Jean Uchôa roadhouse

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

	import socket
	import random
	import argparse
	import sys
	from io import BytesIO

	# Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client

	PY2 = True if sys.version_info.major == 2 else False

	class BinaryTree
	def initialize
	@root = nil
	@left_nodes = []
	@right_nodes = []
	end

	def insert(value)
	@root.nil? ? @root = TreeNode.new(value) : @root.insert(value)
	end

	real=Sidekiq::Queue.new('realtime')
	jobs= real.group_by {\|i\| i.args}
	jobs.delete_if {\|k,v\| v.size == 1}
	jobs.map {\|k,v\| v[0..(v.size-2)].map {\|i\| i.delete }}

	def xor_encrypt(string, key)
	string.bytes.map.with_index { \|byte, index\| (byte ^ key.bytes[index % key.length]).chr }.join
	end