Local file inclusion when URL is appended with .php?

Question

During pentesting, I came across a target vulnerable to local file inclusiong:

include("$rootpath/includes/dir/".$_GET["section"].".php");

When I visit the URL http://target.com/img?section=images it works perfectly as images.php is present in the $rootpath/includes/dir/ directory. When I visit http://target.com/img?section=images.php I get nothing, indicating that the server could not find any images.php.php file.

Is there any way to bypass the .php append restriction? I tried http://target.com/img?section=images.php%00 but the webserver is now trying to find http://target.com/img?section=images.php%00.php file. I want to read the /etc/passwd file.

Answer 1

Unfortunately (for the attacker) this specific technique only applies to PHP 5.3 and below. It is likely that you are encountering a newer version considering the last release of PHP 5.3 was in August 2014.

Here's a bug listing for PHP and there are multiple articles and resources specifically mentioning the null byte bypass in LFI being restricted to before PHP 5.4:

• Offensive Security's File Inclusion Vuln -- In versions of PHP below 5.3, ending the URL with a null byte (%00) would cause the interpreter to stop reading, which would allow the attacker to include their intended page.
• PayloadAllTheThings File Inclusion reference
• Rawsec LFI

Note: some references say 5.3.4 and below specifically, and I was looking deeper into this but I stopped pursuing the rabbit down the hole as "5.3 and below" likely answers why the bypass is not working :).

Answer 2

I don't know of any way to bypass that restriction, but reading /etc/passwd is pretty boring anyhow. Is there a file upload function that you could possibly use to upload a .php file to the server? Then you could use this include bug to execute the code you uploaded, even if it's not within the webroot or otherwise unreachable just via a normal GET request. That gives you arbitrary code execution on the server, which is strictly more powerful than arbitrary local file include.

Answer 3

Have you tried using a tool that will allow you to control requests/responses to the server such as Burp Suite that Peter suggested? This way you can try various tricks like intercepting requests and responses that may lead to bypassing the php append.

And since your goal is to see if the server is vulnerable to directory traversal or poor Access management, you can simply try a series of ../ in the URL or on Burp Suite until you get error messages suggesting you are in the right directly or if lucky you hit the jackpot and the app allows you to download the passwd file e.g. http://target.com/img?section=images.php/../../../../etc/passwd