# CSAW CTF 2016 mfw Writeup
mfw was a web challenge that included one flag for 125 points.
When launching the mfw web site at web.chal.csaw.io:8000 was introduced by the phrases 
```Welcome to my website!I wrote it myself from scratch!``` 
and this is how it basically looked like: A navigation pane with three links to `Home`, `About` and `Contact`. While Home and Contact did not show something interesting, the About page revealed some nice information as he wrote: 
```I wrote this website all by myself in under a week!I used Git, PHP and Bootstrap ```
Next to this it was easy to see that the developer created a common templating system based on the GET parameter `page` as all URL looked like the following:
```http://web.chal.csaw.io:8000/?page={home,about,contact}```
Further investigation of the source code revealed that formerly there seemed to be a fourth link within the navigation pane:
``` Home About Contact  ```
For sure, the most obvious and therefore first try was to use a local file inclusion to get the output of /etc/passwd or the flag.php file but the following answer was returned:
```http://web.chal.csaw.io:8000/?page=../../../../../etc/passwd
Detected hacking attempt!```
Some more tests with different payloads and encodings lead to the fact that the code somehow detects two points, so a simple directory traversal was not possible. After some tries I found out the the flag.php file was lying within a folder called `templates`, but the inclusion of the file did not show any further information so my guess was that the flag is saved within a PHP variable of the file. 
Following the hint from the `About` page I tried to see whether the developer forgot to exclude the `.git` directory from the web server and voila: a directory listing showing the default content of a .git folder was found:
```branches  description  hooks  info  objects      refsconfig    HEAD         index  logs  packed-refs```
Now I cloned the git repository and used `git diff` which revealed the source code of the index.php file as follows:
```
```