# MeePwnTubeTLDR; It is SSRF and filter bypass. Also this is a fun challenge where you can listen to many "hot" singer from Vietnam.
# The problemSource code already provided.## _ducnt.php```$res = mysqli_query($conn,"SELECT * FROM users WHERE username='$username' and password = '$hashpasswd'");// .. snip..$_current_avatar = $row['avatar_name'];// .. snip..$_parse_current_avatar = _curl($_current_avatar);$_parse_current_avatar = '<center></center>';```
## curl.php```$data = curl_exec($ch);// .. snip..return base64_encode($data);```
This give you whole source of page.
## flag.phpThere is a note here.```echo '<center>Nice try dude but but wrong hole....</center>';```
Nice try dude but but wrong hole....
## change_avatar.php```function rule_change_avatar($data){        		$_parse = parse_url($data);		if(!preg_match("/^http$/", $_parse['scheme'])) {				die("<center>Error: 'HTTP only' dude!!</center>");		}
Error: 'HTTP only' dude!!
		if(!preg_match("/meepwntube.0x1337.space$/", $_parse['host'])) {
				die("<center>Error: Our 'space' only dude!!</center>");		}
Error: Our 'space' only dude!!
		//super miniwaf prevent scanning internal		if(preg_match("/127|192|172|000|0.0|fff|0x0|0x7f|0177|2130706433|\]|\[/", $_parse['host'])) {				die("<center>Error: Oops script kiddie detected!!</center>");		}		$_domain = $_parse['scheme']."://".$_parse['host'].":".$_parse['port'].$_parse['path'];		return $_domain;}$_name = miniwaf(rule_change_avatar($_POST['change_avatar']));// .. snip ..$update_avatar = mysqli_query($conn,"UPDATE users SET avatar_name = '$_name' WHERE username='$username'");```
Error: Oops script kiddie detected!!
As you can see, `rule_change_avatar` make sense, but there is a hole in there, `/meepwntube.0x1337.space$/` actually is a failed regex (not properly escaped), which is I can bypass.
### The chain is:- change_avatar.php: update `avatar url`-  \_ducnt.php : _curl	-  source# PoCSo I quickly register a new domain "meepwntubex0x1337.space", then point an A record to "127.0.0.1".I only try on main site, not bak.meepwn.. . because it has an other regex check :doge:
Function `rule_change_avatar` also allow custom `port`, then, scanning whole port from 1 to 10000, I got flag at (I should guess it first :D) (not this domain)
http://random.meepwntubex0x1337.space:1337/flag.php
```1335 1336 1337 Hey dude how can you get here???: BTW here is your flag: MeePwnCTF{******_gr8_again?????}1338 1339 ```