Exploiting the PHP readfile function when a filename is appended to the path

Question

I would like to ask a question about exploiting the PHP function readfile. So I'm geting payed for hacking a site, and I need to read a PHO file named readme.php through a PHP file named read.php, that contains the following code:

<?php
$path = $_GET['p'];
readfile("pages/$path/index.html");
?>

So I can't read the readme.php file because it automatically adds the /index.html. In this case, is there a way to read the PHP file?

Answer 1

Beside PHP is interpreted, version <= to PHP 5.3.4 are vulnerable to an attack commonly call null byte injection.

To declare a string in php, you use $var = "hey" which is then equivalent in C to char tab[4]="hey". Notice that we declared a 4 bytes array of characters while we only want to store 3 characters. This is because compiler automatically insert the null byte character. Your final string is then hey\0

tab is a pointer which point on the first character of your string. Your computer will read from the first character to the null byte character (0 in hexadecimal) represented by \0.

%00 is the representation of the null byte character in PHP.

When you are calling a function with a string, like readfile("pages/$path/index.html");, your string get stored in a variable. Let's call it $tmp=pages/pathFromVariable/index.html which in reality will be stored in memory as pages/pathFromVariable/index.html\0

Now, if you inject null byte at the end of your input, you can erase the end of the string. for example, if $tmp=pages/pathFromVariable%00/index.html it will be stored as pages/pathFromVariable\0/index.html\0 which will result into reading the file pages/pathFromVariable ! Pwned !