A PHP 7.1 site with lfi.php (a local file inclusion) and phpinfo.php: phpinfo() prints the temporary name of a file uploaded with the request, so a race includes that file before PHP deletes it and runs its code.
Pas commencéDockercommit 3bf08fax86_64 · aarch64Secret
Turn the LFI into code execution through phpinfo() and get a shell.
Le brief de ce lab se trouve dans son dépôt.