[ssure]

looool perfect .. thanks !!

[artifice]

Heey, thanks a lot!

I need some help understanding the exploit.

From your code, here's what I could understand / get:  you basically added the php rev shell file, then added a weird format that doesn't exist with a null byte to bypass the .pdf check, then added an 'empty' zip .... can you please explain what was done?

i followed the zip format: https://users.cs.jmu.edu/buchhofp/forens...pkzip.html
also: if you create a zipfile and look at it in a hexeditor, you can see the format described in the website and in my code
I did not add anything special, I just followed the format and changed the second filename to include a nullbyte

I was stuck on the RCE exploit for hours, thank you so much for this!

[baxavo]

How to reverse engineer the stock executable to get that shared object path and name? I've been trying various decompilers without luck. Should I debug it in runtime?

You shouldn't debug it in runtime.
You have to use ghidra https://ghidra-sre.org/ (or similar app to it). Open binary, go to functions and find 'main'. There you will find XOR function call and hardcoded parameters. XOR output gives full path to shared object.

void XOR(long param_1,ulong param_2,long param_3,long param_4)

{
  int local_10;
  int local_c;
 
  local_c = 0;
  for (local_10 = 0; (ulong)(long)local_10 < param_2; local_10 = local_10 + 1) {
    if ((long)local_c == param_4 + -1) {
      local_c = 0;
    }
    *(byte *)(param_1 + local_10) = *(byte *)(param_1 + local_10) ^ *(byte *)(param_3 + local_c);
    local_c = local_c + 1;
  }
  return;
}

[darkmanu]

machine pwned!!

[semtex]

I still don't understand how the pdf bypass works. I can't even upload a legitimate pdf compressed as zip without it telling me to "include a single pdf file". An explanation would be appreciated because I have been stuck all day, and using the script without knowing how the bypass works feels like cheating

[raedbleu]

Thx for sharing!

[bigmelonhead]

Thanks so mcuh!

[deep]

thanks a lot!

[KoJeBole]

Hi guys! I'm releasing my second writeup on here.
This time I converted from Markdown to BBCode so it's much more readable.

As always, it includes my thought process and an explanation of what's actually happening. I'll also include an autopwn script soon

Thanks! I really needed a nudge

[baxavo]

How to reverse engineer the stock executable to get that shared object path and name? I've been trying various decompilers without luck. Should I debug it in runtime?

you are overthinking bro ... no need to reverse nothing or use decompilers ... just very basic "file check up" .... strings , ltrace , strace  are more then enough ... to go on

Can you elaborate your 'basic "file check up"'?
It's true you can find password with 'strings' and path with 'strace'. But how to understand you have to forge shared object?
BTW there is no ltrace on server.