So I'm working on a boot to root and I think I may have found a section that I can inject php. The problem is when I inject my php it gets commented out. I'm trying to find what function this is so I can see if there's a work around but for the life of me I can't find it because these terms are so ambiguous.

Does anyone know the php function that will take:

<?php echo 'it works'; ?>

and turn it into

<-- ?php echo 'it works'; ?-->


I'm fairly certain that there is no php standard library function that does that. So it's probably some kind of home brew. Off course, it's impossible to say exactly what the function looks like without access to the source code or extensive testing, but one simple guess would be something like this:

$halfway = str_replace('<', '<-- ', $input);
$result = str_replace('>', '-->', $halfway);

But there is an unlimited number of possibilities here. Your best bet is to play around with it and see if something unexpected happends.

Another tip for bypassing this... I found this little note in the changelog for PHP 7.0.0 in the PHP manual:

The ASP tags <%, %>, <%=, and the script tag <script language="php"> are removed from PHP.

So if you are running PHP below 7 you could try those. Or just a simple <?=.

  • Yeah after mangling the tags a little I can see that they're matching on <? and ?> so I think you're right. It must be a home brew. Now just to figure out a work around :-D – Anthony Russell Jun 25 '18 at 20:26
  • 1
    @AnthonyRussell See my edit for a little tip. – Anders Jun 25 '18 at 20:30
  • &#60;&#63;php echo 'it works'; &#63;&#62; doesn't work on my local machine but might on your target. – symcbean Jun 25 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.