How can I inject real php code into this website?

Question

So I found a file uploader on example.com. The file uploader accepts every file extension and the file is uploaded inside the directory

/temp/random-numeric-id.php

I tried to upload a php file and it got uploaded, however when I access that file, the content of the file is read as html comment. For example, I uploaded a file with content <?php print(123); ?> and when I visit example.com/temp/111111111.php I see a blank page because my php code has became the following:

<!--?php print(123); -->

Is this some kind of protection mechanism? How can I bypass this to execute my print functionality with php on that server?

Answer 1

This is... strange. My guess is that you are right in that this is some sort of protection mechanism, but it doesn't look like a very stable one. A better approach would be to block files with .php or similar extensions, and on top of that turn off PHP execution in that folder.

So can this be exploited, and if so, how? I am not sure, but here are a few things to try:

• Different PHP tags (<?, <?=, <%, <%=, <script language="php">).
• Insert whitespace and try different cases, e.g. <?PHp or <? pHp. (Not sure if the PHP engine will recognise this, though.)
• Leave out the closing tag, try nesting tags inside tags, and so on.
• Maybe it only does the replacement for PHP files? Then you could use .php5 or .phtml or similar instead.

To figure out a bypass (if there is one), you need to guess how the system works and test your theories. E.g. if you suspect it simply replace all < with <!--, send in a lone < and see what happends! Don't be afraid to experiment. Trial and error is your friend.

Answer 2

Have you tried using a directive based file upload such a self contained htaccess she'll like my htshells project: https://github.com/wireghoul/htshells