PHDays HackBattle: ломаем один на один

Positive Hack Days VII HackBattle. PHDays , , , HackBattle, . , , , .

, , , , , .

, CTF, 25 . 9 , . , .

, . , . , , , , HackBattle, 97 !

, , . “vos” “Beched” .



, PHDays. - , :



. :



: -, , -. root bash-. . , , , .

, , ! www.phdays.com/broadcast/, 24 , part 2 mix stream 2:00:00. , , .



“vos” ! , HackBattle.

“vos” :

« - , . . , :)

, -2 — ».

“Beched” :

« — RuCTF. . — , — , (10–30 ). , .

HackBattle , .
— , . — . Rapid Fire ForAllSecure».

:

OVA:

http://static.ptsecurity.com/phdays/2017/hackbattle/creds.txt —
static.ptsecurity.com/phdays/2017/hackbattle/1.ova
static.ptsecurity.com/phdays/2017/hackbattle/2.ova
static.ptsecurity.com/phdays/2017/hackbattle/3.ova
static.ptsecurity.com/phdays/2017/hackbattle/4.ova
static.ptsecurity.com/phdays/2017/hackbattle/5.ova
static.ptsecurity.com/phdays/2017/hackbattle/6.ova
static.ptsecurity.com/phdays/2017/hackbattle/7.ova
static.ptsecurity.com/phdays/2017/hackbattle/8.ova
static.ptsecurity.com/phdays/2017/hackbattle/9.ova
static.ptsecurity.com/phdays/2017/hackbattle/FINAL.ova

. (№ 3 ), 100 , . , , .

№ 3

- «User 1, you have been successfully logged in.»:


«My profile» User 1:


Flag , .

«/profile/1», «/profile/2», User 2:



, , , IDOR-. 100 id Burp Intruder:







id 72 Length, :



! .

: , , , Positive Technologies