$ cat writeup.md…
$ cat writeup.md…
d3c2026
Task: A PHP-FPM video player passes attacker-controlled HLS or numeric parameters to md5_file() on a hardened Zend heap. Solution: Trigger CNEXT, groom compact page runs, corrupt a HashTable/zval, and invoke a forged destructor.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
online vidddeo player
The attachment provides a PHP-FPM “video player,” its Docker build, and three PHP hardening patches. The goal is to turn its attacker-controlled file hashing into code execution despite those allocator defenses.
The relevant sink in source/index.php is:
function c($x, $y, $z) { /* type and length checks omitted */ $v = json_decode($x, true); if (!is_array($v)) $v = []; $v[$y] = md5_file($z); echo json_encode($v); }
There are two ways to control all three arguments:
params is split by d(). If numeric elements 0, 1, and 2 exist, they are passed directly to c().b(). Session-data fields supply the JSON and key, while #EXT-X-MAP:URI=... or the first media line supplies the file path. A raw body is also accepted when its content type contains mpegurl or it begins with #EXTM3U.Therefore $z can be a php://filter chain. The image deliberately restores the vulnerable ISO-2022-CN-EXT.so gconv module, making the ISO-2022-CN-EXT/CNEXT one-to-three-byte overflow reachable through md5_file().
The supplied PHP is intentionally hardened, so a stock Ambionics CNEXT exploit is the wrong final route:
...
$ grep --similar