Галерея (Gallery)

hackerlab

Task: a PHP gallery that 'only accepts images' includes a user-supplied file_url, with an end-anchored extension blacklist /\\.php[0-9]*$/i. Solution: LFI via php://filter; bypass the .php block by appending /x/.. so the URL string ends in '..' while PHP lexically collapses the path back to /var/www/html/index.php, base64-read the source, and find the flag in a trailing comment.