Bruno Bierbaumer 0xbb

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

AMD R9 390X - Linux Support

Tested with Debian Stretch (Linux 4.3), MSI - Radeon R9 390X Gaming 8G

lspci

lspci -v

01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Hawaii XT [Radeon R9 290X] (rev 80) (prog-if 00 [VGA controller])
	Subsystem: Micro-Star International Co., Ltd. [MSI] Hawaii XT [Radeon R9 290X]
	Flags: bus master, fast devsel, latency 0, IRQ 132

GA-Z170-HD3P (rev. 1.0) - Linux Support

Tested with Debian Stretch (Linux 4.3) + Intel Core i5-6600K

Status:

UEFI boot Kernel: works
LAN network: works
Serial ATA: works
CPU Frequency Scaling: works
Sleep / Suspend: works
Xorg: works

	#!/bin/bash

	while true;
	do
	xdotool mousemove_relative --sync -- 1 1
	xdotool mousemove_relative --sync -- -1 -1

	sleep 60
	done

	#!/usr/bin/env python3
	# Usage : ./sshrand.py server port

	import socket
	import sys

	s = socket.socket()
	s.connect((sys.argv[1], int(sys.argv[2])))

	version = s.recv(4096)

	#!/bin/bash

	apt-get install -y bzip2 gzip xz-utils php5-cli php5-xdebug wget time build-essential bc

	rm -rf vpsmark-test
	mkdir vpsmark-test
	cd vpsmark-test

	model=$(grep '^model name' -m1 /proc/cpuinfo \| sed -r "s/model name.: (.*)/\1/")
	cores=$(grep -c ^processor /proc/cpuinfo)

	#!/usr/bin/env python3
	# Usage: ./tlsrand server port

	import socket
	import sys

	hello = bytearray([3, 3]) # Version: TLS 1.2

	hello += bytearray([0]*32) # Random

	#!/usr/bin/env python3
	# Usage: ./bfi.py source.bf
	import sys

	with open(sys.argv[1]) as f:
	program = f.read()
	cells = [0]*30000
	ptr = 0
	pc = 0
	label_stack = []

	#!/bin/bash
	printf "\x07\x00\x00\x00\x00" > /sys/firmware/efi/efivars/SystemAudioVolume-7c436110-ab2a-4bbb-a880-fe41995c9f82

	#!/usr/bin/env python3
	# Usage: ./bfi.py source.bf
	import sys

	with open(sys.argv[1]) as f:
	py_program = "import sys;cells = [0]*30000;ptr = 0\n"
	level = 0
	for i in f.read():
	py_program += " "*level
	if i == '>':