Nickguitar

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

Nickguitar

Bypassing Discord marked links filter

Recently a friend of mine showed me a way to use hyperlinks on Discord. Discord has a markdown notation support, so users can enhance their messages with formatting, using bold, itallic, titles, etc. It's also possible to use what Discord calls masked links, which are hyperlinks, just like normal markdown, using the syntax [text](https://example.com). The result is the following:

In the context of cybersecurity, one of the first things that comes to mind is to try to make a fake link, putting another URL on the "text" part. It would be something like [https://example.com](https://malicious.com). By doing so, an user would see the URL https://example.com, but by clicking on it, he would be redirected to https://malicious.com.