LFI2RCE via PHP_SESSION_UPLOAD_PROGRESS
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
If you found a Local File Inclusion even if you don't have a session and session.auto_start is Off. If session.upload_progress.enabled is On and you provide the PHP_SESSION_UPLOAD_PROGRESS in multipart POST data, PHP will enable the session for you.
Note that with PHP_SESSION_UPLOAD_PROGRESS you can control data inside the session, so if you includes your session file you can include a part you control (a php shellcode for example).
Due to the default setting of session.upload_progress.prefix, our SESSION file will start with a annoying prefix upload_progress_ Such as: upload_progress_controlledcontentbyattacker
The trick to remove the initial prefix was to base64encode the payload 3 times and then decode it via convert.base64-decode filters, this is because when base64 decoding PHP will remove the weird characters, so after 3 times only the payload sent by the attacker will remain (and then the attacker can control the initial part).
In the where this technique is commented, it wasn't enough to exploit the Race Condition but the content loaded needed to start also with the string @<?php.
More information in the original writeup and final exploit Another writeup in
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.
