Lab 163 — PostFlow — Unrestricted File Upload via Avatar Feature

hackadvisor

Task: PHP blogging platform with avatar upload feature; server-side content filter blocks standard <?php tags but allows PHP short tags, and preserves .php extension in web-accessible uploads directory. Solution: bypass content filter using <?= short tag with backtick command execution, prepend PNG magic bytes to pass header validation, upload as .php to achieve RCE and read /root/flag.txt.