OJDec 20, 2022

Had this on a recent engagement and thought I'd provide a cut-down version as a fun little CTF-like challenge.

As an attacker, you can invoke `pwnme()` and control the value of `$filename` via a web request.

You cannot control the contents of the file system that this code is running on. You don't have the ability to upload files.

How do you achieve command injection?

#php #challenge

Show threadAndrew Bailey
@oj id start with filename is foo;id
Dec 21, 2022 at 2:34amMastodon for Android
Show threadJustin StevenDec 21, 2022
@notaname @oj that would almost certainly fail to pass the file_exists() conditional though. And per the challenge you can't create files on the victim system.
Show threadAndrew BaileyDec 21, 2022
@justinsteven @oj *reads file_exists docs* 
Show threadAndrew BaileyDec 21, 2022
@justinsteven @oj filename is something like https://myserver.com/;<shell command> might need to futz with things