1

I am working on hackme, which introduce LFI in php code.

<?php
if (isset($_COOKIE["user"])) {
    $file="txt/".$_COOKIE["user"];
    include $file;
}
?>

So I can include any file from the system by just setting cookie user to file location, eg: "../../../etc/passwd".

Is there any way to use this vulnerability to execute my own php code?

I have tried using:

  • /proc/self/environ
  • /proc/self/fd/0
  • /proc/self/fd/1
  • /proc/self/fd/...

neither was working (no results) and errors was similar to this one:

include(txt/../../../proc/self/fd/2): failed to open stream: Permission denied

|improve this question|||||
  • This is the absolute basic of LFI, so you might want to work through some of the standard tutorials first. E.g., you might be successful with the /proc/self/environ method. – Arminius Aug 4 '17 at 13:25
  • I have tried /proc/self/environ and /proc/self/fd/... but those are readable only by root. I also can't read log files (apache nor sshd - other services are not available) – user156041 Aug 4 '17 at 13:29
  • It would be great if you could incorporate that into your question and clarify what you tried. Otherwise answerers will just unnecessarily spend time reiterating the standard techniques. – Arminius Aug 4 '17 at 13:35
1

Well, there may be many ways to do something like this. I agree with the comments regarding doing some research into exactly what an LFI is doing, and looking a bit at RFIs to help understand the implicit differences.

As to your question, the answer would be yes, but strictly theoretical as we have no direct interaction with the application, therefore I do not know if the application is even vulnerable to other vectors that may come into play.

Without giving you the answer, as these types of vulnerable applications are for learning on your own, there are multiple ways to potentially execute PHP via LFI, most involving uploading a file in some way, but that's not nearly always the case. Some examples: via some sort of stored comments, accessing the page via LFI and having the code execute; via uploading through some sort of file upload functionality and accessing the shell you uploaded via the LFI; via turning your LFI into an RFI (have you tried?); via escaping the command that's causing the file read (your injection point), and running PHP after it, and a plethora of other potentials.

Since you control the cookie and it's reflected directly into the PHP, have you simply tried cleanly closing the statement the cookie gets dumped into, and writing more PHP afterward? This would be the first thing I would try when a value gets reflected, unmodified, into code in use on the server.

Hopefully this can be an answer 'enough'. These types of questions are a bit subjective, but this may help.

|improve this answer|||||
  • Is it possible then, to "close the statement" if code is not using eval function? If yes, could you provide working example? I have tried this, but no luck. – user156041 Aug 5 '17 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy