- PHP<\/li><\/ul>\n\n\n\n
Level09<\/strong><\/h2>\n\n\n\n
By looking at the files under the \/home\/flag09 folder you can identify the SUID program and a file with PHP code, which is the same presented on the challenge\u2019s page<\/a>.<\/p>\n\n\n
\n![\"Files\"](\"wp-content\/uploads\/2018\/06\/files.png\")
<\/figure>\n<\/div>\n\n\nFirst of all, the markup function is our \u201cpoint of entrance\u201d in the code. This function takes two arguments, which means the flag09 SUID program also takes two arguments. Let\u2019s ignore the second argument and feed something random.<\/p>\n\n\n\n
Now, taking a look at the code, is possible to identify some calls to the preg_replace, whose function is to replace content in a string based on a regular expression. The first preg_replace will basically replace all the \u201c.\u201d by \u201cdot\u201d and all the \u201c@\u201d by \u201cAT\u201d. The last two preg_replace will replace the square brackets by the angle quotes.<\/p>\n\n\n\n
If you feed some file to this program, flag09 will analyze and replace all \u201c@\u201d and \u201c.\u201d symbols. At the end, will print to the command line the entire file sanitized.<\/p>\n\n\n\n
For example, the following image contains the output of running flag09 with some file containing \u201c[email moveaxme@moveax.me]\u201d.<\/p>\n\n\n
\n![\"test\"](\"wp-content\/uploads\/2018\/06\/test.png\")
<\/figure>\n<\/div>\n\n\nIn order to get a shell, we can place in the file \u201c[email {${system(sh)}}]\u201d instead of the last string. We use the system function because it\u2019ll show the output immediately and not at the end.<\/p>\n\n\n\n
Now we will have a shell under the flag09 user. From here, we can run the getflag command and solve the level09 challenge. Let\u2019s see.<\/p>\n\n\n
\n![\"Solution](\"wp-content\/uploads\/2018\/06\/solution_level09.png\")
<\/figure>\n<\/div>\n\n\nChallenges completed: 10\/20<\/p>\n\n\n\n
Mitigation<\/strong><\/h2>\n\n\n\n
So, as mitigation to this level09 we have the same advises I gave to level0<\/a>.<\/p>\n\n\n\n
It\u2019s always good to remember that all the input provided by the user (or some program) should always be sanitized.<\/p>\n\n\n\n
Walkthrough<\/strong><\/h2>\n\n\n\n