Add shortest solution of lixi_2018
WangYihang opened this issue · comments
22 Bytes
?%E2%81%A3=${${`cu\\rl 0:88\88`}};
not for arbitrary command execution, ssrf to get flag~
Cool! Actually, prior to releasing the challenge, I already removed curl wget telnet stuff.
But it turns out that busybox can be used.
oh, ${{}} is useless
`cu\\rl 0:88\88`;
wow, I did not notice that... I just test it in my computer~ thank you for your excellent challenge, pretty cool~
Glad you liked it! Enjoy other ones ~
Oh, I think there was a mistake.. I didn't noticed that the function shell_exec will not print the output of the command... so I was my fault, I think die() or any other functions can print string are necessary;
Yea, you can check the solutions out, there is one payload which using die(`ssh... got the same idea to yours.