Edit

LFI2RCE via PHP Filters

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Intro

This writeup explains that you can use php filters to generate arbitrary content as output. Which basically means that you can generate arbitrary php code for the include without needing to write it into a file.

Basically the goal of the script is to generate a Base64 string at the beginning of the file that will be finally decoded providing the desired payload that will be interpreted by include.

The bases to do this are:

  • convert.iconv.UTF8.CSISO2022KR will always prepend \x1b$)C to the string

  • convert.base64-decode is extremely tolerant, it will basically just ignore any characters that aren't valid base64. It gives some problems if it finds unexpected "=" but those can be removed with the convert.iconv.UTF8.UTF7 filter.

The loop to generate arbitrary content is:

  1. prepend \x1b$)C to our string as described above

  2. apply some chain of iconv conversions that leaves our initial base64 intact and converts the part we just prepended to some string where the only valid base64 char is the next part of our base64-encoded php code

  3. base64-decode and base64-encode the string which will remove any garbage in between

  4. Go back to 1 if the base64 we want to construct isn't finished yet

  5. base64-decode to get our php code

Includes usually do things like appending ".php" at the end of the file, which could diffecult the exploitation of this because you would need to find a .php file with a content that does't kill the exploit... or you could just use php://temp as resource because it can have anything appended in the name (lie +".php") and it will still allow the exploit to work!

How to add also suffixes to the resulting data

This writeup explains how you can still abuse PHP filters to add suffixes to the resulting string. This is great in case you need the output to have some specific format (like json or maybe adding some PNG magic bytes)

Automatic Tools

Full script

Improvements

The previous script is limited to the base64 characters needed for that payload. Therefore, I created my own script to bruteforce all the base64 characters:

Here is the script to get encodings that generate each b64 letter:

More References

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
Previousphar:// deserializationNextLFI2RCE via Nginx temp files

Last updated