PHP

Path Traversal with PHP wrapper

by Brumens

drag_indicator

info

drag_indicator

inputs

drag_indicator

inspect

Path traversal with PHP wrapper

Found a way to escape the /tmp/files/notes/ directory and access arbitary files on the vulnerable application!

Goal

Capture the flag! The flag can be found in the file: /tmp/secret/flag.txt

Hints

Hint #1

expand_more

You looking for the php wrapper

Solution

Read the solution

expand_more

The program relies entirely on the specified file name given by the user, making it vulnerable to a path traversal. The attacker can the php wrapper to escape the intended folder structure and access the flag file stored in the secret folder.

Payload:

php://filter//resource=/tmp/secret/flag.txt

There is a lot of different payloads that will work and you can find more payloads here

drag_indicator

waf

INPUT

OUTPUT

drag_indicator

code

drag_indicator

result