HexF

# awful code for decrypting DLink TCLinux firmware files
# requires pycryptodome

import struct
import binascii
from Crypto.Cipher import AES

KEY = bytes.fromhex("11223344556677889900aabbccddeeff")
IV = bytes.fromhex("a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5")

loknop

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

poxyran

Start GDB and execute the following commands:

catch syscall ptrace
commands 1
set ($eax) = 0
continue
end

Then, run the app and voilá! you can debug your program :)

alirobe

### 
###
### UPDATE: For Win 11, I recommend using this tool in place of this script: 
### https://christitus.com/windows-tool/
### https://github.com/ChrisTitusTech/winutil
### https://www.youtube.com/watch?v=6UQZ5oQg8XA
### iwr -useb https://christitus.com/win | iex
###
###