LFI Wrapper: zip://
Raw, unsanitized Local File Inclusion on a single menu parameter — include($_GET['page']) with no base path, no extension, no whitelist — chained with PHP's zip:// stream wrapper. The app only checks that uploads end in .zip, never what's inside them. Discover the real storage path from the Reports page, upload your own malicious archive, and hand-craft the full wrapper string yourself to get remote code execution. No split parameters, no shortcuts — you write the entire payload.
# 1. Extract the archive you just downloaded — on your own box, not a server.
you@host:~$ unzip lfi-wrapper-zip.zip && cd lfi-wrapper-zip
# 2. Boot the vulnerable machine. It prints the IP it was assigned.
you@host:~$ sudo bash deploy.sh lfi-wrapper-zip.tar
# 3. Point your tools at that IP. Ctrl+C here tears it back down when you're done.
Learn more
Read the theory behind this lab before diving in.
Submit flags
Log in to submit flags and track your progress.