\n\nThis page has been machine-translated from the original page.
\n
I participated in n1CTF, which ran from November 20, 2021.
\nUnfortunately I could not solve any of the problems, so this article is entirely about reviewing what I missed.
\nI am going through the challenges using other participants’ writeups as references.
\n\nYou can access a website running the following PHP script:
\n<?php \n//flag is /flag\n$path=$_POST['path'];\n$time=(isset($_GET['time'])) ? urldecode(date(file_get_contents('php://input'))) : date(\"Y/m/d H:i:s\");\n$name=\"/var/www/tmp/\".time().rand().'.txt';\n$black=\"f|ht|ba|z|ro|;|,|=|c|g|da|_\";\n$blist=explode(\"|\",$black);\nforeach($blist as $b){\n if(strpos($path,$b) !== false){\n die('111');\n }\n}\nif(file_put_contents($name, $time)){\necho \"<pre class='language-html'><code class='language-html'>logpath:$name</code></pre>\";\n}\n$check=preg_replace('/((\\s)*(\\n)+(\\s)*)/i','',file_get_contents($path));\nif(is_file($check)){\necho \"<pre class='language-html'><code class='language-html'>\".file_get_contents($check).\"</code></pre>\";\n}The Flag is located at the path /flag, but the path data sent via POST is filtered by a blacklist.
My original assumption was that this involved crafting an eval-like statement using characters not on the blacklist so that $check would ultimately contain /flag — but that turned out to be wrong.
The key to obtaining the Flag is focusing on this line:\n$time=(isset($_GET['time'])) ? urldecode(date(file_get_contents('php://input'))) : date(\"Y/m/d H:i:s\");
This expression checks whether a variable exists — specifically, whether the GET query contains time.
Reference: PHP: isset - Manual
\nThis script is called when the GET query contains time.
file_get_contents('php://input') retrieves the raw request body below the HTTP headers.
Reference: ajax - PHP “php://input” vs $_POST - Stack Overflow
\nReference: What is PHP filegetcontents()? - Qiita
\nAs described above, the request data obtained as a string via file_get_contents('php://input') is passed to the date() function.
Reading the official documentation reveals this format sample:
\n<?php\n// Assuming today is March 10th, 2001, 5:16:18 pm, and that we are in the\n// Mountain Standard Time (MST) Time Zone\n\n$today = date(\"F j, Y, g:i a\"); // March 10, 2001, 5:16 pm\n$today = date(\"m.d.y\"); // 03.10.01\n$today = date(\"j, n, Y\"); // 10, 3, 2001\n$today = date(\"Ymd\"); // 20010310\n$today = date('h-i-s, j-m-y, it is w Day'); // 05-16-18, 10-03-01, 1631 1618 6 Satpm01\n$today = date('\\i\\t \\i\\s \\t\\h\\e jS \\d\\a\\y.'); // it is the 10th day.\n$today = date(\"D M j G:i:s T Y\"); // Sat Mar 10 17:16:18 MST 2001\n$today = date('H:m:s \\m \\i\\s\\ \\m\\o\\n\\t\\h'); // 17:03:18 m is month\n$today = date(\"H:i:s\"); // 17:16:18\n$today = date(\"Y-m-d H:i:s\"); // 2001-03-10 17:16:18 (the MySQL DATETIME format)\n?>As you can see from date('\\i\\t \\i\\s \\t\\h\\e jS \\d\\a\\y.');, prefixing characters with a backslash prevents date() from treating them as date-format tokens, so the backslash-escaped characters are output literally.
Using this behavior, sending \\/\\f/l\\/a/g as POST data causes $time to ultimately contain /flag, from which the Flag can be retrieved.
I really wanted to review the Rev problems too, but I could not find any writeups for them.
\nI will update this article if I find some.
","fields":{"slug":"/ctf-n1ctf-2021-en","tagSlugs":["/tag/ctf-en/","/tag/web-en/","/tag/english/"]},"frontmatter":{"date":"2021-11-26","description":"I participated in n1CTF, which ran from November 20, 2021. Unfortunately I could not solve any problems, but I am reviewing what I missed with the help of other writeups.","tags":["CTF (en)","Web (en)","English"],"title":"N1CTF 2021 Writeup","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-n1ctf-2021-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}