4

During pentesting, I came across a target vulnerable to local file inclusiong:

include("$rootpath/includes/dir/".$_GET["section"].".php");

When I visit the URL http://target.com/img?section=images it works perfectly as images.php is present in the $rootpath/includes/dir/ directory. When I visit http://target.com/img?section=images.php I get nothing, indicating that the server could not find any images.php.php file.

Is there any way to bypass the .php append restriction? I tried http://target.com/img?section=images.php%00 but the webserver is now trying to find http://target.com/img?section=images.php%00.php file. I want to read the /etc/passwd file.

  • I never faced these types of problem, have you tried to inject the CRLF character. Maybe it worth to try. Something like, http://target.com/img?section=images.php%0d%0a – Utkarsh Agrawal Jun 28 '18 at 16:49
  • Now, I believe that the LFI you found is limited to .php. – Utkarsh Agrawal Jun 28 '18 at 17:12
0

I believe %00 in url does not work. You need to use some packet modification software such as Burp Suite and edit the request to contain actual null terminator character.

  • 4
    I don't think the way the null byte is encoded matters here since PHP refuses to include() a filename containing a null byte either way. – Arminius Apr 29 '18 at 23:00
0

Have you tried using a tool that will allow you to control requests/responses to the server such as Burp Suite that Peter suggested? This way you can try various tricks like intercepting requests and responses that may lead to bypassing the php append.

And since your goal is to see if the server is vulnerable to directory traversal or poor Access management, you can simply try a series of ../ in the URL or on Burp Suite until you get error messages suggesting you are in the right directly or if lucky you hit the jackpot and the app allows you to download the passwd file e.g. http://target.com/img?section=images.php/../../../../etc/passwd

0

I don't know of any way to bypass that restriction, but reading /etc/passwd is pretty boring anyhow. Is there a file upload function that you could possibly use to upload a .php file to the server? Then you could use this include bug to execute the code you uploaded, even if it's not within the webroot or otherwise unreachable just via a normal GET request. That gives you arbitrary code execution on the server, which is strictly more powerful than arbitrary local file include.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.