1

I'm reading this blog and it says:

If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written into the HTTP User-Agent field.

Then, it goes on to say:

GET lfi.php?file=../../../proc/self/environ HTTP/1.1
User-Agent: <?php phpinfo();?>

Now if an attacker sends the above http request to the web server then :

  1. First the data on User-Agent field will written on the /proc/self/environ file.
  2. Then the page request "lfi.php?file=../../../proc/self/environ" will include the content of /proc/self/environ file into the output page and our payload is get executed.

Now, I understand the first part of it that when we include /proc/self/environ, a Linux-based operating system fills the file with information related to the environment it was called from. In our case, it gets populated with the HTTP request as our environment happens to be a browser.

What I do not understand is why is the content of the HTTP request is getting executed? Looking at it from a developer's standpoint, lfi.php gets executed and there's a function in the file that reads the content of the file passed to it as a parameter. So, the content of the file /proc/self/environ and by extension, the content of the HTTP request should be read and not executed.

Can someone please explain what am I missing?

2
  • As said below, lfi is when the file is "included" via a function that executes code. Simply reading files is a traversal vulnerability or lfd, although many seems to confuse these two bug classes
    – wireghoul
    Commented May 18, 2021 at 13:31
  • In my humble opinion You should investigate on apache log poisoning to RCE Commented Oct 16, 2021 at 11:58

2 Answers 2

0

I think when it works like that (if it works like that?) it's because in old versions of php, PHP code was executed as it was output by the server. In a normal .php file that is part html and part php, maybe the webserver would spit out all html until it hits a <?php statement and then starts executing the php code. I'm not quite sure because I can't replicate it with a modern copy of php.

For what it's worth I just tried it on a webhosting account that uses PHP 7.2.30 and it really doesn't seem to work that way (anymore?). I'm really not an expert. Obviously, if you include, include_once, require, etc a file from a variable it'll become RCE.

first test (wont work):

<?php
  readfile($_GET['lfi']);
?>

third test (will work):

<?php
      $str = $_GET['lfi'];
      include $str;
?>`

The wikipedia page just says that it needs to be a function that executes files, and then gives a good example of why someone might code an application that way. https://en.wikipedia.org/wiki/File_inclusion_vulnerability#PHP

0

According to PHP Include Documentation

" When a file is included, parsing drops out of PHP mode and into HTML mode at the beginning of the target file and resumes again at the end. For this reason, any code inside the target file which should be executed as PHP code must be enclosed within valid PHP start and end tags. "

The above statement doesn't mention the extension as a requirement, the most important thing is that the code to be executed must be enclosed within valid PHP start and end tags.

As an example below simple LFI-vulnerable application:

LFI-vulnerable

As you can see below I created multiple file extensions all of which contain PHP code that echo 'Hi CPUKiller' and then calls phpinfo().

Files

As you can see below screenshots all files execute PHP code and the extension doesn't matter in this case:

CPUKillerTest

CPUKillerTest.whatever

And so on...

The only case that our include will not execute, is when we create a file with invalid PHP tags as you can see below, I have created a file with invalid PHP tags to test:

enter image description here

if we then tried to include this file using LFI it will not work as you can see below:

Wrong

Conclusion

There is a reason why Log Poisoning is a very powerful technique you can use to escalate LFI to RCE by poisoning any file you add input to it and read it using LFI this file can be any log file such as apache access and error log files, SSH log files, SMTP Log files, any file that contain any request data you can control. since the important thing is to add valid PHP tags it will work if you did!

Hope that helped!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .