testuser-aaa

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

Pwntools Cheatsheet

Program Interaction
Environment and Contexts
Logging and Output
Encoding, Packing and Utility
Assembly and Shellcraft
ELFs, Strings and Symbols
Return Oriented Programming
SROP and Sigreturn Frames

ELF Format Cheatsheet

Introduction

Executable and Linkable Format (ELF), is the default binary format on Linux-based systems.

	#!/usr/bin/python

	from scapy.all import *
	import threading
	import argparse
	import pdb
	import sys
	import os

	class ARPPoisoning(threading.Thread):

	(() => {
	let gadgets = [];

	if (typeof _satellite !== 'undefined') {
	gadgets.push('Adobe Dynamic Tag Management');
	}

	if (typeof BOOMR !== 'undefined') {
	gadgets.push('Akamai Boomerang');
	}

	0spam.fusionzero.com
	2.0.0.127.b.barracudacentral.org
	3y.spam.mrs.kithrup.com
	abuse.earthlink.net
	abuse.org
	abuse.rfc-ignorant.org
	accept.the-carrot-and-the-stick.com
	access.redhawk.org
	all.rbl.kropka.net
	all.s5h.net

	#!/usr/bin/env python

	"""
	Script to open TCP connection and send 1 HTTP GET request containing
	a specific string, and header

	Usage:
	./http.py <IP_of_target>

	There is only one mandatory argument, which is the target IP address.