Skip to content

Instantly share code, notes, and snippets.

View wupco's full-sized avatar
💭
On vacation

{{1+1}} wupco

💭
On vacation
View GitHub Profile
@wupco
wupco / writeup.md
Created December 31, 2021 02:05 — forked from loknop/writeup.md
Solving "includer's revenge" from hxp ctf 2021 without controlling any files

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

@wupco
wupco / exp.c
Created September 2, 2019 09:49 — forked from icchy/exp.c
Oneline Calc
123;
return 123;
}
extern void *opendir(const char *);
extern void *readdir(void *);
extern void *shmat(int, const void *, int);
typedef struct {
ino_t d_ino;
off_t d_off;
unsigned short d_reclen;