This challenge required uploading a `GIF` file to the website's backend in order to later be able to view it.
Here's the PHP code for the backend of the website:
```php
1*1000){
$uploadOk = false;
echo "too big!!!";
}
$extension = strtolower(pathinfo($target_dir,PATHINFO_EXTENSION));
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$type = finfo_file($finfo,$files["tmp_name"]);
finfo_close($finfo);
if($extension != "gif" || strpos($type,"image/gif") === false){
echo " Sorry, only gif files are accepted";
$uploadOk = false;
}
$target_dir = strtok($target_dir,chr(0));
if($uploadOk && move_uploaded_file($files["tmp_name"],$target_dir)){
echo "uploaded gif here go see it!";
}
}
?>
```
After a few attempts, I noticed that the backend was checking certain parameters of the file, such as not being too memory-intensive, not having a traversal path in its name, having a `.gif` extension, and having the correct magic numbers for a valid `GIF` file. \
I also observed how it used `strtok()` between the file name and a null byte, taking the first part of the string as the actual file name. Following this observation, I was able to write a PHP reverse shell (which is in my [GitHub](https://github.com/AlBovo/CTF-Writeups/tree/main/nullcon%20CTF%202023) repository) named `rev.php%00.gif`. This file name successfully bypassed all the checks, and after the function execution, the actual file name would become `rev.php`. \
As soon as I opened the file at the URL `images/rev.php`, I could execute commands in the shell as `www-data`.

Original writeup (https://github.com/AlBovo/CTF-Writeups/tree/main/nullcon%20CTF%202023).