I continued to play with the vulnhub virtual machine and started the TopHatSec - Freshly.

"The goal of this challenge is to break into the machine via the web and find the secret hidden in a sensitive file. If you can find the secret, send me an email for verification. :)"

I start the LAMPSecurity CTF4 challenge of vulnhub available here. The goal is to get a root shell on the server.

Discovery

First of all we need to determine the IP address of the server. Since we launch it in a bridged virtual machine the local router got the IP …