Bypass Local File Inclusion(LFI) prevention filters

Question

I have these two LFI filters and i want to bypass them

        $bad = str_replace('../','',$_GET['bad']);
        while( substr_count($bad, '../', 0)) {
            $bad = str_replace('../', '', $bad);
        };
        include("./".$bad);

I tried various ways and i was not able to bypass them, also the php wrappers are mostly used in php 5.* versions and before and i have php 7.6 version.

Answer 1

The filtering method is unsafe on windows as ..\ won't get replaced. Also you'll be able to include files from sub directories such as file.php?bad=uploads/shell.jpg

Wrappers won't work as the ./ path prefix isn't compatible with any of the wrapper URIs.

Exploitation of this would likely require multiple steps, f.ex writing php into a file in the same directory or a sub directory using file upload, csv export, temporary logs, etc.

You could also leak the content of non php files which might get you additional information to use against other parts of the application such as .htpasswd file for an admin interface, like: file.php?bad=admin/.htpasswd or admin/sql_dump.sql to be able to access additional functionality which may contain additional vulnerabilites.

Answer 2

I don't think you can do it, unless there are insecure and exploitable symlinks that allow bypassing the '../' removal filter and are reachable down from the current directory.

In other words, I believe that LFI filtering is adequate.