BioCorp CTF

Hello, everyone! I hope you’re doing great. This article is a write-up of the BioCorp Challenge from the Intigriti CTF 2024. Let’s dive right in!

BioCorp reached out with concerns about the security of their network. Specifically, they wanted to ensure that any dangerous functionality was properly decoupled from their public-facing website. Our task was to review their system and report any vulnerabilities.

I began my investigation by navigating through the website like a normal user, checking out pages such as About, Contact, and Services. The Contact page caught my attention as it contained a feedback form (see the screenshot below).

After exploring the frontend, I turned my attention to the source code, which was provided as a ZIP file.

In the source code, I noticed a PHP file named panel.php that wasn’t linked anywhere on the website. While the public-facing pages included About, Services, and Contact, this file seemed hidden.

Here’s the first snippet of code from panel.php that caught my attention: