> For the complete documentation index, see [llms.txt](https://docs.cooku222.kr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cooku222.kr/security/web-hacking/dreamhack/dreamhack-simple-phparse.md).

# \[Dreamhack] simple-phparse

문제 출처 :<https://dreamhack.io/wargame/challenges/1367>

***

<br>

<figure><img src="https://blog.kakaocdn.net/dna/b7M7HK/btsOPnxN0qw/AAAAAAAAAAAAAAAAAAAAAJ1poXt97sx6bv87giEAWXkx9_ACmyXvS2AiZCOxAcOt/img.png?credential=yqXZFxpELC7KVnFOS48ylbz2pIh7yKj8&#x26;expires=1782831599&#x26;allow_ip=&#x26;allow_referer=&#x26;signature=cTeFQ8jUGGKZx1bJ4Qaa8ZoOELw%3D" alt="" height="403" width="735"><figcaption></figcaption></figure>

페이지 동작 원리는 경로 입력한게 path: 프롬프트에 인코딩 된 채로 뜬다.&#x20;

현재 서버에서는 flag.php 경로 접근을 path 기준으로 필터링하고 있다. nginx에서 중복된 슬래시는 제거해 //flag.php를 url에 덧붙이면 /flag.php로 인식되어 flag.php에 접근한다.

<figure><img src="https://blog.kakaocdn.net/dna/cT4aQ4/btsONJa1KrS/AAAAAAAAAAAAAAAAAAAAAEQnrf3xt3ayszsA4JM6KjnCo6k6rncEWGFZ2AsCHU8r/img.png?credential=yqXZFxpELC7KVnFOS48ylbz2pIh7yKj8&#x26;expires=1782831599&#x26;allow_ip=&#x26;allow_referer=&#x26;signature=nOI82gwdvregDPcQu7D55WWluz8%3D" alt="" height="452" width="1436"><figcaption></figcaption></figure>

여기서 parse\_url()이 host, path등 동작을 나누고 //flag.php와 같이 중복 슬래시가 있으면 host가 flag.php, path는 빈 문자열처럼 잘못 해석될 여지가 있다.&#x20;

flag.php는 host로 인식되진 않지만 parse\_url() 특성상 host 처럼 처리 될 수 있다.&#x20;

* /flag.php로 접근 시 index.php에서 내부적으로 flag.php를 실행시키고 있고, nginx에서 .php 확장자가 아닌 경로, 또는 /flag.php 경로가 들어오면 index.php를 실행하도록 설정해놓음.
* 그 안에서 parse\_url이나 preg\_match 함수로 입력값을 해석한 결과, 우연히 flag.php가 호출될 수 있는 구조로 되어 있음.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cooku222.kr/security/web-hacking/dreamhack/dreamhack-simple-phparse.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.