# Include me## Description
> Zero Dollar Security is hiring infosec enthusiast. Apply ASAP. Connect at chall.ctf-ehcon.ml:32104
## Solution
This application just has register function
![Register function](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/register.png)
Use Burp Suite to intercept the request.- As we see, body of the request is XML- The response has the `username` has sent before
--> This might contain XXE vulnerability 
![Register function](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/register-burp.png)
The first we try to read a file such as `/etc/passwd` ```xml
     ]>    <root>        <email>&ext;</email>        <password>none</password>    </root>```
![XXE](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/read-file-xxe.png)
That's good, continue reading other files such as `flag.txt`, `flag.php`... but I get nothing.
When I'm trying to list directory, I receive a strange response having a newline character `\n` 
![New hint](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/read-file-2.png)
Nice, use another method to read or list directory. Because I knew this application use `PHP`, therefore I use PHP wrapper to read file- File `flag.php` is guessed ```xml
     ]>    <root>        <email>&ext;</email>        <password>none</password>    </root>```
![Read file with PHP wrapper](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/read-file-base64.png)
Okay good response, take this to base64 decode. Read this code a bit- It takes param `content` in request using `POST` method- Put `content` into created file with given `content` - Pass 2 file `.html` and `.pdf` to `/var/www/html/files/` ```php
```What did I get through this snippet code?- We can put our payload into a file `html` - A new directory `/var/www/html/files/` 
Well, observer new directory a bit
![Files directory](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/directory-before-post.png)
Now, how can we capture the flag with controlable data HTML? Can we read file or list directory?
We can definately do it with `iframe` tag in HTML--> LFI with iframe
Replace body of `POST` method from XML to `content`
![POST method](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/post.png)
My payload:- Diretory listing of `/` 
![Content param in POST method](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/content.png)
After send the request, F5 the application we will get new files
![After post](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/directory-after-post.png)
Nice, check out content of file `result.pdf` 
![List directory in /](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/list-directory.png)
Where is the flag? Ah, it's in `/ctf/`. List directory in `/ctf/`
![List directory in /ctf/](https://raw.githubusercontent.com/greybtw/write-up-CTF_2021/master/eHaCON%20CTF%202K21/img/Include%20me/list-directory-ctf.png)
The flag was captured ??
```Flag is : EHACON{lf1_@nd_xx3_1s_fun}```