Last updated
Last updated
We are only allowed to use these characters: $()_[]=+;".
Webserver evals our input.
We also have a 2000 character cap (found by experimenting)
Found a pretty good resource on this:
Main idea is to
use underscores for variables names
use $_=([]."")[([]==[])+([]==[])+([]==[])] to get a lowercase a
use $_=([]."")[[].[]+[][[]]] to get an uppercase A
use [varname]++ to increase the ascii value for each of these to get all ascii letters
take a string and join our characters one by one with .=
for other characters, we can just join then with .="char", assuming it is allowed.
Our first goal is to get phpinfo, to see if there are any disabled functions:
Payload:
We can see that useful functions which would have allowed us to read from the file like file_get_contents are disabled. However, readfile() is not disabled, so we can use that. We can then use printf() to output that to us.
Our final payload will then eval to: printf(readfile("FLAG.PHP"))
Final payload:
(need to view source to see it)