Firstly, I make the obligatory disclaimer that everything I am doing here is legitimate and pre-authorized, etc., etc.
For those unfamiliar with user session local file inclusion in PHP, there's a nice example of it here in section 2.2.4: http://www.enye-sec.org/en/papers/web_vuln-en.txt
I am auditing a Web service that suffers an LFI vulnerability that can only be exploited via a session file include (I have no rights to read /proc/self/environs, Apache access/error logs, etc.). The contents of the original session file look like this (modified from the original for secrecy):
I can modify the sig parameter by using a proxy to intercept the Web traffic. For example, by changing sig=0 to sig=hello, I see:
So far, so good. The problem comes when I try to inject PHP code instead of a text string. Using any of the code below, I see the same result:
<?php passthru($_GET['cmd']); ?> <?php system($_GET['cmd']); ?> <?php exec($_GET['cmd']); ?>
The session file registers the code string lengths correctly, but the contents are apparently filtered out.
Either way, I cannot get my PHP code to run, as this returns nothing.
I feel like I'm missing something quite simple, but I'm not too experienced with PHP; thus, I'd very much appreciate any and all ideas.