webmedium

Vault

tamuctf

Task: Laravel app with avatar upload using $_FILES['full_path'] (LFI) and voucher redeem using decrypt() (deserialization). Solution: Chain LFI to extract APP_KEY, generate phpggc gadget chain, encrypt with Laravel format, trigger RCE to find randomized flag filename, read flag via LFI.

$ ls tags/ techniques/
rcelfipath_traversalphpdeserializationlaravelphpggcapp_key
lfi_via_full_pathlaravel_decrypt_deserializationphpggc_gadget_chainapp_key_extraction
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]