$ cat writeup.md…
$ cat writeup.md…
tamuctf
Task: Laravel app with avatar upload using $_FILES['full_path'] (LFI) and voucher redeem using decrypt() (deserialization). Solution: Chain LFI to extract APP_KEY, generate phpggc gadget chain, encrypt with Laravel format, trigger RCE to find randomized flag filename, read flag via LFI.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar