loknop

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

Ekultek

#!/bin/bash

# all known shodan IP addresses
SCANNERIPADDRESSES=$"185.181.102.18
94.102.49.193
94.102.49.190
89.248.167.131
93.174.95.106
185.163.109.66
89.248.172.16

mccabe615

Command Execution

exec           - Returns last line of commands output
passthru       - Passes commands output directly to the browser
system         - Passes commands output directly to the browser and returns last line
shell_exec     - Returns commands output
\`\` (backticks) - Same as shell_exec()
popen          - Opens read or write pipe to process of a command
proc_open      - Similar to popen() but greater degree of control
pcntl_exec - Executes a program

justinian

x64 NASM cheat sheet

Registers

	64 bit	32 bit	16 bit	8 bit
A (accumulator)	RAX	EAX	AX	AL
B (base, addressing)	RBX	EBX	BX	BL
C (counter, iterations)	RCX	ECX	CX	CL
D (data)	RDX	EDX	DX	DL