tudo - GitLite

KO | EN

gitlite — search

#python #react #ai #typescript #android #rust #linux #docker #java #kubernetes #awesome-list #pytorch #security #open-source

tudo

(★ 143)

TUDO — A Vulnerable PHP Web App

파일 탐색기

최종 버전 다운로드 (.zip)

- launch.json
- - import_user.php
  - update_motd.php
  - upload_image.php
- - motd_1.png
  - motd_2.png
  - motd_3.png
- - createpost.php
  - db_connect.php
  - header.php
  - login_footer.php
  - logout.php
  - utils.php
- - style.css
- - .htaccess
  - motd.tpl
- - .htaccess
- - .htaccess
  - autoload.php
- .htaccess
- favicon.ico
- forgotpassword.php
- forgotusername.php
- index.php
- login.php
- profile.php
- resetpassword.php
- - Dockerfile
  - emulate.cron
  - emulate.py
- - Dockerfile
  - xdebug.ini
- init.sql
- debugging.png
- login.png
- - generateTokens.php
  - insecureSeed.py
  - sqli.py
- - xss.py
- - deserialize.py
  - generateSerializedPayload.php
  - imageUpload.py
  - ssti.py
- - auth-1_a.png
  - auth-1_b.png
  - auth-2.png
  - privesc-1_a.png
  - privesc-1_b.png
  - privesc-1_c.png
  - privesc-1_d.png
  - rce-1_a.png
  - rce-1_b.png
  - rce-2.png
  - rce-3_a.png
  - rce-3_b.png
- - copyFrom.py
  - udf.c
  - udf.py
- README.md
.gitignore
docker-compose.yaml
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/bmdyy/tudo

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd tudo

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

$ docker compose up -d

정의된 모든 컨테이너(서버, DB 등)를 한 번에 빌드하고 백그라운드에서 실행합니다.

$ docker compose down

compose 설정 파일에 정의된 서비스들을 대상으로 명령을 실행합니다.

$ docker system prune -f

이 명령어를 터미널에 그대로 입력해 실행하세요.

$ docker logs -f tudo-db

이 명령어를 터미널에 그대로 입력해 실행하세요.

$ docker exec -it tudo-db psql -U postgres tudo

이 명령어를 터미널에 그대로 입력해 실행하세요.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![](https://raw.githubusercontent.com/bmdyy/tudo/main/app/favicon.ico)

# TUDO &mdash; A Vulnerable PHP Web App

## Introduction

**TUDO** is an intentionally vulnerable web application that may be used to prepare for the **OSWE/AWAE** certification exam. Originally created in **March 2021**, many aspects of the challenge stopped working as the years went by, and so a major update was released in **December 2025** to address these. Everything works now, guaranteed!

## Challenge

There are **three steps** to complete the challenge, and multiple ways
to complete each step.

- **Authentication bypass:** Gain access to either `user1` or `user2`'s account (two possible ways).
- **Privilege escalation:** Gain access to the `admin` account (one possible way).
- **Remote code execution:** Find a way to remotely execute arbitrary commands (five possible ways &ndash; three of which were originally intended).

To make the most of **TUDO**, it is recommended to try and find all eight vulnerabilities, and to create a python script which chains three steps for a complete POC (_Hint: this is what they will require you to do on the exam_).

This challenge is intended to be treated like a **white-box penetration test**, so fire up [VS Code](https://github.com/microsoft/vscode), and read.

_Note: There is a cronjob emulating certain admin activity every minute._

_Note: To avoid spoilers, do not look inside the `docker` and `solutions` folders!_

## Credentials

You are provided with credentials for two standard users, as well as the administrator. _Remember, there are two possible authentication bypasses, so knowing these credentials is not necessary to "solve" TUDO. It does help to know which users exist though._

| Type          | Username | Password |
|---------------|----------|----------|
| Standard user | user1    | user1    |
| Standard user | user2    | user2    |
| Administrator | admin    | admin    |

## How to begin?

Clone the repository, and use [Docker Compose](https://docs.docker.com/compose/install/linux/) to launch the challenge:

```console
$ git clone https://github.com/bmdyy/tudo.git
$ cd tudo
$ docker compose up -d
```

The target will be accessible at [http://localhost:8000](http://localhost:8000).

![](https://raw.githubusercontent.com/bmdyy/tudo/main/screenshots/login.png)

To stop the challenge, run:

```console
$ docker compose down
```

If you need to reset the challenge, run this while the containers are down:

```console
$ docker system prune -f
```

_Good luck!_

### PHP remote debugging

The challenge is already set up for remote debugging using [Xdebug](https://xdebug.org/) and [VS Code](https://code.visualstudio.com/). Assuming you opened the **root folder** in Code and not **app**, simply hit `[F5]` to start debugging.

![](https://raw.githubusercontent.com/bmdyy/tudo/main/screenshots/debugging.png)

_Note: If for some reason your host machine's Docker IP is **not** `172.17.0.1`, make sure to update `hostname` in `.vscode/launch.json`_

### Viewing PostgreSQL query log

All PgSQL queries are automatically written to the database container's log file. To view it, run the following command:

```console
$ docker logs -f tudo-db
```

### Interacting with the database

You can interact with the PostgreSQL database via `psql` with the following command:

```console
$ docker exec -it tudo-db psql -U postgres tudo
psql (18.1 (Debian 18.1-1.pgdg13+2))
Type "help" for help.

tudo=# \dt
             List of tables
 Schema |    Name     | Type  |  Owner   
--------+-------------+-------+----------
 public | class_posts | table | postgres
 public | motd_images | table | postgres
 public | tokens      | table | postgres
 public | users       | table | postgres
(4 rows)
```

## Solutions

There are POCs and explanations for all the various ways to solve **TUDO** in [solutions](solutions/).