SunshineCTF - Evaluation
-------------------------
**Category:** Web

**Points:** 50

##### Description:
```
Evaluate your life.
How are you doing, and are you doing the best you can possibly do?
Look deeper within yourself, beyond the obvious.
Look at the source of it all.

Also, here's a PHP challenge.

http://evaluation.web1.sunshinectf.org

Author: hackucf_levi
```
Upon visiting the site we're prompted with the following code:
```

```
From the following code we can assume that the flag is stored in ``flag.php``, also we know its supressing errors by adding the ``@`` symbol infront of ``$_REQUEST['hello'];``, regardless we know we know our attack vector is the parameter ``hello`` and that it's passed inside the ``eval()`` function without being parsed or formatted which is a big red flag.

After sending a GET request with ``?hello=$flag`` we get the response ``string(4) "Nope"``so we can assume that the flag isn't stored in the variable but inside the file.

After this I copied the code locally so I could easier debug it (with error reporting so I could break out of the ``var_dump``. After some tweaking I managed to use the ``show_source`` function to reveal the flag using the payload ``$flag); show_source('flag.php'`` revealing the source code and the flag:
```

```