webProhard

Lab 313 — ThreadForge — PHAR Deserialization Chain via Backup Leak & Chunked Upload

hackadvisor

Task: PHP forum with admin panel, backup download, chunked upload API, and image processor path setting. Solution: Download SQLite backup to leak config, upload PHP webshell via unrestricted upload API, trigger execution via include() in the /uploads/ route handler.

backup_leak chunked_upload decoy_flag deserialization file_upload information_disclosure nginx phar php php_include slim_framework sqlite unrestricted_file_upload webshell

decoy_flag_avoidance

$ ls tags/ techniques/

backup_leak chunked_upload decoy_flag deserialization file_upload information_disclosure nginx phar php php_include slim_framework sqlite unrestricted_file_upload webshell

decoy_flag_avoidance

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups