I would like to ask a question about exploiting the PHP function readfile. So I'm geting payed for hacking a site, and I need to read a PHO file named readme.php through a PHP file named read.php, that contains the following code:

$path = $_GET['p'];

So I can't read the readme.php file because it automatically adds the /index.html. In this case, is there a way to read the PHP file?

  • 1
    @silverpenguin you need to try this attack for yourself. There are multiple reasons why that is an invalid payload. PHP patched nullbyte injection for file-io functions, and that isn't a null byte injection payload.
    – rook
    Nov 20 '16 at 16:38

Beside PHP is interpreted, version <= to PHP 5.3.4 are vulnerable to an attack commonly call null byte injection.

To declare a string in php, you use $var = "hey" which is then equivalent in C to char tab[4]="hey". Notice that we declared a 4 bytes array of characters while we only want to store 3 characters. This is because compiler automatically insert the null byte character. Your final string is then hey\0

tab is a pointer which point on the first character of your string. Your computer will read from the first character to the null byte character (0 in hexadecimal) represented by \0.

%00 is the representation of the null byte character in PHP.

When you are calling a function with a string, like readfile("pages/$path/index.html");, your string get stored in a variable. Let's call it $tmp=pages/pathFromVariable/index.html which in reality will be stored in memory as pages/pathFromVariable/index.html\0

Now, if you inject null byte at the end of your input, you can erase the end of the string. for example, if $tmp=pages/pathFromVariable%00/index.html it will be stored as pages/pathFromVariable\0/index.html\0 which will result into reading the file pages/pathFromVariable ! Pwned !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.