Project Sekai
🔒 WolvCTF 2023 / ✅-web-filter-madness
php moment
<?php
$result = 'no madness submitted yet';
$madness = isset($_GET['madness']) ? $_GET['madness'] : '';
if (strstr($madness, '/')) {
die('Sorry, no slashes allowed');
}
$file = "php://filter/$madness/resource=/etc/passwd";
if (strlen($file) > 100) {
die('Sorry, your madness is too long');
}
$result = file_get_contents($file);
if ($result === 'zombies for the flag') {
$result = file_get_contents('/flag.txt');
}
?>
<div>Can you submit some madness that will return the flag?</div>
<br/>
<div>Your filter madness: <?php echo $file ?></div>
<div>Your filter madness length: <?php echo strlen($file) ?></div>
<div>Your filter madness results: <?php echo $result ?></div>
<br/>
<form method='GET'>
<input name='madness'></input>
<button>Submit</button>
</form>
<br/>
<div>Here's some <a href='/info.php'>info</a>.</div>
} else if (!strncasecmp(path, "filter/", 7)) {
/* Save time/memory when chain isn't specified */
if (strchr(mode, 'r') || strchr(mode, '+')) {
mode_rw |= PHP_STREAM_FILTER_READ;
}
if (strchr(mode, 'w') || strchr(mode, '+') || strchr(mode, 'a')) {
mode_rw |= PHP_STREAM_FILTER_WRITE;
}
pathdup = estrndup(path + 6, strlen(path + 6));
p = strstr(pathdup, "/resource=");
if (!p) {
zend_throw_error(NULL, "No URL resource specified");
efree(pathdup);
return NULL;
}
if (!(stream = php_stream_open_wrapper(p + 10, mode, options, opened_path))) {
efree(pathdup);
return NULL;
}
*p = '\0';
p = php_strtok_r(pathdup + 1, "/", &token);
while (p) {
if (!strncasecmp(p, "read=", 5)) {
php_stream_apply_filter_list(stream, p + 5, 1, 0);
} else if (!strncasecmp(p, "write=", 6)) {
php_stream_apply_filter_list(stream, p + 6, 0, 1);
} else {
php_stream_apply_filter_list(stream, p, mode_rw & PHP_STREAM_FILTER_READ, mode_rw & PHP_STREAM_FILTER_WRITE);
}
p = php_strtok_r(NULL, "/", &token);
}
...
static void php_stream_apply_filter_list(php_stream *stream, char *filterlist, int read_chain, int write_chain) /* {{{ */
{
char *p, *token = NULL;
php_stream_filter *temp_filter;
p = php_strtok_r(filterlist, "|", &token);
while (p) {
php_url_decode(p, strlen(p));
if (read_chain) {
if ((temp_filter = php_stream_filter_create(p, NULL, php_stream_is_persistent(stream)))) {
php_stream_filter_append(&stream->readfilters, temp_filter);
} else {
php_error_docref(NULL, E_WARNING, "Unable to create filter (%s)", p);
}
} whats the filter challenge