Local File Inclusion (LFI) - CTF Writeup

Fri, 27 Feb 2026 00:00:00 +0000

Alpaca Rangers — Daily Alpacahack Write-up

Category: Web Difficulty: Medium Topic: Local File Inclusion (LFI)

Description

Hero of Justice, Alpaca Rangers!

We’re given a PHP image viewer that loads files via a ?img= GET parameter.

Source Code Analysis

$targetPath = $_GET['img'] ?? '';

if (str_starts_with($targetPath, '/') || str_starts_with($targetPath, '\\') || str_contains($targetPath, '..')) {
 $errorMessage = 'Invalid path.';
} else {
 $contents = @file_get_contents($targetPath);
 ...
 $dataUri = 'data:' . $mimeType . ';base64,' . base64_encode($contents);
}

The app tries to block path traversal by rejecting anything that:

Starts with / or \
Contains ..

However, it passes the raw user input directly into file_get_contents() — which in PHP supports stream wrappers like php://, file://, http://, etc.

Path Traversal on 4mN3s14 | CTF Player & Student

Local File Inclusion (LFI) - CTF Writeup

Alpaca Rangers — Daily Alpacahack Write-up

Description

Source Code Analysis