Bugku login2

Entering the environment is a login page

  Come in and try the universal password first , Weak password , Directory explosion has no result

see wp Is to grab the bag

  In the response header tip Tips ,base64 Decode the source code

  Get the source code

  Show if the password equals its md5 Value should be able to login successfully

Here use union select Insert password md5 Value bypass

' union select 1,md5(123)#&password=123

After entering, there is a process monitoring system. According to the topic prompt, here should be the command execution

 127.0.0.1|ls / No echo

Input 127.0.0.1|sleep 5 A delay indicates that the command was executed , But the output may be filtered

We make use of > Save the output results to a file to view

127.0.0.1|ls />1.php

  Then check it out flag

127.0.0.1|cat /flag>1.php