlers (like search engines). In CTF challenges, it tells us which part of the website they shouldn't crawl.
User-agent: \*\
Disallow: /admin/\
Disallow: /secret/
{% endhint %}
From here, I tried to Burp Suite to find any more clues, but it resulted in nothing. I then tried creating a file using a PHP web shell since its commonly associated with LFI challenges.
{% hint style="info" %}
A **web shell** is a script that provides remote access and control over a web server through a web browser. Think of it as a command-line interface accessible via HTTP/HTTPS.
{% endhint %}
***
The extra little factor we need to consider is to make our file resemble of a PNG. We need to alter the magic bytes whether in Hex Editor or somewhere else. Sometimes you need to manually edit the hex with it, but for this scenario, since the file checks only 3 bytes of the word PNG, we can just type PNG at the top of the file. Once we insert the file, we can finally get remote access. (I called the file I created "injection")
You can find all type of scripts here I used:
{% embed url="" %}
```
http://atlas.picoctf.net:55652/uploads/injection.png.php
```
And by using some the find command "**find / -name “\*.txt".** This searches all the way from the root directory. If you did like "find . -name "\*.txt", you would find the same but in your current directory.