0

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running on localhost), we came to the conclusion that the only possible place to inject anything is following code snippet:

if (!file_exists($filepath . $file . '.php')) { redirect_main_page(); } include_once($filepath . $file . '.php');

However, we have further constraints ini_set("include_path", ".:../etc/:../files/");

So is there any way to exploit the include? The ultimate goal is to display the /var/www/html/project/etc/config.php on the website.

What we have tried so far:

->Fatal Error: include_once(): Failed opening '/var/www/html/project/files/../etc/config.php' for inclusion (include_path='.:../etc/:../pages/') (2).

1

Why are you using %00 at the end of your input? You're getting it "free" :) from the code itself in the . ".php" part

I'm guessing that the challenge is not in PHP7, since you can't terminate strings like that any more.

Anyway, using the payload ../etc/config (without null - %00) works for me:

enter image description here

However, maybe my setup is wrong:

/opt/lampp/htdocs/project/files/test.php:

<?php
ini_set("include_path", ".:../etc/:../files/");

$filepath = "/opt/lampp/htdocs/project/files/";
$file = $_GET['page'];


echo("<h2> final path - <b>".$filepath . $file . '.php' . "</b></h2>");
if (!file_exists($filepath . $file . '.php')) {
         echo "FAIL";
         exit();
}

include_once($filepath . $file . '.php');

/opt/lampp/htdocs/project/etc/config.php:

<?php
echo "<br>WIN<br>";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.