Cyber Jawara 2018 Final - Web Exploitation

public function executeConvertCmd($cmd, $values = array())
{
    // First, get a temporary file for the input
    if (strpos($cmd, '__FILEIN__') !== false) {
        $tmpin = $this->toFile($this->_data);
    } else {
        $tmpin = '';
    }
    // Now an output file
    $tmpout = stream_get_meta_data(tmpfile())['uri'];
    // Substitue them in the cmd string
    $cmd = str_replace(
        array('__FILEIN__', '__FILEOUT__', '__CONVERT__'),
        array('"' . $tmpin . '"', '"' . $tmpout . '"', $this->_convert),
        $cmd
    );
    //TODO: See what else needs to be replaced.
    $cmd = $this->_convert . ' ' . $cmd . ' 2>&1';

    exec($cmd, $output, $retval);
    $this->_data = file_get_contents($tmpout);
    @unlink($tmpin);
    @unlink($tmpout);
}

public function __construct($params, $context = array())
{
    parent::__construct($params, $context);
    if (empty($context['convert'])) {
        throw new InvalidArgumentException(
            'A path to the convert binary is required.'
        );
    }
    $this->_convert = $context['convert'];
    if (!empty($context['identify'])) {
        $this->_identify = $context['identify'];
    }
    if (!empty($params['filename'])) {
        $this->loadFile($params['filename']);
    } elseif (!empty($params['data'])) {
        $this->loadString($params['data']);
    } else {
        $cmd = "-size {$this->_width}x{$this->_height} xc:{$this->_background} -strip {$this->_type}:__FILEOUT__"; // Here
        $this->executeConvertCmd($cmd);
    }
}

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\User;
use App\Http\Controllers\Controller;

class MainController extends Controller
{
    public function show(Request $request)
    {
        $dir_name = '/tmp/' . $request->session()->getId();
        if (file_exists($dir_name)) {
            $files = glob($dir_name . '/*');
            $checked = array("c", "cpp", "py", "sh");
            $result = array();
            foreach ($files as $file) {
                if (is_file($file)) {
                    $exp = explode('.', $file);
                    $extension = end($exp);
                    $exp = explode('/', $file);
                    $filename = end($exp);
                    if (in_array($extension, $checked)) {
                        $content = file_get_contents($file);
                        $result[$filename] = sha1($content);                        
                    }
                }
            }
            return view('main', ['result' => $result]);
        }
        return view('main');
    }

    public function upload(Request $request)
    {
        if ($request->hasFile('file')) {
            $dir_name = '/tmp/' . $request->session()->getId();
            if (!file_exists($dir_name)) {
                mkdir($dir_name);
            } else {
                $files = glob($dir_name . '/*');
                foreach ($files as $file) {
                    if (is_file($file)) {
                        unlink($file);
                    }
                }
            }

            $file = request()->file('file');
            $extension = $file->getClientOriginalExtension();

            $allowed = array("tar", "zip", "phar");
            if (in_array($extension, $allowed)) {
                $name = $file->getClientOriginalName();
                $file->move($dir_name . '/', $name);
                $path = $dir_name . '/' . $name;

                $archive = NULL;

                try {
                    $archive = new \Phar($path);
                } catch (\Exception $e) {
                    try {
                        $archive = new \PharData($path);
                    } catch (\Exception $e) {
                        // pass
                    }
                }

                if ($archive) {
                    $archive->extractTo($dir_name);
                    $checked = array("c", "cpp", "py", "sh");
                    $result = array();
                    foreach (new \RecursiveIteratorIterator($archive) as $submission) {
                        $exp = explode('.', $submission);
                        $extension = end($exp);
                        $exp = explode('/', $submission);
                        $filename = end($exp);
                        if (in_array($extension, $checked)) {
                            $content = file_get_contents($submission);
                            $result[$filename] = sha1($content);
                        }
                    }
                    return view('main', ['result' => $result]);
                } else {
                    return view('main', ['error' => "Invalid Archive"]);
                }

            } else {
                return view('main', ['error' => "Invalid Archive"]);
            }
        }
        return view('main');
    }
}

<?php

namespace Illuminate\Broadcasting;

use Illuminate\Contracts\Events\Dispatcher;

class PendingBroadcast
{
    /**
     * The event dispatcher implementation.
     *
     * @var \Illuminate\Contracts\Events\Dispatcher
     */
    protected $laravel_events; // Original : $events

    /**
     * The event instance.
     *
     * @var mixed
     */
    protected $laravel_event; // Original : $event

    /**
     * Create a new pending broadcast instance.
     *
     * @param  \Illuminate\Contracts\Events\Dispatcher  $events
     * @param  mixed  $event
     * @return void
     */
    public function __construct(Dispatcher $events, $event)
    {
        $this->laravel_event = $event;
        $this->laravel_events = $events;
    }

    /**
     * Broadcast the event to everyone except the current user.
     *
     * @return $this
     */
    public function toOthers()
    {
        if (method_exists($this->laravel_event, 'dontBroadcastToCurrentUser')) {
            $this->laravel_event->dontBroadcastToCurrentUser();
        }

        return $this;
    }

    /**
     * Handle the object's destruction.
     *
     * @return void
     */
    public function __destruct()
    {
        $this->laravel_events->dispatch($this->laravel_event);
    }
}

protected $events;
protected $event;

function __construct($events, $cmd)
{
    $this->events = $events;
    $this->event = $cmd;
}
....
protected $formatters = [
    'dispatch' => 'assert'
];
....

protected $laravel_events;
protected $laravel_event;

function __construct($events, $cmd)
{
    $this->laravel_events = $events;
    $this->laravel_event = $cmd;
}
....
protected $formatters = [
    'dispatch' => 'passthru'
];
....