7

During pentesting, I came across a target vulnerable to local file inclusiong:

include("$rootpath/includes/dir/".$_GET["section"].".php");

When I visit the URL http://target.com/img?section=images it works perfectly as images.php is present in the $rootpath/includes/dir/ directory. When I visit http://target.com/img?section=images.php I get nothing, indicating that the server could not find any images.php.php file.

Is there any way to bypass the .php append restriction? I tried http://target.com/img?section=images.php%00 but the webserver is now trying to find http://target.com/img?section=images.php%00.php file. I want to read the /etc/passwd file.

3
  • 1
    I never faced these types of problem, have you tried to inject the CRLF character. Maybe it worth to try. Something like, http://target.com/img?section=images.php%0d%0a Jun 28, 2018 at 16:49
  • Now, I believe that the LFI you found is limited to .php. Jun 28, 2018 at 17:12
  • 1
    Any chance they have a file upload you can a use to get a PHP file on their server? Dec 14, 2019 at 1:23

3 Answers 3

3

Unfortunately (for the attacker) this specific technique only applies to PHP 5.3 and below. It is likely that you are encountering a newer version considering the last release of PHP 5.3 was in August 2014.

Here's a bug listing for PHP and there are multiple articles and resources specifically mentioning the null byte bypass in LFI being restricted to before PHP 5.4:

Note: some references say 5.3.4 and below specifically, and I was looking deeper into this but I stopped pursuing the rabbit down the hole as "5.3 and below" likely answers why the bypass is not working :).

1

I don't know of any way to bypass that restriction, but reading /etc/passwd is pretty boring anyhow. Is there a file upload function that you could possibly use to upload a .php file to the server? Then you could use this include bug to execute the code you uploaded, even if it's not within the webroot or otherwise unreachable just via a normal GET request. That gives you arbitrary code execution on the server, which is strictly more powerful than arbitrary local file include.

-1

Have you tried using a tool that will allow you to control requests/responses to the server such as Burp Suite that Peter suggested? This way you can try various tricks like intercepting requests and responses that may lead to bypassing the php append.

And since your goal is to see if the server is vulnerable to directory traversal or poor Access management, you can simply try a series of ../ in the URL or on Burp Suite until you get error messages suggesting you are in the right directly or if lucky you hit the jackpot and the app allows you to download the passwd file e.g. http://target.com/img?section=images.php/../../../../etc/passwd

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .