0

I have these two LFI filters and i want to bypass them

        $bad = str_replace('../','',$_GET['bad']);
        while( substr_count($bad, '../', 0)) {
            $bad = str_replace('../', '', $bad);
        };
        include("./".$bad);

I tried various ways and i was not able to bypass them, also the php wrappers are mostly used in php 5.* versions and before and i have php 7.6 version.

5
  • It would help if you describe what you have tried and what the response was. The obvious tactic is to simply not use ../. What other options have you tried?
    – schroeder
    Apr 23 at 7:36
  • the code has two str_replace() functions so whenever you give ../../../etc/passwd (or any variation of that) they alter the input to /etc/passwd. I used all the possible scenarios from payload of all things
    – Mike Anast
    Apr 23 at 7:40
  • ... and if you add 3?
    – schroeder
    Apr 23 at 8:33
  • You might want to try the suggestions in this answer
    – nobody
    Apr 23 at 13:25
  • You could try to abuse the browser that normalize the string so you can pass ..\` that will be normalized into ../` or you can try .;./ or %2e%2e/ Oct 22 at 6:30
0

I don't think you can do it, unless there are insecure and exploitable symlinks that allow bypassing the '../' removal filter and are reachable down from the current directory.

In other words, I believe that LFI filtering is adequate.

0

The filtering method is unsafe on windows as ..\ won't get replaced. Also you'll be able to include files from sub directories such as file.php?bad=uploads/shell.jpg

Wrappers won't work as the ./ path prefix isn't compatible with any of the wrapper URIs.

Exploitation of this would likely require multiple steps, f.ex writing php into a file in the same directory or a sub directory using file upload, csv export, temporary logs, etc.

You could also leak the content of non php files which might get you additional information to use against other parts of the application such as .htpasswd file for an admin interface, like: file.php?bad=admin/.htpasswd or admin/sql_dump.sql to be able to access additional functionality which may contain additional vulnerabilites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.