PharOut
Simple PHP deserialization detect with code review.
Challenge
Find the vulnerability using the provided source code. Dockerfile included.
Exploit the vulnerability in http://challenges.ctfd.io:30455 to recover the flag. Please, no scanners, brute force, DoS against the live site.
Server is Ubuntu/Apache2/PHP7.4
Code Review
Index
Doit Class
Wrapper Class
Exploit
At first change the private $doit
to public $doit
in class Wrapper, then code a phar generator based on this class to upload a file and trigger the PHP Deserialization.
Upload file
Upload a exploit.phar in page and with proxy change the value f
in paramater s
to value p
, uploading a phar://
instead of file://
(as show in index).
Flag
Last updated