2

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL:

http://127.0.0.1/download.php?file=file.txt&hash=[the valid md5 hash]

I'm trying to print out /etc/passwd using this:

http://127.0.0.1/download.php?file=file.txt��/../../../etc/passwd&hash=[extended valid hash]

The backend first checks whether the provided MD5 is valid and then prints out the requested file. I'm using the PHP functions fopen and fread for that.

I'm able to create valid hashes for arbitrary strings but PHP fails with the following error:

Warning: fopen() expects parameter 1 to be a valid path, string given in /var/www/html/download.php

Note: The characters �� in the URL are due to the MD5 padding of the hash extension.

4

Since PHP 5.3.4, an error is thrown if a path contains a null byte.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.