Blank Space

300 points. The page is an upload form for a street art gallery. It accepts files and returns a success box containing a URL. The opening test is a PHP file submitted with an incorrect MIME type.

The server responds with an explicit error:

ERROR: File type (MIME: application/octet-stream) is not allowed! Only image/jpeg, image/png, image/gif are accepted.

The check applies to the declared MIME type rather than the file content. Resending the same PHP file while declaring it a JPEG passes the gate:

ffcurl -F "uploaded_file=@test.php;type=image/jpeg" http://54.72.82.22:8160

The response switches to success and returns a URL:

SUCCESS:
Uploaded file URL: /uploads/test.php
Your Art Is: safctf{059507cb1ce1b9fa4dbf4ad6cfb83a4a}

Requesting the uploaded path also executes the file, confirming that the server runs PHP from the upload directory:

ffcurl http://54.72.82.22:8160/uploads/test.php

hi

Flag:

safctf{059507cb1ce1b9fa4dbf4ad6cfb83a4a}

The extension is not the variable worth examining. The MIME declaration is the only gate, and once it is spoofed the upload proceeds and the flag appears in the response.