Infinity Shell

Challenge 25: Cipher’s legion of bots has exploited a known vulnerability in our web application, leaving behind a dangerous web shell implant. Investigate the breach and trace the attacker's footsteps!

Solution

1. Since we know this is a webshell. So it is better to start from server logs.
   

2. Check both error and access logs.

3. By intuition I figured image.php seems a better starting point, so I searched the endpoint and found several base64 encoded texts.
   

4. On decoding that text we found the solution to this challenge.