webPromedium

Vault

tamuctf

Task: Laravel app with avatar upload using $_FILES['full_path'] (LFI) and voucher redeem using decrypt() (deserialization). Solution: Chain LFI to extract APP_KEY, generate phpggc gadget chain, encrypt with Laravel format, trigger RCE to find randomized flag filename, read flag via LFI.

$ ls tags/ techniques/
rcelfipath_traversalphpdeserializationlaravelphpggcapp_key
lfi_via_full_pathlaravel_decrypt_deserializationphpggc_gadget_chainapp_key_extraction
πŸ”’

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups