search

Vuln-Code 2 {php}

Code is from a ctf {link below}

Code

<?php
    if(isset($_GET['resource'])){
        include($_GET['resource'] . '.php');
    } else {
        header("Location: /index.php?resource=main_page");
    }
?>

This code is taken from the ctfarrow-up-right: Leaky

hashtag
Vulnerability

The code is vulnerable to RCE via php filters.There is a whole research on these that how they can give RCE , tib3riusarrow-up-right explains really well. The catch in the vulnerability lies that we can write arbitrary code in the files. To do that we need to give the filters in a specific sequence for each character to be written. We have a script provided by synacktivarrow-up-right. So we go to generate the payload with the help of the script and add the payload to the url like this

copy the whole from php://

the url:

which gives us:

But we don’t need to overkill , we can get the file contents via encoding them to base64:

via another wrapper:

php://filter/convert.base64-encode/resource=main_page

we also get the flag:

PreviousVuln-Code 1 {JS}NextVuln-Code 3 {Python}

Last updated